Panel: A Genealogy of Non-Interference
Peter Y. A. Ryan · 1996
Non-interference is intended to capture the idea that one user’ s interaction with a system should not causally effect any observations of the system that can be made by another user. Thus the latter user should be unable to infer anything from observations of the system about the actual behaviour of the former. As such it is a central concept in security modelling . Ever since Goguen and Meseguer first proposed a for- malisation of the idea there has been a staggering prolifera- tion of generalisations and alternative formulations. This, superficially very simple and intuitive idea, turns out to ha&our remarkable subtleties, especially when extended to systems with non-determinism. It should be noted that the concept of non-determinism itself is very subtle and in- deed at least two distinct flavours can be identified: under- specified and probabilistic, and it turns out that the distinc- tion can be crucial from a security point of view, see for example [3]. Further elaborations of non-interference are possible if probability and/or time are introduced into the models. The utility of NI has also been questioned: it is clearly an elegant abstraction but, at least in its pure form, seems rarely to be used for real. This has prompted a number of generalisations applicable to a wider class of applications: