A Genealogy of Non-Interference

Non-interference is intended to capture the idea that one user’s interaction with a system should not causally effect any observations of the system that can be made by another user. Thus the latter user should be unable to infer anything from observations of the system about the actual behaviour of the former. As such it is a central concept in security modelling . Ever since Goguen and Meseguer first proposed a formalisation of the idea there has been a staggering proliferation of generalisations and alternative formulations. This, superficially very simple and intuitive idea, turns out to ha&our remarkable subtleties, especially when extended to systems with non-determinism. It should be noted that the concept of non-determinism itself is very subtle and indeed at least two distinct flavours can be identified: underspecified and probabilistic, and it turns out that the distinction can be crucial from a security point of view, see for example [3]. Further elaborations of non-interference are possible if probability and/or time are introduced into the models. The utility of NI has also been questioned: it is clearly an elegant abstraction but, at least in its pure form, seems rarely to be used for real. This has prompted a number of generalisations applicable to a wider class of applications: