Analyzing Non-Interference with respect to Classes

The information flow property of Non-Interference was recen tly relaxed into Abstract NonInterference (ANI), a weakened version where attackers can only observe properties of data, rather than their exact value. ANI was originally defin ed on integers: a property models the set of numbers satisfying it. The present work proposes an Object-Oriented, Javabased formulation of ANI, where data take the form of objects, and the observed property comes to be their class. Relevant data are stored in fields; th e execution of a program is taken to be the invocation of some (public) method by an external user; a class is secure if, for all its public methods, the class of its public data after the execution does not depend on the initial class of its private data. The relation ANI lie s in the representation of abstract domains as class hierarchies: upper closure operators map objects into the smallest class they belong to. An analyzer for a non-trivial subset of Java is illustrated, which is sound since programs are never misclassified as secure.