Observational Determinism for Concurrent Program Security Steve Zdancewic Andrew C. Myers Department of Computer and Information Science Computer Science Department University of Pennsylvania Cornell University
[email protected] [email protected] Abstract This paper makes two contributions. First, it presents a definition of information-flow security that is appropriate for Noninterference is a property of sequential programs that concurrent systems. Second, it describes a simple but ex- is useful for expressing security policies for data confiden- pressive concurrent language with a type system that prov- tiality and integrity. However, extending noninterference to ably enforces security. concurrent programs has proved problematic. In this pa- Notions of secure information flow are usually based on per we present a relatively expressive secure concurrent lan- noninterference [15], a property only defined for determin- guage. This language, based on existing concurrent calculi, istic systems. Intuitively, noninterference requires that the provides first-class channels, higher-order functions, and an publicly visible results of a computation do not depend on unbounded number of threads. Well-typed programs obey a confidential (or secret) information. Generalizing noninter- generalization of noninterference that ensures immunity to ference to concurrent languages is problematic because these internal timing attacks and to attacks that exploit informa- languages are naturally nondeterministic: the order of execu- tion about the thread scheduler. Elimination of these refine- tion of concurrent threads is not specified by the language se- ment attacks is possible because the enforced security prop- mantics. Although this nondeterminism permits a variety of erty extends noninterference with observational determin- thread scheduler implementations, it also leads to refinement ism.