Security completeness: towards noninterference in composed languages

Abstract

Ensuring that software protects its users' privacy has become an increasingly pressing challenge. Requiring software to be certified with a secure type system is one enforcement mechanism. Protecting privacy with type systems, however, has only been studied for programs written entirely in a single language, whereas software is frequently implemented using multiple languages specialized for different tasks. This paper presents an approach that facilitates reasoning over composed languages. It outlines sufficient requirements for the component languages to lift privacy guarantees of the component languages to well-typed composed programs, significantly lowering the burden necessary to certify that such composite programs safe. The approach relies on computability and security-level separability. This paper defines completeness with respect to secure computations and formally establishes conditions sufficient for a security-typed language to be complete. We demonstrate the applicability of the results with a case study of three seminal security-typed languages.