The inference problem for computer security

Abstract

An inference problem in computer security occurs when an individual can infer classified information by viewing only information of strictly lower classification. This paper introduces questions for discussion for the computer security community. These questions are organized into the following areas: definition of the inference problem; requirements for a theory of the inference problem; mechanisms for controlling inference; and practical formulations of inference control. The author believes that investigation of these issues is required in order for progress to be made toward addressing the management of inference in computer security.<>