date/vreme: 11/03/2025, 12:00
venue/mesto: Ogranak SANU, "Platoneum", Nikole Pašića 6, Novi Sad
Speaker / Predavač
Prof. Sanjiva Prasad, Department of Computer Science and Engineering, Indian Institute of Technology Delhi, India
https://www.cse.iitd.ernet.in/~sanjiva/ (home page)
Title / Naslov:
Secure Information Flow Connections
Abstract / Sažetak:
Denning's lattice model provided secure information flow analyses with an intuitive mathematical foundation: the lattice ordering determines permitted flows. We propose a connection-based extension of this framework that permits two autonomous organisations, each employing possibly quite different security lattices, to exchange information while maintaining security of information flow as well as their autonomy in formulating and maintaining security policies. Our prescriptive framework is based on the rigorous mathematical framework of Lagois connections proposed by Melton, together with a simple type system and operational model for transferring object data between the two domains. The merit of this formulation is that it is simple, minimal, adaptable and intuitive.
We show that our framework is semantically sound, by proving that the connections proposed preserve standard correctness notions such as noninterference. We then illustrate via examples how Lagois theory also provides a robust framework and methodology for negotiating and maintaining secure agreements on information flow between autonomous organisations, even when either or both organisations change their security lattices. Composition and decomposition properties indicate support for a modular approach to secure flow frameworks in complex organisations. Finally, a natural and conservative extension of the Decentralised Labels Model of Myers et al. shows the applicability of the framework — a Lagois connection between the hierarchies of principals in two organisations naturally induces a Lagois connection between the corresponding security label lattices, thus extending the security guarantees ensured by the decentralised model to encompass bidirectional interorganisational flows.
(The talk is based on articles FORTE 2019, JLAMP 2021.)
About the speaker. Sanjiva Prasad is a Professor and former Head of the Department of Computer Science and Engineering (2018-2021) and also the Amar Nath and Shashi Khosla School of Information Technology (2011-2015) at the Indian Institute of Technology Delhi. His research interests include formal methods, programming languages and their semantics, security of information flow and networks, and medical applications of computing. He has written several conference and journal papers in these areas, served on the technical programme committees of several international conferences, and delivered seminar talks at leading universities across the world. He is currently Co-Editor-in-Chief of ACM Books (based in New York). Prof. Prasad was Head of IIT Delhi’s School of Public Policy (2022-24). His research interests in this area concern issues regarding data and computation, and their confidentiality and integrity, in particular health-related data systems. He is also interested in issues of higher education, pedagogical processes and affordable access to educational materials. Prior to working at IIT Delhi, Prof. Prasad worked on program verification at Odyssey Research Associates in Ithaca, USA from 1990-1992, and then at the European Computer- Industry Research Center (ECRC GmbH) in Munich, Germany from 1992-1994 on the Facile project which was based on his dissertation. He was a visiting Lektor at BRICS, Aarhus University from 1998 to 1999. His PhD is from Stony Brook University, New York, and he earned a BTech in Computer Science and Engineering from the Indian Institute of Technology Kanpur in 1985.