Mechanizing Security In HOL

Abstract

Four definitions or “models” of security are described formally and with examples. The formalization into HOL of three of these models is demonstrated. The relative strengths of these definitions is discussed with respect to adequacy, mechanizability, and provability. Mechanizability refers to how susceptible the model is to formalization in a language like HOL or EHDM [2]. Provability refers to the difficulty of verifying that a particular system has a desired security property. The “non-interference” and “restrictiveness” models described in sections 3 and 4 are concise and elegant, but verifying that a system has either of these properties generally involves lengthy and complicated inductions [l].