Information-flow Type Research Articles

Secure information flow by self-composition

Information flow policies are confidentiality policies that control information leakage through program execution. A common way to enforce secure information flow is through information flow type systems. Although type systems are compositional and usually enjoy decidable type checking or inference, their extensibility is very poor: type systems need to be redefined and proved sound for each new variation of security policy and programming language for which secure information flow verification is desired.In contrast, program logics offer a general mechanism for enforcing a variety of safety policies, and for this reason are favoured in Proof Carrying Code, which is a promising security architecture for mobile code. However, the encoding of information flow policies in program logics is not straightforward because they refer to a relation between two program executions.The purpose of this paper is to investigate logical formulations of secure information flow based on the idea of self-composition, which reduces the problem of secure information flow of a program P to a safety property for a program derived from P by composing P with a renaming of itself. Self-composition enables the use of standard techniques for information flow policy verification, such as program logics and model checking, that are suitable in Proof Carrying Code infrastructures.We illustrate the applicability of self-composition in several settings, including different security policies such as non-interference and controlled forms of declassification, and programming languages including an imperative language with parallel composition, a non-deterministic language and, finally, a language with shared mutable data structures.

Implicit self-adjusting computation for purely functional programs

Computational problems that involve dynamic data, such as physics simulations and program development environments, have been an important subject of study in programming languages. Building on this work, recent advances in self-adjusting computation have developed techniques that enable programs to respond automatically and efficiently to dynamic changes in their inputs. Self-adjusting programs have been shown to be efficient for a reasonably broad range of problems but the approach still requires an explicit programming style, where the programmer must use specific monadic types and primitives to identify, create and operate on data that can change over time. We describe techniques for automatically translating purely functional programs into self-adjusting programs. In this implicit approach, the programmer need only annotate the (top-level) input types of the programs to be translated. Type inference finds all other types, and a type-directed translation rewrites the source program into an explicitly self-adjusting target program. The type system is related to information-flow type systems and enjoys decidable type inference via constraint solving. We prove that the translation outputs well-typed self-adjusting programs and preserves the source program's input-output behavior, guaranteeing that translated programs respond correctly to all changes to their data. Using a cost semantics, we also prove that the translation preserves the asymptotic complexity of the source program.

Understanding Organisational Culture as a Trait Theory

This paper aims at an organisational culture theory redefining existing concepts of organisational or corporate culture dimensions. It does this by embracing a new concept of organisational culture that fits with thematic classes of organisation theory. Knowledge cybernetics will be used to show the interconnections (interaction processes) between thematic fields of organisation theory following Hatch and Cunliffe (2006). Its perspective is that social collectives have collective minds that can be explored in terms of their social psychological processes, and personalities. In concert with Bandura's concept of collective agency, that of normative personality is integrated into organisational context and Piaget's notions of how the mind operates are applied to the organisation. Organisational culture manifests itself by different emphasis given to different types of the interconnections interactions between the organisation and its environments and different emphasis on different types of information and knowledge flows within the organisation. The paper offers a theoretical construct exploring organisational culture from the perspective of thematic fields of organisation theory. It requires further elaboration and development of a questionnaire to be tested in different contexts and samples. It has the capacity to provide pragmatic meaning in case studies and may contribute to identification of dysfunctions of information and knowledge management in organisations. This is the first approach to take a view from the thematic fields of organisation theory on research into organisational culture by applying knowledge cybernetics.

The Non-Interference Protection in BML

Many information-flow type systems have been developed that allow to control the non-interference of information between the levels of classification in the Bell-LaPadula model. We present here a translation of typing information collected for bytecode programs to a bytecode program logic. This translation uses the syntax of a bytecode specification language BML. A translation of this kind allows including the check of the non-interference property in a single, unified verification framework based on a program logic and thus can be exploited within a foundational proof-carrying code infrastructure. It also provides a flexible basis for various declassification strategies that may be useful in a particular code body.

Secure information flow for a concurrent language with scheduling

Information flow type systems provide an elegant means to enforce confidentiality of programs. Using the proof assistant Isabelle/HOL, we have specified an information flow type system for a concur...

Run-time principals in information-flow type systems

Information-flow type systems are a promising approach for enforcing strong end-to-end confidentiality and integrity policies. Such policies, however, are usually specified in terms of static information—data is labeled high or low security at compile time. In practice, the confidentiality of data may depend on information available only while the system is running. This article studies language support for run-time principals , a mechanism for specifying security policies that depend on which principals interact with the system. We establish the basic property of noninterference for programs written in such language, and use run-time principals for specifying run-time authority in downgrading mechanisms such as declassification. In addition to allowing more expressive security policies, run-time principals enable the integration of language-based security mechanisms with other existing approaches such as Java stack inspection and public key infrastructures. We sketch an implementation of run-time principals via public keys such that principal delegation is verified by certificate chains.

Dimensions of Information and Resource Flow in Healthcare Systems

This study focuses on classifying human interactions in healthcare delivery in terms of the information and resource flows at multiple levels of analysis. Understanding the characteristic healthcare delivery requirements and communication patterns among healthcare professionals seems to be necessary to effectively support information sharing and coordination. We analyzed communication links between healthcare providers and dissected different types of information and resource flow. We identified four dimensions of information and resource flow: spatial proximity, flow requirement, modality, and flow path. Now that we have set a new methodology to characterize them, we can easily distinguish the various information and resource flow types. When applying these finding in simulating healthcare systems in order to analyze information and resource sharing and coordination, the above four dimensions would serve as attributes of the flowing entities. Finally, we demonstrate that the results of this study are the natural first step towards developing an efficient healthcare quality measurement tool.

Geography, Informal Information Flows and Mutual Fund Portfolios

Previous papers have uncovered the existence of different information flows linked to the geographical location of portfolio investors. Yet, the potentially crucial interactions of multiple information flows linked to geographical location have not received much empirical scrutiny. The primary focus of this study is on the value and interaction of two types of information flows linked to the location of mutual fund managers: information transfers among fund managers (fund-fund flows), and between the holding companies and the fund managers (fund-company flows). We show that while these informal information flows can increase risk-adjusted returns from holdings, the relationship depends critically on the interactions between the two types of information channels considered. Empirical results support the notion of a counter-effective rather than reinforcing relationship between the different information channels. Specifically, we find that (1) fund-fund (fund-company) information flows help in generating positive risk-adjusted returns from holdings in the absence of fund-company (fund-fund) flows; (2) any informational advantages are reversed when the two information flows cumulate. The stocks selected in the more beneficial information environments (defined ex-post) during a portfolio quarter also exhibit positive future returns beyond the quarter, alluding to the ability of these information flows to aid in picking undervalued assets.

Level of visualization support for project communication in the Turkish construction industry: A quality function deployment approach

Quality of communication is a key factor in the success of construction projects. Visualization technologies can play an important role in improving the quality of data by improving human comprehension and increasing the depth of the information delivered. Visualization has for some time been identified as one of the major technology themes allowing development of construction processes. However, visualization has not been embraced as a strategic tool by construction companies, and they generally fail to take full advantage of available visualization tools. This paper aims to evaluate the extent of visualization as a communication tool in the construction industry and to determine potential benefits to be gained through implementation of visualization. The current state of the use of visualization for communication in Turkish architecture, engineering, and construction companies is mapped through surveys and interviews. Information flow contents and types are analysed to determine the types of information in the construction process that may benefit from visual representation. According to the priorities of the expectations ranked by the users and the potential of different visualization tools, the level of visualization required for each data flow is determined by a quality function deployment (QFD) based approach.Key words: visualization, construction, visual communication, quality.

Secure information flow for a concurrent language with scheduling

Information flow type systems provide an elegant means to enforce confidentiality of programs. Using the proof assistant Isabelle/HOL, we have specified an information flow type system for a concurrent language featuring primitives for scheduling, and shown that typable programs are non-interfering for a possibilistic notion of non-interference. The development, which constitutes to our best knowledge the first machine-checked account of non-interference for a concurrent language, takes advantage of the proof assistant facilities to structure the proofs about different views of the programming language and to identify the relationships among them and the type system. Our language and type system generalize previous work of Boudol and Castellani, Theoretical Computer Science 281 (2002), 109-130, in particular by including arrays and lifting several convenient but unnecessary conditions in the syntax and type system of the work of Boudol and Castellani. We illustrate the generality of our language and the usefulness of our type system with a medium size example.

Harmless advice

This paper defines an object-oriented language with harmless aspect-oriented advice. A piece of harmless advice is a computation that, like ordinary aspect-oriented advice, executes when control reaches a designated control-flow point. However, unlike ordinary advice, harmless advice is designed to obey a weak non-interference property. Harmless advice may change the termination behavior of computations and use I/O, but it does not otherwise influence the final result of the mainline code. The benefit of harmless advice is that it facilitates local reasoning about program behavior. More specifically, programmers may ignore harmless advice when reasoning about the partial correctness properties of their programs. In addition, programmers may add new pieces of harmless advice to pre-existing programs in typical "after-the-fact" aspect-oriented style without fear they will break important data invariants used by the mainline code.In order to detect and enforce harmlessness, the paper defines a novel type and effect system related to information-flow type systems. The central technical result is that well-typed harmless advice does not interfere with the mainline computation. The paper also presents an implementation of the language and a case study using harmless advice to implement security policies.

Timing Aware Information Flow Security for a JavaCard-like Bytecode

Common protection mechanisms fail to provide end-to-end security; programs with legitimate access to secret information are not prevented from leaking this to the world. Information-flow aware analyses track the flow of information through the program to prevent such leakages, but often ignore information flows through covert channels even though they pose a serious threat. A typical covert channel is to use the timing of certain events to carry information. We present a timing-aware information-flow type system for a low-level language similar to a non-trivial subset of a sequential Java bytecode. The type system is parameterized over the time model of the instructions of the language and over the algorithm enforcing low-observational equivalence, used in the prevention of implicit and timing flows.

Information flows and option bid/ask spreads

AbstractThis study analyzes two types of information flows in financial markets. The first type represents return information, where informed investors know whether the stock price will increase or decrease. The second type is labeled volatility information, where the direction of the stock price is unknown, but informed investors know that the stock price either will increase or decrease. Both information flows are estimated within the GARCH framework, approximated with the use of Swedish OMX stockindex and options strangle return shocks, respectively. The results show significant conditional stock‐index and options strangle variance, although with notable differences. Stock‐index return shocks exhibit a high level of variance persistence and an asymmetric initial impact to the variance. Option strangle shocks have a relatively low persistence level, but a higher and more symmetric initial impact. A time‐series regression of call and put option bid/ask spreads is performed, relating the spreads to the information flows and other explanatory variables. The results show that call and put option bid/ask spreads are related to stock‐index and options strangle return shocks, as well as the conditional stock‐index variance. This is consistent with the view that market makers alter option spreads in response to return and volatility information flows, as well as the conditional stock‐index variance.© 2005 Wiley Periodicals, Inc. Jrl Fut Mark 25:1147–1172, 2005

Security types preserving compilation

Starting from the seminal work of Volpano and Smith, there has been growing evidence that type systems may be used to enforce confidentiality of programs through non-interference. However, most type systems operate on high-level languages and calculi, and “low-level languages have not received much attention in studies of secure information flow” (Sabelfeld and Myers, [Language-based information-flow security. IEEE Journal on Selected Areas in Communications 2003; 21:5–19]). Therefore, we introduce an information flow type system for a low-level language featuring jumps and calls, and show that the type system enforces termination-insensitive non-interference. Furthermore, information flow type systems for low-level languages should appropriately relate to their counterparts for high-level languages. Therefore, we introduce a compiler from a high-level imperative programming language to our low-level language, and show that the compiler preserves information flow types.

Quantitative Information Flow, Relations and Polymorphic Types

This paper uses Shannon's information theory to give a quantitative definition of information flow in systems that transform inputs to outputs. For deterministic systems, the definition is shown to specialize to a simpler form when the information source and the known inputs jointly determine all inputs uniquely. For this special case, the definition is related to the classical security condition of non-interference and an equivalence is established between non-interference and independence of random variables. Quantitative information flow for deterministic systems is then presented in relational form. With this presentation, it is shown how relational parametricity can be used to derive upper and lower bounds on information flows through families of functions defined in the second-order lambda calculus.

Downgrading policies and relaxed noninterference

In traditional information-flow type systems, the security policy is often formalized as noninterference properties. However, noninterference alone is too strong to express security properties useful in practice. If we allow downgrading in such systems, it is challenging to formalize the security policy as an extensional property of the system.This paper presents a generalized framework of downgrading policies. Such policies can be specified in a simple and tractable language and can be statically enforced by mechanisms such as type systems. The security guarantee is then formalized as a concise extensional property using program equivalences. This relaxed noninterference generalizes traditional pure noninterference and precisely characterizes the information released due to downgrading.

Information Asymmetry, Bid-Ask Spreads and Option Returns

This study analyses the information asymmetry at the stock market considering two different types of information flow. The first type represents changes in information where informed traders know if the stock price will increase or decrease. The second type is less specific - the direction is unknown, but informed traders know that the stock price either will increase or decrease. The different flows of information are estimated within a GARCH framework, using shocks in Swedish OMX-index returns and index option strangle returns respectively. The results show significant conditional variance in index returns and options strangle returns, although with notable differences. The index returns exhibit a high level of variance persistence, and an asymmetric initial impact of return shocks to variance (leverage effect). The strangle returns have a relatively low variance persistence, but a higher (and more symmetric) initial impact of return shocks. A time series regression of call and put option bid-ask spreads is performed, relating spreads to these two types of information, as well as other explanatory variables. The results show that option spreads are related to shocks in index and options strangle returns, as well as the conditional variance of the stock returns. Hence, market makers appear to alter option bid-ask spreads primarily in response to unexpected shocks in stock and strangle returns - and to changes in the expected variance level of stock returns.

Process integration using the design structure matrix

AbstractA process, as a kind of system, derives its added value from the relationships among its elements (e.g., activities). For a group of activities to be truly integrated (versus merely aggregated), the flow of deliverables among them must be well defined, agreed to, and committed to. Engineering processes are especially complex because of the large number of interdependencies among the activities, as many types of information flow to many destinations. A process model of what actually flows must be extracted from the existing, implicit way work really gets done. Since this requires getting “close” to where work is actually done, it is beyond the ability of a single, centralized group to build the entire model. Instead, a number of process “puzzle pieces” must be integrated into a single process model that will have more holistic descriptive, analytical, and prescriptive value. (The systems engineering “V” model applies to processes as well as to products.) This paper applies a powerful technique for representing and analyzing complex processes, the design structure matrix (DSM). The paper shows how to use the DSM to display both internal and external inputs and outputs, thereby defining the “edges” of the process puzzle pieces so they can be assembled to form large, integrated processes where value can flow. Process definition and integration is akin to “mapping the genome” of how work is efficiently and effectively accomplished across disciplines and organizations. It is an important enabler of process understanding and improvement. © 2002 Wiley Periodicals, Inc. Syst Eng 5: 180–193, 2002

4.2.3 From Process Aggregation to Process Integration

Abstract1A process is a kind of system. As such, it derives its added value from the relationships among its elements (e.g., activities). For a group of activities to be truly integrated (versus merely aggregated), their interfaces must be well defined. In engineering processes, these interfaces usually indicate a flow of information. Engineering processes are extremely complex because of the large number of interfaces, as many types of information flow to many destinations. While the general structure of a process architecture is specified top‐down, the description of what actually flows must be extracted from the existing, implicit way work really gets done. Detailed descriptions of various processes must then be integrated into a process model that will have some prescriptive value. (The systems engineering “V” model applies to processes as well as to products.) This paper applies a powerful technique for representing and analyzing complex processes, the design structure matrix (DSM). The paper shows how to use the DSM to account for both internal and external inputs and outputs, providing the basis for process “puzzle pieces” that can be assembled to form large, integrated processes where value can flow.

Providing content and facilitating social change: Electronic media in rural development based on case material from Peru

In his famous book Understanding media, Marshall McLuhan discusses the impact he expects (networked) electronic media to have on the world. Since then the emergence of a 'global village' has become a universally accepted idea. McLuhan is perhaps more to the point when he observes that "The organic everywhere supplants the mechanical. Dialogue supersedes the lecture" (McLuhan, 1964; pp. 255-256). This paper takes a cue from McLuhan and discusses the way different types of information flows reveal the underlying power structures related to the provision and exchange of information. In line with McLuhan it is argued that 'dialogue', or information exchange, through networked media will have to play a role of increasing importance in development, whereby dialogues will have 'horizontal' and 'vertical' dimensions. Networked media are in that way to facilitate rural networking and social change. In its essence information provision, or 'lecture' is claimed to strengthen existing power structures, to create dependencies and to lead to a mismatch between information demand and supply. Despite the fact that networked electronic media are favored for rural development, they obviously do not have the same reach and levels of access and accessability as the traditional electronic media do. Another distinction between media is the type of information and content they are able to convey in a message, whereby significant differences between traditional and networked electronic media can be distinguished. Based on the two above mentioned distinctions between electronic media combinations of electronic media are suggested for use in rural development, both to improve the quality of the information provided and to change existing information and communication related power structures.