Departmental Papers (CIS)

Date of this Version


Document Type

Conference Paper


Copyright 2009 IEEE. Reprinted from:

Foster, J.N.; Pierce, B.C.; Zdancewic, S., "Updatable Security Views," Computer Security Foundations Symposium, 2009. CSF '09. 22nd IEEE , vol., no., pp.60-74, 8-10 July 2009

Publisher URL:

This material is posted here with permission of the IEEE. Such permission of the IEEE does not in any way imply IEEE endorsement of any of the University of Pennsylvania's products or services. Internal or personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution must be obtained from the IEEE by writing to By choosing to view this document, you agree to all provisions of the copyright laws protecting it.


Security views are a flexible and effective mechanism for controlling access to confidential information. Rather than allowing untrusted users to access source data directly, they are instead provided with are restricted view, from which all confidential information has been removed. The program that generates the view effectively embodies a confidentiality policy for the underlying source data. However, this approach has a significant drawback: it prevents users from updating the data in the view. To address the "view update problem" in general, a number of bidirectional languages have been proposed. Programs in these languages - often called lenses - can be run in two directions: read from left to right, they map sources to views; from right to left,they map updated views back to updated sources. However, existing bidirectional languages do not deal adequately with security. In particular, they do not provide a way to ensure the integrity of source data as it is manipulated by untrusted users of the view. We propose a novel framework of secure lenses that addresses these shortcomings. We enrich the types of basic lenses with equivalence relations capturing notions of confidentiality and integrity, and formulate the essential security conditions as non-interference properties. We then instantiate this framework in the domain of string transformations, developing syntax for bidirectional string combinators with security-annotated regular expressions as their types.


authorisation, formal languages, access control, bidirectional language, bidirectional string combinator, confidential information, confidentiality policy, noninterference property, secure lenses, security views, security-annotated regular expression, source data access, view update problem, Security views, confidentiality, information flow, integrity, lenses, regular types, view update



Date Posted: 11 December 2009