Combining robust declassification and intransitive noninterference

Language-based information flow security properties such as noninterference ensure that confidential data does not affect the publicly visible behavior. But real computing systems sometimes need to dynamically release certain amount of sensitive information. Noninterference is too restrictive to permit such leakage. This paper presents a new security policy of information flow which combines robust declassification and intransitive noninterference according to who can release information and where in the system information is released. Moreover, we introduce an endorsement mechanism that takes the form of a local integrity endorsing policy declaration. Such policy is connected to a semantic security condition which addresses when endorsing is allowed. Thus the integrity of data can be upgraded according to its local endorsing policy. Because robust declassification requires that the decision to perform information release have high integrity, we can grant un- trusted code a limited ability to dynamically affect information release by upgrading its integrity.