Explicit information flow properties in JML

This paper considers how explicit information flow properties can be expressed and verified in a traditional program logic, using preand postconditions. As concrete specification language for expressing these properties we use the specification language JML for Java. For this we propose a new classification of information flow properties, namely positive and negative properties, where the former are easier to describe. This also leads us to reconsider the duality between integrity and confidentiality in the light of the difference between explicit and implicit information flows.