Secure Nested Transactions

Preventing the writing of sensitive information to a “low” database variable is insufficient, since the use of locks to synchronize accesses to the database provide a covert channel. In this example, T1 signals to T2 by locking X but not Y. In multilevel databases, this leak is prevented by allowing the low transaction to implicitly pre-empt the high transaction when the latter holds a resource that former requires [1]. More recently information flow control has been investigated in the realm of language-based security, as an endto-end security property of software systems that can be to some extent checked by compilers [2]. The key insight in this work is that noninterference can be related to the control flow in a program, so that indirect leaks through the control flow may be prevented via a type-based control flow analysis. For example, in the following program, there is an apparent information leak due to the writing to “low” variable Y after reading “high” variable X: