Giving Semantics to Program-Counter Labels via Secure Effects

Program-Counter Labels are how static Information-Flow Control systems reason about effects. We give them semantics in the monadic style.

Authors

Andrew K. Hirsch and Ethan Cecchetti

Abstract

Type systems designed for information-flow control commonly use a program-counter label to track the sensitivity of the context and rule out data leakage arising from effectful computation in a sensitive context. Currently, type-system designers reason about this label informally except in security proofs, where they use ad-hoc techniques. We develop a framework based on monadic semantics for effects to give semantics to program-counter labels. This framework leads to three results about program-counter labels. First, we develop a new proof technique for noninterference, the core security theorem for information-flow control in effectful languages. Second, we unify notions of security for different types of effects, including state, exceptions, and nontermination. Finally, we formalize the folklore that program-counter labels are a lower bound on effects. We show that, while not universally true, this folklore has a good semantic foundation.

Publication History

Conditionally accepted to POPL 2021.

Preprint

Technical Report

%d bloggers like this: