Execution Monitoring and Information Flow Properties

The purpose of this paper is to show that typical information flow policies can be enforced by enforcement mechanisms that work by monitoring a system execution at run time. the system execution represent an event sequence in the system. Our enforcement mechanism has extra structure. In this paper the extra structure become an emulator to work on a subsequence of the observed sequence in order to discuss an information flow property. The enforcement mechanisms obtains not only execution sequences of targets but subsequences restricted to events of partial targets. An information flow policy will define relations between groups of users on a system. The relations signify a direction that the system allows information to flow. Some user processes, using covert channel, are able to flow an information against the policy. If the information can be flowed form a sender process to a receiver process we are required to detect the channel(also called path). The enforcement mechanism can eventually discover such a violation of information flow policies and thus prevents information leaks to be exploited. Since the bandwidth of the covert channel is narrow, the receiver process to a covert channel can be terminated by the mechanism before all of the information is received.