Composing Cross-Domain Solutions

High-assurance systems with multiple security levels use data filters to facilitate the safe flow of information from higher to lower classification levels. Since filters play a critical security role, they must be formally verified. However, a wide range of sanitization strategies has been developed to address the wide variety of data content and contexts that arise in practice. As the diversity of the content and context increases, the complexity of monolithic filters grows rapidly, making them decreasingly tractable for formal verification. The MILS philosophy argues for the decomposition of any functional unit that is too large to be formally verified. Inspired by MILS, we argue that (i) data sanitization should be decomposed, (ii) each filter should handle a specific type of content, and (iii) the sanitization should provide a streaming differential privacy guarantee. Together, these will allow formal assurances for the data sanitization in the system.