Search

Maintaining diversity in drug development in research into Alzheimer's disease (AD) is necessary to avoid over-reliance on targeting AD neuropathology. Treatments that reduce or prevent the generation of oxidative stress, frequently cited for its causal role in the aging process and AD, could be useful in at-risk populations or diagnosed AD patients. However, in this review, it is argued that clinical research into antioxidants in AD could provide more useful feedback as to the therapeutic value of the oxidative stress theory of AD. Improving comparability between randomized controlled trials (RCTs) is vital from a waste-reduction and priority-setting point of view for AD clinical research. For as well as attempting to improve meaningful outcomes for patients, RCTs of antioxidants in AD should strive to maximize the extraction of clinically useful information and actionable feedback from trial outcomes. Solutions to maximize information flow from RCTs of antioxidants in AD are offered here in the form of checklist questions to improve ongoing and future trials centered around the following dimensions: adhesion to reporting guidelines like CONSORT, biomarker enrichment, simple tests of treatment, and innovative trial design. [ABSTRACT FROM AUTHOR]

Background: Working memory deficits in Alzheimer's disease (AD) are linked to impairments in the retrieval of stored memory information. However, research on the mechanism of impaired working memory retrieval in Alzheimer's disease is still lacking. Objective: The medial prefrontal cortex (mPFC) and mediodorsal thalamus (MD) are involved in memory retrieval. The purpose of this study is to investigate the functional interactions and information transmission between mPFC and MD in the AD model. Methods: We recorded local field potentials from mPFC and MD while the mice (APP/PS1 transgenic model and control) performed a T-maze spatial working memory task. The temporal dynamics of oscillatory activity and bidirectional information flow between mPFC and MD were assessed during the task phases. Results: We mainly found a significant decrease in theta flow from mPFC to MD in APP/PS1 mice during retrieval. Conclusions: Our results indicate an important role of the mPFC-MD input for retrieval and the disrupted information transfer from mPFC to MD may be the underlying mechanism of working memory deficits in APP/PS1 mice. [ABSTRACT FROM AUTHOR]

Replay attacks are among the most well-known attacks against vote privacy. Many e-voting systems have been proven vulnerable to replay attacks, including systems like Helios that are used in real practical elections. Despite their popularity, it is commonly believed that replay attacks are inefficient but the actual threat that they pose to vote privacy has never been studied formally. Therefore, in this paper, we precisely analyze for the first time how efficient replay attacks really are. We study this question from commonly used and complementary perspectives on vote privacy, showing as an independent contribution that a simple extension of a popular game-based privacy definition corresponds to a strong entropy-based notion. Our results demonstrate that replay attacks can be devastating for a voter's privacy even when an adversary's resources are very limited. We illustrate our formal findings by applying them to a number of real-world elections, showing that a modest number of replays can result in significant privacy loss. Overall, our work reveals that, contrary to a common belief, replay attacks can be very efficient and must therefore be considered a serious threat. [ABSTRACT FROM AUTHOR]

Replay attacks are among the most well-known attacks against vote privacy. Many e-voting systems have been proven vulnerable to replay attacks, including systems like Helios that are used in real practical elections. Despite their popularity, it is commonly believed that replay attacks are inefficient but the actual threat that they pose to vote privacy has never been studied formally. Therefore, in this paper, we precisely analyze for the first time how efficient replay attacks really are. We study this question from commonly used and complementary perspectives on vote privacy, showing as an independent contribution that a simple extension of a popular game-based privacy definition corresponds to a strong entropy-based notion. Our results demonstrate that replay attacks can be devastating for a voter's privacy even when an adversary's resources are very limited. We illustrate our formal findings by applying them to a number of real-world elections, showing that a modest number of replays can result in significant privacy loss. Overall, our work reveals that, contrary to a common belief, replay attacks can be very efficient and must therefore be considered a serious threat. [ABSTRACT FROM AUTHOR]

Using functional neuroimaging, electrophysiological techniques and neural data processing techniques, neuroscientists have found that mathematically gifted adolescents exhibit unusual neurocognitive features in the activation of task-related brain regions. Hemispheric information interaction, functional reorganization of networks, and utilization of task-related brain regions are beneficial to rapid and efficient task processing. Based on Granger causality channel selection, the transfer entropy (TE) value between effective channels was computed, and the information flow patterns in the directed functional brain networks derived from electroencephalography (EEG) data during deductive reasoning tasks were explored. We evaluated the workspace configuration patterns of the brain network and the global integration characteristics of separated brain regions using node strength, motif, directed clustering coefficient and characteristic path length in the brain networks of mathematically gifted adolescents with effective connectivity. The empirical results demonstrated that a more integrated functional network at the global level and a more efficient clique at the local level support a pattern of workspace configuration in the mathematically gifted brain that is more conducive to task-related information processing. [ABSTRACT FROM AUTHOR]

Background: A proper explanation for perceptual symptoms in neurodegenerative disorders including Alzheimer's disease and Parkinson's disease (PD) is still lacking.Objective: This study aimed at investigating the imbalance between 'bottom-up' and 'top-down' information flow (IF) and processing in PD in relation with visual hallucination symptoms.Methods: Here, we looked at bottom-up and top-down IF markers using resting state electroencephalographic (EEG) data from PD patients analyzed through three different IF measures (direct Directed Transfer Function (dDTF), full frequency Directed Transfer Function (ff-DTF), and renormalized Partial Directed Coherence (rPDC).Results: We observed an increased gamma band IF and a reduced beta band IF in PD patients compared to healthy controls. Additionally, we noticed a reduced theta band IF in PD patients using dDTF as a measure of IF. By source localizing the EEG activity of the PD patients and healthy controls, we looked at the alterations of IF in the prefrontal cortex of PD patients as well.Conclusion: In line with previous studies, our results suggest that the delicate balance between bottom-up and top-down IF is disrupted in Parkinson's disease potentially contributing to the cognitive symptoms of PD patients. [ABSTRACT FROM AUTHOR]

This paper investigates the effect of bucketing in security against timing-channel attacks. Bucketing is a technique proposed to mitigate timing-channel attacks by restricting a system's outputs to only occur at designated time intervals, and has the effect of reducing the possible timing-channel observations to a small number of possibilities. However, there is little formal analysis on when and to what degree bucketing is effective against timing-channel attacks. In this paper, we show that bucketing is in general insufficient to ensure security. Then, we present two conditions that can be used to ensure security of systems against adaptive timing-channel attacks. The first is a general condition that ensures that the security of a system decreases only by a limited degree by allowing timing-channel observations, whereas the second condition ensures that the system would satisfy the first condition when bucketing is applied and hence becomes secure against timing-channel attacks. A main benefit of the conditions is that they allow separation of concerns whereby the security of the regular channel can be proven independently of concerns of side-channel information leakage, and certain conditions are placed on the side channel to guarantee the security of the whole system. Further, we show that the bucketing technique can be applied compositionally in conjunction with the constant-time-implementation technique to increase their applicability. While we instantiate our contributions to timing channel and bucketing, many of the results are actually quite general and are applicable to any side channels and techniques that reduce the number of possible observations on the channel. It is interesting to note that our results make non-trivial (and somewhat unconventional) uses of ideas from information flow research such as channel capacity and refinement order relation. [ABSTRACT FROM AUTHOR]

Distributed information systems are prevalent in modern computing but difficult to build securely. Because systems commonly span domains of trust, host nodes share data and code of varying degrees of trustworthiness. Modern systems are often open and extensible, making security even harder to reason about. Unfortunately, standard methods for software construction do not help programmers enough with ensuring their software is secure. Fabric is a system and language for building open, distributed, extensible information systems that are secure by construction. Fabric is a decentralized system that allows nodes to securely share both data and code despite mutual distrust. All resources are labeled with confidentiality and integrity policies that are enforced through a combination of compile-time and run-time mechanisms. The Fabric language offers a high-level but powerful model of computation. All resources appear as objects in the language, and the distribution and persistence of code and data are largely transparent to programmers. Fabric supports both data-shipping and query/RPC styles of computation: computation and information can both move between nodes. Optimistic, nested transactions ensure consistency across all objects and nodes. Fabric programs can securely share mobile code across trust domains, enabling more reuse and evolution of code and supporting new kinds of secure applications not possible in other distributed systems. Results from applications built using Fabric suggest that Fabric enforces strong security while offering a clean, concise, powerful programming model with good performance. An open-source prototype is available for download. [ABSTRACT FROM AUTHOR]

Conventional security policies for software applications are adequate for managing concerns on the level of access control. But standard abstraction mechanisms of mainstream programming languages are not sufficient to express how information is allowed to flow between resources once access to them has been obtained. In practice we believe that such control - information flow control - is needed to manage the end-to-end security properties of applications. In this paper we present Paragon, a Java-based language with first-class support for static checking of information flow control policies. Paragon policies are specified in a logic-based policy language. By virtue of their explicitly stateful nature, these policies appear to be more expressive and flexible than those used in previous languages with information-flow support. Our contribution is to present the design and implementation of Paragon, which smoothly integrates the policy language with Java's object-oriented setting, and reaps the benefits of the marriage with a fully fledged programming language. [ABSTRACT FROM AUTHOR]

We consider the problem of model-checking some of the well-known trace-based information flow properties from the literature for classes of infinite-state system models. We first define some language-theoretic operations that help to characterize language inclusion in terms of these properties. This gives us a reduction of the language inclusion problem for a class of system models, say F, to the model checking problem for F, whenever F is effectively closed under these language-theoretic operations. We apply this result to show that the problem of model-checking any of these properties for One Counter Nets, One-Counter Automata, Basic Parallel Processes, and some properties for deterministic One Counter Automata, is undecidable. We also consider the class of Visibly Pushdown Systems and show that their model-checking problem is undecidable for a couple of properties. For the special case when all confidential events are internal we show that model-checking each of these properties for Visibly Pushdown Systems becomes decidable. [ABSTRACT FROM AUTHOR]

Web applications written in JavaScript are regularly used for dealing with sensitive or personal data. Consequently, reasoning about their security properties has become an important problem, which is made very difficult by the highly dynamic nature of the language, particularly its support for runtime code generation via eval. In order to deal with this, we propose to investigate security analyses for languages with more principled forms of dynamic code generation. To this end, we present a static information flow analysis for a dynamically typed functional language with prototype-based inheritance and staged metaprogramming. We prove its soundness, implement it and test it on various examples designed to show its relevance to proving security properties, such as noninterference, in JavaScript. To demonstrate the applicability of the analysis, we also present a general method for transforming a program using eval into one using staged metaprogramming. To our knowledge, this is the first fully static information flow analysis for a language with staged metaprogramming, and the first formal soundness proof of a CFA-based information flow analysis for a functional programming language. [ABSTRACT FROM AUTHOR]

Critical success factors in medication care involve communication and information sharing. Knowing the information needs of each actor in medication process in home care, is the first step to ensure that the right type of information is available, when needed. The aim of the study was to describe the needed and delivered information in home care in order to perform medication care successfully. A total of 15 nurses from primary home care participated a workshop focusing on medication treatment. The qualitative data was collected by focus group technique. Data was analyzed according to content analysis. Three medication information themes were formulated: Client-related information, medication, and medication error. The critical medication information were generic drug information, validity of the list of medication and client's clinical status. As a conclusion findings, show the diversity of the medication information in home care. [ABSTRACT FROM AUTHOR]

JavaScript drives the evolution of the web into a powerful application platform. Increasingly, web applications combine services from different providers. The script inclusion mechanism routinely turns barebone web pages into full-fledged services built up from third-party code. Script inclusion poses a challenge of ensuring that the integrated third-party code respects security and privacy. This paper presents a dynamic mechanism for securing script executions by tracking information flow in JavaScript and its APIs. On the formal side, the paper identifies language constructs that constitute a core of JavaScript: dynamic objects, higher-order functions, exceptions, and dynamic code evaluation. It develops a dynamic type system that guarantees information-flow security for this language. Based on this formal model, the paper presents JSFlow, a practical security-enhanced interpreter for fine-grained tracking of information flow in full JavaScript and its APIs. Our experiments with JSFlow deployed as a browser extension provide in-depth understanding of information manipulation by third-party scripts. We find that different sites intended to provide similar services effectuate rather different security policies for the user's sensitive information: some ensure it does not leave the browser, others share it with the originating server, while yet others freely propagate it to third parties. [ABSTRACT FROM AUTHOR]

Recently, much progress has been made on achieving information-flow security via secure multi-execution. Secure multi-execution (SME) is an elegant way to enforce security by executing a given program multiple times, once for each security level, while carefully dispatching inputs and ensuring that an execution at a given level is responsible for producing outputs for information sinks at that level. Secure multi-execution guarantees noninterference, in the sense of no dependencies from secret inputs to public outputs, and transparency, in the sense that if a program is secure then its secure multi-execution does not disable any of its original behavior. This paper pushes the boundary of what can be achieved with secure multi-execution. First, we lift the assumption from the original secure multi-execution work on the totality of the input environment (that there is always assumed to be input) and on cooperative scheduling. Second, we generalize secure multi-execution to distinguish between security levels of presence and content of messages. Third, we introduce a declassification model for secure multi-execution that allows expressing what information can be released and where it can be released. Fourth, we establish a full transparency result showing how secure multi-execution can preserve the original order of messages in secure programs. We demonstrate that full transparency is a key enabler for discovering attacks with secure multi-execution. [ABSTRACT FROM AUTHOR]

A quantification of process's security by differential privacy is defined and studied in the framework of probabilistic process algebras. The resulting (quantitative) security properties are investigated and compared with other (qualitative and quantitative) security notions. [ABSTRACT FROM AUTHOR]

Differential privacy aims at protecting the privacy of participants in statistical databases. Roughly, a mechanism satisfies differential privacy if the presence or value of a single individual in the database does not significantly change the likelihood of obtaining a certain answer to any statistical query posed by a data analyst. Differentially-private mechanisms are often oblivious: first the query is processed on the database to produce a true answer, and then this answer is adequately randomized before being reported to the data analyst. Ideally, a mechanism should minimize leakage -- i.e., obfuscate as much as possible the link between reported answers and individuals' data -- while maximizing utility -- i.e., report answers as similar as possible to the true ones. These two goals, however, are in conflict with each other, thus imposing a trade-off between privacy and utility. In this paper we use quantitative information flow principles to analyze leakage and utility in oblivious differentially-private mechanisms. We introduce a technique that exploits graph symmetries of the adjacency relation on databases to derive bounds on the min-entropy leakage of the mechanism.We consider a notion of utility based on identity gain functions, which is closely related to min-entropy leakage, and we derive bounds for it. Finally, given some graph symmetries, we provide a mechanism that maximizes utility while preserving the required level of differential privacy. [ABSTRACT FROM AUTHOR]

Opacity testing is formalized and studied. We specify opacity testers as well as tested systems by (timed) process algebras. We model various testers according to how sophisticated observations of tested system they can make and which kind of conclusions they can obtain. We use this technique to define several realistic security properties. The properties are studied and compared with other security concepts. [ABSTRACT FROM AUTHOR]

Health information provides the foundation for all decision making in healthcare whether clinical at the bed side, or at a national government level. This information is generally collected as part of systems which support administrative or clinical workflow and practice. This chapter describes the many and varied features of systems such as electronic health records (EHRs), how they fit with health information systems and how they collectively manage information flow. Systems engineering methods and tools are described together with their use to suit the health industry. This focuses on the need for suitable system architectures and semantic interoperability. These concepts and their relevance to the health industry are explained. The relationship and requirements for appropriate data governance in these systems is also considered. [ABSTRACT FROM AUTHOR]

Process testing as a way to obtain information on confidential data is investigated. Our working formalism is based on an appropriate (probabilistic) process algebra and (probabilistic) testing. We define testing noninterference as well as sets of private actions which execution is guaranteed by a given test and sets of actions which execution could be excluded by a given test. Moreover, we relate obtained information to a size of the test. [ABSTRACT FROM AUTHOR]

This article proposes a systematic study of information flow in credential-based declarative authorization policies. It argues that a treatment in terms of information flow is needed to adequately describe, analyze and mitigate a class of probing attacks which allow an adversary to infer any confidential fact within a policy. Two information flow properties that have been studied in the context of state transition systems, non-interference and opacity, are reformulated in the current context of policy languages. A comparison between these properties reveals that opacity is the more useful, and more general of the two; indeed, it is shown that non-interference can be stated in terms of opacity. The article then presents an inference system for non-opacity or detectability, in Datalog-based policies. Finally, a pragmatic method is presented, based on a mild modification of the mechanics of delegation, for preventing a particularly dangerous kind of probing attack that abuses delegation of authority. [ABSTRACT FROM AUTHOR]

Many computer systems have a functional requirement to release information. Such requirements are an important part of a system's information security requirements. Current information-flow control techniques are able to reason about permitted information flows, but not required information flows. In this paper, we introduce and explore the specification and enforcement of required information release in a language-based setting. We define semantic security conditions that express both what information a program is required to release, and how an observer is able to learn this information. We also consider the relationship between permitted and required information release, and define bounded release, which provides upper- and lower-bounds on the information a program releases. We show that both required information release and bounded release can be enforced using a security-type system. [ABSTRACT FROM AUTHOR]

Formalisms for analysis of systems of various nature specified by process algebras are proposed. They allow us to formalize security properties based on an absence of information flow and properties on system's integrity. Resulting properties are compared and discussed. We present also quantification of these properties by means of information theory. [ABSTRACT FROM AUTHOR]

Different techniques for expressing an amount of information on secrete data which can be obtained by a process observation are presented. They are based on information theory and they express certainty about sets of private actions which execution is guaranteed by a given observation and sets of actions which execution is excluded by a given observation. Moreover, the case when an intruder has same preliminary belief on secrete data is discussed. It is shown how the presented technique could be applied for such case. As regards working formalism, probabilistic process algebra is used for description of systems as well as attacker's belief. [ABSTRACT FROM AUTHOR]

Radio Frequency Identification, or RFID, has been attracting considerable attention from large retailers and consumer goods manufacturers with the expectation of improved efficiencies, and significant business benefits. Despite many useful applications, the technology's potential has yet to be fully realized. The aim of this paper is to highlight RFID's promises as well as its pitfalls in the retail supply chain, discuss potential strategic benefits of this technology, explore the many factors that may contribute to RFID success, identify the implementation challenges and key business drivers, and suggest a possible relationship among implementation factors and success variables. [ABSTRACT FROM AUTHOR]

Formalisms for description how much information on private actions can be obtained by observing public ones are presented. Two sets of private actions are considered. The set of actions which execution is guaranteed according to observations and the set of actions which execution is excluded according to observations. Since information flows could be realized also by means of different covert channels as time, termination and divergence this possibility is considered as well. Both qualitative and quantitative dimensions of the flow are considered. [ABSTRACT FROM AUTHOR]

A general framework for defining security properties is presented. It allows us to model many traditional security properties as well as to define new ones. The framework is based on process algebras contexts and processes relations. By appropriate choice of both of them we can model also probabilistic and quantified security properties. [ABSTRACT FROM AUTHOR]

Trace properties, which have long been used for reasoning about systems, are sets of execution traces. Hyperproperties, introduced here, are sets of trace properties. Hyperproperties can express security policies, such as secure information flow and service level agreements, that trace properties cannot. Safety and liveness are generalized to hyperproperties, and every hyperproperty is shown to be the intersection of a safety hyperproperty and a liveness hyperproperty. A verification technique for safety hyperproperties is given and is shown to generalize prior techniques for verifying secure information flow. Refinement is shown to be applicable with safety hyperproperties. A topological characterization of hyperproperties is given. [ABSTRACT FROM AUTHOR]

The improved Chinese information environment influenced China's capacity to accept Freedom of Information (FOI). The comparison of different information management approaches to crises taken by the Chinese government over time demonstrates that without the improvement of the information environment due to the formation of multiple paths for information flow, the Chinese government would have been unlikely to be receptive to FOI reform. [ABSTRACT FROM AUTHOR]

A quantification of process's security by quantification of an amount of information flow is defined and studied in the framework of timed process algebras. The resulting quantified security is compared with other (qualitative) security notions. Unprecise and limited observations are defined and discussed. [ABSTRACT FROM AUTHOR]

Computing systems often deliberately release (or declassify) sensitive information. A principal security concern for systems permitting information release is whether this release is safe: is it possible that the attacker compromises the information release mechanism and extracts more secret information than intended? While the security community has recognised the importance of the problem, the state-of-the-art in information release is, unfortunately, a number of approaches with somewhat unconnected semantic goals. We provide a road map of the main directions of current research, by classifying the basic goals according to what information is released, who releases information, where in the system information is released and when information can be released. With a general declassification framework as a long-term goal, we identify some prudent principles of declassification. These principles shed light on existing definitions and may also serve as useful “sanity checks” for emerging models. [ABSTRACT FROM AUTHOR]

We address the issue of declassification in a language-based security approach. We introduce, in a Core ML-like language with concurrent threads, a declassification mechanism that takes the form of a local flow policy declaration. The computation in the scope of such a declaration is allowed to implement information flow according to the local policy. To take into account declassification, and more generally dynamic flow policies, we introduce a generalization of non-interference, that we call the non-disclosure policy, and we design a type and effect system for our language that enforces this policy. Besides dealing with declassification, our type system improves over previous systems for checking information flow in two directions: first, we show that the typing of terminations leaks can be largely improved, by particularizing the case where the alternatives in a conditional branching both terminate. Moreover, we also provide a quite precise way of approximating the confidentiality level of an expression, by ignoring the level of values that are only used for side-effects. [ABSTRACT FROM AUTHOR]

We present our experience in developing an open source tool for the measurement of security flaws. Since security flaws result from the unauthorized flow of information, our tool shows how these flaws can be measured and compared based on the amount of information that flows, how "far" it flows, and the value of the information. Flaws can then be compared and careful security testers can maximize the amount of security for a limited set of resources. The development of a tool to partially automate this process will prove to be an asset to the open source community in that the "many eyes" can be directed and these resources prioritized in order to patch flaws in the most efficient manner and minimize downtime and risk. [ABSTRACT FROM AUTHOR]

A formal model for description of probabilistic timing attacks is presented and studied. It is based on a probabilistic timed process algebra, on observations (mappings which make visible only a part of system behavior) and on an information flow. The resulting security properties are studied and compared with other security concepts. [ABSTRACT FROM AUTHOR]

A formal model for description of passive and active timing attacks is presented, studied and compared with other security concepts. It is based on a timed process algebra and on a concept of observations which make only a part of system behaviour visible. From this partial information which contains also timing of actions an intruder tries to deduce some private system activities. [ABSTRACT FROM AUTHOR]

We propose an approach to quantify interference in a simple imperative language that includes a looping construct. In this paper we focus on a particular case of this definition of interference: leakage of information from private variables to public ones via a Trojan Horse attack. We quantify leakage in terms of Shannon's information theory and we motivate our definition by proving a result relating this definition of leakage and the classical notion of programming language interference. The major contribution of the paper is a quantitative static analysis based on this definition for such a language. The analysis uses some non-trivial information theory results like Fano's inequality and the ℒ1 inequality to provide reasonable bounds for conditional statements. While-loops are handled by integrating a qualitative flow-sensitive dependency analysis into the quantitative analysis. [ABSTRACT FROM AUTHOR]

A formal model for an analysis of an information flow in interconnection networks is presented. It is based on timed process algebra which can express also network properties. The information flow is based on a concept of deducibility on composition. Robustness of systems against network timing attacks is defined. A variety of different security properties which reflect different security requirements are defined and investigated. [ABSTRACT FROM AUTHOR]

One fundamental key to successful implementation of secure high assurance computer systems is the design and implementation of security policies. For systems enforcing multiple concurrent policies, the design and implementation is a challenging and difficult task. To simplify this task, we present an Inter-Enclave Multi-Policy (IEMP) paradigm for information access of the Multiple Independent Levels of Security and Safety (MILS) approach to high assurance system design for security- and safety-critical multi-enclave systems. The IEMP paradigm manages multiple security policies (i.e., controls the conflicts and cooperation of policies of different enclaves) within heterogeneous systems. IEMPs are “policies about policies” that ensure the enforcement of end-to-end mandatory information flow security policies, where the management and evolution of policies can be separated from applications. Although the approach was initially designed for use in the MILS architecture, based on the concept of a separation kernel, it is applicable to a much broader range of architectures. [ABSTRACT FROM AUTHOR]

Noninterference requires that there is no information flow from sensitive to public data in a given system. However, many systems release sensitive information as part of their intended function and therefore violate noninterference. To control information flow while permitting information release, some systems have a downgrading or declassification mechanism, but this creates the danger that it may cause unintentional information release. This paper shows that a robustness property can be used to characterize programs in which declassification mechanisms cannot be controlled by attackers to release more information than intended. It describes a simple way to provably enforce this robustness property through a type-based compile-time program analysis. The paper also presents a generalization of robustness that supports upgrading (endorsing) data integrity. [ABSTRACT FROM AUTHOR]

We study information flow security in the setting of mobile agents. We propose a sufficient condition to security named Persistent_BNDC. A process is Persistent_BNDC when every of its reachable states satisfies a basic Non-Interference property called BNDC. By imposing that security persists during process execution, one is guaranteed that every potential migration is performed in a stable, secure state. We define a suitable bisimulation-based equivalence relation among processes, that allows us to express the new property as a single equivalence check, thus avoiding the universal quantifications over all the reachable states (required by Persistent_BNDC) and over all the possible hostile environments (implicit in the basic Non-Interference property BNDC). We prove that Persistent_BNDC is a sufficient condition to the security of mobile agents by (i) giving a sound and complete characterization of Persistent_BNDC in terms of dynamic contexts, i.e., execution contexts that can non-deterministically change at run-time, abstractly modelling arbitrary migrations; (ii) showing that Persistent_BNDC implies information flow security when agent mobility is explicitly expressed in the calculus. [ABSTRACT FROM AUTHOR]

In this paper, we present a systematic way to determine the information flow security goals achieved by systems running a secure O/S, specifically systems running Security‐Enhanced Linux. A formalization of the access control mechanism of the SELinux security server, together with a labeled transition system representing an SELinux configuration, provides our framework. Information flow security goal statements expressed in linear temporal logic provide a clear description of the objectives that SELinux is intended to achieve. We use model checking to determine whether security goals hold in a given system. These formal models combined with appropriate algorithms have led to automated tools for the verification of security properties in an SELinux system. Our approach has been used in other security management contexts over the past decade, under the name rigorous automated security management. [ABSTRACT FROM AUTHOR]

This paper concerns a new approach to intelligent data analysis based on information flow distribution study in a flow graph. Branches of a flow graph are interpreted as decision rules, whereas a flow graph is supposed to describe a decision algorithm. We propose to model decision processes as flow graphs and analyze decisions in terms of flow spreading in a graph. [ABSTRACT FROM AUTHOR]