Dynamic Intransitive Noninterference

Existing noninterference frameworks for reasoning about system security assume a fixed configuration of domains governed by a security policy that does not change over time. A static security policy, however, cannot express the domain interactions present in many modern system designs, which allow users to configure the set of active domains at runtime. In this paper, we generalize Rushby’s framework for static noninterference to support reasoning about the security of systems with a dynamic policy. In particular, we show that the security of a given dynamic policy system can be established by supplementing Rushby’s unwinding theorem with the new notion of policy respect.