Scheduler-Related Confidentiality for Multi-Threaded Programs
Observational determinism has been proposed in the literature as a way to ensure confidentiality for multi-threaded programs. Intuitively, a program is observationally deterministic if the behavior of the public variables is deterministic, i.e., independent of the private variables. Several formal definitions of observational determinism exist, but all of them have shortcomings; for example they accept insecure programs or they reject too many innocent programs. Besides, all the proposed definitions of observational determinism are not scheduler-independent: a program that is secure under one kind of scheduler might not be secure when executed with a different scheduler. The existing definitions do not ensure that a program behaves securely when the scheduling policy changes.