A taxonomy for information flow policies and models

A notation for describing information flow policies that can express transitive, aggregation and separation (of duty) exceptions is proposed. Operators for comparing, composing, and abstracting flow policies are described. These allow complex policies to be built from simpler policies. Many existing confidentiality (and by using a dual model, integrity) policies and their models can be captured in this framework. A high water mark model is described that can enforce a large class of these information flow policies. The model provides the basis for a taxonomy of existing high water mark mechanisms.<>