A Library for Light-Weight Information-Flow Security in Haskell

Protecting confidentiality of data has become increasingly important forcomputing systems. Information-flow techniques have been developed over the years to achieve that purpose, leading to special-purpose languages thatguarantee information-flow security in programs.However, rather than producing a new language from scratch,information-flow security can also be provided as a library.This has been done previously in Haskell using the arrow framework.In this paper, we show thatarrows are not necessary to designsuch libraries and that a less general notion, namely monads, issufficient to achieve the same goals. We presenta monadic library to provide information-flowsecurity for Haskell programs. The library introducesmechanisms to protect confidentialityof data for pure computations, that we then easily, and modularly,extend to include dealing with side-effects. We alsopresent combinators to dynamically enforce different declassificationpolicies when release of information is required in acontrolled manner. It is possible to enforce policies relatedto what, by whom, when information isreleased or a combination of them.The well-known concept of monadstogether with the light-weight characteristicof our approach makes the library suitable tobuild applications whereconfidentiality of data is an issue