Information Flow
Provides a finer-grained security model than an access control model
Incorporates a multi-level security model into the type system
- variables are typed or labeled “high” or “low”
- generalizes to an arbitrary lattice
- some variables are assigned a security type by the user
- type rules describe propagation of security types
- implicit flows accounted for
- type system determines if a consistent type assignment is possible