Information Flow Analysis for Valued-Indexed Data Security Compartments

Data-intensive applications as popularised by cloud computing raise many security challenges, due to the large number of remote users involved and multi-tenancy. Fre-quently, the security compartment associated to data stored in shared containers, such as database tables, is not determined by the static structure of the database schema, but depends on runtime data values, as required to ensure so-called "row-level " security. In this paper, we investigate a programming language approach to these issues, based on a λ-calculus extended with data manipulation primitives. We develop a type-based infor-mation flow analysis introducing a notion of value-indexed security labels, representing value-indexed security levels, or compartments. Our results ensure that well-typed pro-grams do not break confidentiality constraints imposed by a declared security discipline.