text:
ILS Proton Successfully Launches the KA-SAT Satellite for Eutelsat
Marks a Record of 8 Commercial Missions in 2010 for ILS
Visit the KA-SAT mission control page…
BAIKONUR COSMODROME, Kazakhstan, December 27, 2010 – International Launch Services (ILS), a world leader in providing launch services to the commercial space industry, successfully carried the KA-SAT satellite to orbit for Eutelsat Communications of France on an ILS Proton. The ILS Proton vehicle lifted off from the Baikonur Cosmodrome at 3:51 a.m. local time (4:51 p.m. EST, 10:51 p.m. in Paris on December 26). After a 9 hour 12 minute mission, the Breeze M successfully released the KA-SAT satellite into geostationary transfer orbit.
The launch of the KA-SAT satellite marks the 8th ILS Proton launch of the year; a record number of commercial launches for ILS. This was also the 64th commercial launch to date for ILS and the 12th Proton launch for the year. The Proton Breeze M vehicle is built by Khrunichev Space Center of Moscow, one of the pillars of the Russian aerospace industry and majority owner of ILS. Proton has a heritage of 363 missions since its maiden flight in 1965.
The 6150 kg KA-SAT satellite was built on the Eurostar E3000 platform by Astrium and has a 15 year life expectancy. With its total capacity of 70 Gbps, KA-SAT is ranked as the world's most powerful satellite and will be situated at Eutelsat's 9 degrees East location. Through a configuration of 82 spot beams and a ground infrastructure of ten gateways connected to the Internet, KA-SAT will provide service across Europe and the Mediterranean Basin.
Frank McKenna, president of ILS said, "We worked very closely with Eutelsat and Astrium to ensure the successful launch of the KA-SAT satellite on ILS Proton. We are honored to play an important role in the deployment of innovative programs and technologies such as KA-SAT, the first European satellite that will operate exclusively in high capacity Ka-band frequencies. We thank Eutelsat for relying on ILS Proton once again to deliver their spacecraft securely into orbit."
"We are pleased to continue our long term relationship with ILS with the launch of KA-SAT on the powerful Proton Breeze M rocket. The launch of this High Throughput Satellite marks the opening of a new era for satellite-delivered broadband and data services across Europe and the Mediterranean Basin. It is also new evidence of Eutelsat's commitment to innovation that broadens the scope of satellite-based services in a rapidly-expanding digital economy. Our sincere thanks and appreciation go out to the entire team of ILS, Khrunichev and Astrium, for their tireless work on this mission," said Michel de Rosen, CEO of Eutelsat.


text:
Acts 18:1 - 18
18:1 - [ In Context | Read Chapter | Discuss this Verse ]
[ Original: Greek | Multi-Translation ]
After these things he left Athens R1077 and went to Corinth. R1078
And he found a Jew named Aquila, R1079 a native of Pontus, R1080 having recently come from Italy R1081 with his wife Priscilla, R1079 because Claudius R1082 had commanded all the Jews to leave Rome. He came to them,
and because he was of the same trade, he stayed with them and they R1083 were working, for by trade they were tent-makers.
And he was reasoning in R1084 the synagogue every Sabbath R1085 and trying to persuade Jews R1086 and Greeks.
But when Silas R1087 and Timothy came R1088 down from Macedonia, R1089 Paul began devoting himself completely to the word, solemnly testifying R1090 to the Jews that Jesus R1091 was the Christ. F414
But when they resisted and blasphemed, he shook R1092 out his garments and said to them, "Your blood R1093 be on your own heads! I am clean. From now on I will go to R1094 the Gentiles."
Then he left there and went to the house of a man named Titius F415 Justus, a R1095 worshiper of God, whose house was next to the synagogue.
Crispus, R1096 the R1097 leader of the synagogue, believed in the Lord with R1098 all his household, and many of the Corinthians R1099 when they heard were believing and being baptized.
And the Lord said to Paul in the night by a R1100 vision, "Do not be afraid any longer, but go on speaking and do not be silent;
for I am with you, and no man will attack you in order to harm you, for I have many people in this city."
And he settled there a year and six months, teaching the word of God among them.
But while Gallio was proconsul R1101 of Achaia, R1102 the R1103 Jews with one accord rose up against Paul and brought him before the R1104 judgment seat,
saying, "This man persuades men to worship God contrary to the R1105 law."
But when Paul was about to open R1106 his mouth, Gallio said to the Jews, "If it were a matter of wrong or of vicious crime, O Jews, it would be reasonable for me to put up with you;
but if there are questions R1107 about words and names and your own law, look after it yourselves; I am unwilling to be a judge of these matters."
And he drove them away from the R1108 judgment seat.
And they all took hold of Sosthenes, R1109 the R1110 leader of the synagogue, and began beating him in front of the R1111 judgment seat. But Gallio was not concerned about any of these things.
Paul, having remained many days longer, took R1112 leave of the R1113 brethren and put out to sea for Syria, R1114 and with him were Priscilla R1115 and Aquila. R1115 In Cenchrea R1116 he F416 had R1117 his hair cut, for he was keeping a vow.
F414 I.e. Messiah
F415 One early ms reads Titus; two other early mss omit the name
F416 Lit having his hair cut
R1077 Acts 17:15
R1078 Acts 18:8; 19:1; 1 Corinthians 1:2; 2 Corinthians 1:1,23; 6:11; 2 Timothy 4:20
R1079 Acts 18:18,26; Romans 16:3; 1 Corinthians 16:19; 2 Timothy 4:19
R1080 Acts 2:9
R1081 Acts 27:1,6; Hebrews 13:24
R1083 Acts 20:34; 1 Corinthians 4:12; 9:14f; 2 Corinthians 11:7; 12:13; 1 Thessalonians 2:9; 4:11; 2 Thessalonians 3:8
R1084 Acts 9:20;
R1086 Acts 14:1
R1087 Acts 15:22; 16:1;
R1090 Luke 16:28; Acts 20:21
R1091 Acts 17:3; 18:28
R1092 Nehemiah 5:13; Acts 13:51
R1093 2 Samuel 1:16; 1 Kings 2:33; Ezekiel 18:13; 33:4,6,8; Matthew 27:25; Acts 20:26
R1095 Acts 13:43; 16:14
R1096 1 Corinthians 1:14
R1097 Mark 5:22
R1100 Acts 9:10
R1102 Acts 18:27; 19:21; Romans 15:26; 1 Corinthians 16:15; 2 Corinthians 1:1; 9:2; 11:10; 1 Thessalonians 1:7f
R1103 1 Thessalonians 2:14ff
R1104 Matthew 27:19
R1105 John 19:7; Acts 18:15
R1106 Matthew 5:2
R1109 1 Corinthians 1:1
R1114 Matthew 4:24
R1115 Acts 18:2,26
R1116 Romans 16:1
R1117 Numbers 6:2,5,9,18; Acts 21:24

redpajama_set_name: RedPajamaCommonCrawl


text:
Rowe shows Lazenby United the way to go
PAUL ROWE headed a dramatic winner against Redcar Rugby Club to send second division Lazenby United into the quarter-finals of the North Riding Sunday Challenge Cup.
Teesside Live
First Division Rugby Club took the lead in the first half when Jamie Graham scored.
In the second half Jack scored an equaliser with a long range effort and then from a long throw in, Rowe earned United a home tie against Thorntree (RAOB) in the last eight.
Crown and Anchor, already through to the quarter finals, will have a home tie against Dormans United.
In the North Riding County Cup, Clarendon Hotel played host to Corus RCO and ran out 5-3 winners to take their place in the quarter-finals where they will have a home tie against South Bank 2006.
In the league, Guisborough Black Swan entertained Coatham Road Social Club and the visitors were indebted to their goalkeeper for saving two penalties.
However, Guisborough broke away in the second half and Dan Drazdouskas scored the only goal of the game to lift the Black Swan to within two points of leaders Normanby Hall Cricket Club.
Cleveland Hotel moved to the top of the second division when they beat Saltburn Town.
Michael Dowse scored four times and Leon Lainton and Ian Hutchinson also netted.
Coatham
Eston and Normanby
Lazenby
Saltburn and East Cleveland


Colombo, 27 December, (Asiantribune.com): Sri Lankan nation remembers and pays respect to those who perished in the tsunami disaster on the 26th of December last year. The entire country observed a silence for two minutes at 9.30 to 9.32 am, as a gesture of remembrance of all those deceased in the natural calamity.
Pealing of the bells of all religious places at the same time at 9.29 am were heard continuously for 3 minutes all over the island.
Nearly 35,322 Sri Lankan people were victims to Tsunami and over 21 thousand sustained injuries due to the salt water tidal waves upheaval. One million people were displaced and nearly one hundred thousand houses were either damaged or completely destroyed. A number of religious observances island-wide are in the agenda till the 31st of this month beginning from Monday, in remembrance of the deceased by the Tsunami catastrophe.
Meanwhile, the government made an appeal to light a candle or lamp in every house at 7.00 PM on Monday, in remembrance of the Tsunami victims.
Commemorating last year's devastation, Sri Lanka's President Mahinda Rajapakse said that cannot be any other challenge that could in anyway overcome by a nation that has awakened and tormented by this tidal fury.
This was proven in the weeks immediately after the December 26th Tsunami disaster a year ago. The President said the joint effort made by the citizens of the country to recover from the disaster, caused amazement for the rest of the countries in the globe. He made this comment at the national ceremony for the first year commemoration of the Tsunami devastation held at the Jinarathana College premises in Peraliya, Hikkaduwa Monday morning.


This week we want to encourage you to be a blessing to others with your art. We hopefully have all been touched by someone who has done something unexpectedly kind or generous. This week, let's pay it forward! We have decided to include Krazy Island Family members in our Pay it Forward plans. We have each created some hand-painted postcards that we will be sending to random KIF and JKIS members this week. If you are not a KIF member, you can join us here Krazy Island Family. For our journal pages, Peta and Gina have both incorporated happy mail they have received, and I made a page that started from excess paint from creating my postcards. Hopefully this week you can find time to create something or put together a few RAK's (random acts of kindness) to send to other members or friends or family. Peta has created a video explaining all about it that she has uploaded directly to the group page. Below is a link where you can access it directly. I hope many of you will join us this week in doing something to pay it forward. Oh, and if you haven't already, please make sure your current address is in the proper happy mail list in the Files tab at the top of the KIF page. We have one for US and another for International members. Have a great week!
Due to health issues and doctor bills I have to cut back for a while, please cancel my subscription . I have enjoyed all my classes and I have learned so much and enjoyed being a part of family. Thanks, Lorrie Yeager.


If you're like me, buying Valentine's gifts for your special someone can be a challenge. First, we've been doing it for 14 years, so I feel like I used up all the "good" ideas a while ago. Second, we don't "need" anything, so my practical self struggles with purchasing frivolous gifts he doesn't really need.
Ok, so I'm not going to lie... just about every man would fall over and die if his woman had the guts to do a boudoir photo session. SO - first and foremost - I recommend you do THAT. I did one last year for my 40th birthday and I've never felt sexier or more empowered!
And this one right here might be Winner, Winner Chicken Dinner for Mr. Toth. Lord knows my man loves anything having to do with BBQ!
My guy already has one of these, but trust me... you won't regret buying this for him to make you delicious meals with. Best filet mignon I've ever had! Nom, nom, nom.
Disclaimer: I haven't been compensated in any way by the manufacturers of the above products. They're just things I've found online that I thought would be fun. The "Buy" button is just to make it super easy for YOU!


We can also customize a lens to fit almost any patient.
Our doctors have higher rates of success in fitting astigmatism, bifocal and other specialty contact lenses than many other practices. We utilize our experience, patience, and compassion to make sure each patient is fit with the perfect contact lens.
We have a large inventory of diagnostic contact lenses to accelerate the fitting process. In addition, we have a large stock of contact lenses in our office available for purchase. Why wait to have your lenses shipped to you when you can walk out of our office with your year's supply of contact lenses today?!
We guarantee our contact lenses are competitively priced, plus added discounts if you purchase a full year's supply. Remember that mass distributors focus on volume discounting on cheap, disposable lenses. These lenses may result in poorer vision, more torn lenses, etc. Also beware of hidden surcharges for shipping fees! Purchase your year's supply from our office and if your prescription changes within one year we will gladly and without hassle return the unopened boxes. Add in the rebates that apply to one year supply of contact lenses and you save even more!
----&gt Going on vacation and don't want to worry about traveling with large bottles of contact lens solutions? Do you suffer from allergies that are made worse by your contact lenses? Ask one of our doctors about the benefits of daily disposable contact lenses.
----&gt Are your current contact lenses uncomfortable or dry at the end of the day? Ask us about the improvements in contact lens design and technology that may result in a longer lifespan and less dryness and discomfort.
We are proud to provide co-management of LASIK through our friends at TLC Laser Eye Centers. TLC has two convenient locations in the Chicagoland area: Arlington Heights and Westchester. Call our office to set up an eye exam with one of our doctors to discuss the advantages of LASIK today!


text:
(function(){
	'use strict';

	angular.module('app.pouch',[]);
})();

redpajama_set_name: RedPajamaGithub


Awesome thread! I will contribute soon! My 5yo is going to love this!!
Loving the Star Wars lego shots. I need to start getting creative with the ones I have.
Not sure which I like best.. My son is enthralled with the Ninjago Lego series.
This is his own design, he is 5 and very imaginative!
Post edited over 3 years ago by EightEleven.
My son has really impressed us with his "Master Builder" imagination.. Enjoy!
This is overlooking the Colorado River from the observation deck on the Hoover Dam.
If you moved the guy on the left a tad closer and extended his hand back a bit, it would look like a forbidden love shot.
I'm pretty sure the TF doesn't make mistakes.
Location: I've seen it. It's rubbish.
The only thing a golfer and photographer needs is more light.


Human activity has increased greenhouse gases in the atmosphere and more than doubled the risk of record-breaking hot European summers, like that of 2003, according to a new study by Peter Stott from the Met Office's Hadley Centre for Climate Prediction and Research, and Dáithí Stone and Myles Allen of the University of Oxford.
A previous study at the Hadley Centre for Climate Prediction and Research at the Met Office, demonstrated that large-scale global warming is not a result of urban development. Measurements of night-time air temperature, averaged across a number of weather stations worldwide, show a rate of warming of around 0.19 °C per decade during the period 1950-2000. This rate is the same for calm conditions as it is for windy.
David Parker of the Hadley Centre, who undertook the research, says: "Urban developments have not affected the estimated worldwide warming trend; if they had, the rate of warming would have been greater on calm nights than on windy nights."
This new research - reported today (2 December) in Nature - shows how human influence, mainly fossil fuel burning, can be blamed for increasing the risk of such a heatwave and that this type of summer could be expected to occur as often as every other year by the middle of this century. Linked to more than 27,000 excess deaths across the continent, the temperatures of summer 2003 were almost undoubtedly the highest in Europe for over 500 years.
As climate naturally varies, with some very hot summers and some very cool ones, the hot summer of 2003 could have been dismissed as just another quirk of nature. However, by using sophisticated climate models and new statistical techniques, this study has been able to separate the human factors from natural ones.
"We simulated 2003 summer temperatures over Europe - with and without the effect of man's activities - and compared these with observations," explains Peter Stott. "We found that although the high temperature experienced in 2003 was not impossible in a climate unaltered by man, it is very likely that greenhouse gases have at least doubled the risk and our best estimate is that such a heatwave is now four times more likely as a result of human influence on climate."
Myles Allen has also co-authored (with Richard Lord QC) a commentary on the legal implications of the research, which is published in the same edition of Nature. He says: "Quantifying the costs of climate change requires being able to separate natural from man-made contributions to weather risk. If a dice is loaded to come up six and does so, then clearly there is a sense in which the loading helped this to happen, but when several sixes turn up, it makes no sense to ask which of these are due to the loading. In the same way, we cannot say which of the heatwaves were man-made and which were natural, but we can apportion blame for the change in risk."
Changes in the frequency of extremes are often the most sensitive aspects of climate change for ecosystems and societal responses. According to Dáithí Stone: "This research will help us understand how human influences on climate affect the increased risk of deaths, forest fires, and crop losses."
"We know that 2003-type hot summers and associated heatwaves won't happen every year, but continuing man-made global warming will increase the chance," adds, Peter Stott. "According to our model, by the middle of this century every other summer could be even hotter than 2003."


text:
1,087 10.0 216,176 2.9 649,171 2.8
In the 2016 Census, there were 10,914 people in Casino (State Suburbs). Of these 48.1% were male and 51.9% were female. Aboriginal and/or Torres Strait Islander people made up 10.0% of the population.
The median age of people in Casino (State Suburbs) was 42 years. Children aged 0 - 14 years made up 20.2% of the population and people aged 65 years and over made up 23.7% of the population.
3,532 40.6 2,965,280 48.7 9,148,218 48.1
Of people in Casino (State Suburbs) aged 15 years and over, 40.6% were married and 15.0% were either divorced or separated.
In Casino (State Suburbs), of people aged 15 years and over, 40.6% of people were in a registered marriage and 11.0% were in a de facto marriage.
419 13.2 269,249 11.6 827,505 11.5
In Casino (State Suburbs), 29.2% of people were attending an educational institution. Of these, 28.0% were in primary school, 21.6% in secondary school and 12.9% in a tertiary or technical institution.
1,339 15.4 730,498 12.0 2,442,203 12.8
18 0.2 4,849 0.1 13,454 0.1
1,487 17.1 513,209 8.4 1,529,897 8.0
Of people aged 15 and over in Casino (State Suburbs), 10.1% reported having completed Year 12 as their highest level of educational attainment, 18.9% had completed a Certificate III or IV and 4.9% had completed an Advanced Diploma or Diploma.
Respondents had the option of reporting up to two ancestries on their Census form, and this is captured by the Ancestry Multi Response (ANCP) variable used in this table. Therefore, the total responses count will not equal the persons count for this area. Calculated percentages represent a proportion of all responses from people in Casino (State Suburbs) (including those who did not state an ancestry).
In Casino (State Suburbs), 79.8% of people had both parents born in Australia and 6.1% of people had both parents born overseas.
There were 3,966 people who reported being in the labour force in the week before Census night in Casino (State Suburbs). Of these 49.0% were employed full time, 36.4% were employed part-time and 9.2% were unemployed.
Of employed people in Casino (State Suburbs), 11.4% worked 1 to 15 hours, 11.3% worked 16 to 24 hours and 33.1% worked 40 hours or more.
The median weekly personal income for people aged 15 years and over in Casino (State Suburbs) was $487.
In Casino (State Suburbs), of people aged 15 years and over, 62.5% did unpaid domestic work in the week before the Census. During the two weeks before the Census, 24.7% provided care for children and 13.5% assisted family members or others due to a disability, long term illness or problems related to old age. In the year before the Census, 18.2% of people did voluntary work through an organisation or a group.
Of people who did unpaid domestic work in the week before the Census in Casino (State Suburbs), 23.4% worked 5 to 14 hours, 12.1% worked 15 to 29 hours and 10.9% worked 30 hours or more.
Of the families in Casino (State Suburbs), 34.5% were couple families with children, 38.9% were couple families without children and 24.4% were one parent families.
In Casino (State Suburbs), 17.2% of single parents were male and 82.8% were female.
119 5.9 63,106 4.0 203,596 4.1
In Casino (State Suburbs), of couple families with children, 14.4% had both partners employed full-time, 5.9% had both employed part-time and 16.7% had one employed full-time and the other part-time.
315 6.9 284,741 9.9 1,039,874 11.2
In Casino (State Suburbs), 93.1% of private dwellings were occupied and 6.9% were unoccupied.
Of occupied private dwellings in Casino (State Suburbs), 84.2% were separate houses, 1.7% were semi-detached, row or terrace houses, townhouses etc, 11.8% were flat or apartments and 2.0% were other dwellings.
In Casino (State Suburbs), of occupied private dwellings 3.8% had 1 bedroom, 21.3% had 2 bedrooms and 47.0% had 3 bedrooms. The average number of bedrooms per occupied private dwelling was 3. The average household size was 2.3 people.
Of occupied private dwellings in Casino (State Suburbs), 36.2% were owned outright, 24.2% were owned with a mortgage and 34.8% were rented.
In Casino (State Suburbs), of all households, 63.9% were family households, 33.2% were single person households and 3.0% were group households.
In Casino (State Suburbs), 32.8% of households had a weekly household income of less than $650 and 3.0% of households had a weekly income of more than $3000.
In Casino (State Suburbs), 41.3% of occupied private dwellings had one registered motor vehicle garaged or parked at their address, 32.7% had two registered motor vehicles and 11.8% had three or more registered motor vehicles.
In Casino (State Suburbs), 65.9% of households had at least one person access the internet from the dwelling. This could have been through a desktop/laptop computer, mobile or smart phone, tablet, music or video player, gaming console, smart TV or any other device.
In Casino (State Suburbs), 48.5% of Aboriginal and/or Torres Strait Islander people were male and 51.5% were female. The median age was 19 years.
1 -- 1 -- 1 --
In Casino (State Suburbs), for dwellings occupied by Aboriginal and/or Torres Strait Islander people, the average household size was 3.4 persons, with 1 persons per bedroom. The median household income was $993.
In Casino (State Suburbs), for dwellings occupied by Aboriginal and/or Torres Strait Islander people, the median weekly rent was $240 and the median monthly mortgage repayment was $1,300.


Beacon House Inn is a nostalgic hotel near Wilmington. The former boarding house has been transformed into a classic inn comprising a lot of luster and luxury. The celebrated beach of Carolina is just at a stone's throw from the hotel and the windows and balconies open to the vast beauty of the ocean. Situated in a convenient location, Beacon House is twenty minutes away from the Wilmington Airport.
The hotel rooms feature cable television and complimentary wireless internet access. The hotel lobby features a fireplace and there are barbeque grills and refrigerators in the public areas. Fort Fisher and the Aquarium are only 2 miles away and the beach is just across the street.


text:
\subsection{The coarse-grained type system, {CG}}
\label{sec:cg}

\input{cg-typesystem}

Our coarse-grained type system, {CG}, is a variant of the static
fragment of the hybrid IFC type system
HLIO~\cite{icfp15-HLIO}.\footnote{\update{Differences between {CG} and HLIO
  and their consequences are discussed in
  Section~\ref{sec:discussion}.}} Like {FG}, {CG} also operates on a
  higher-order, eager, call-by-value language with state, but it
  separates pure expressions from impure (stateful) ones at the level
  of types. This is done, as usual, by introducing a monad for state,
  and limiting all state-accessing operations (dereferencing,
  allocation, assignment) to the monad. However, in {CG}, as in HLIO,
  the monad also doubles as the unit of labeling. Values and types are
  not necessarily labeled individually in {CG}. Instead, there is a
  confidentiality label on an entire monadic computation. This makes
  {CG} coarse-grained.

{CG}'s syntax and type system are shown in
Figure~\ref{fig:cg-ts}. The types include all the usual types of the
simply typed $\lambda$-calculus and, unlike {FG}, a label is not
forced on every type. There are two special types: $\tslio
{\ell_1}{\ell_2}{\tau}$ and $\tlabeled{\ell}{\tau}$.

The type $\tslio {\ell_1}{\ell_2}{\tau}$ is the aforementioned
monadic type of computations that may access the heap (expressions of
other types cannot access the heap), eventually producing a value of
type $\tau$. The first label $\ell_1$, called the \emph{pc-label},
is a lower bound on the write effects of the computation. The second
label $\ell_2$, called the \emph{taint label}, is an upper bound on
the labels of all values that the computation has analyzed so far; it
is, for this reason, also an \emph{implicit} label on the output type
$\tau$ of the computation, and on any intermediate values within the
computation.

The type $\tlabeled{\ell}{\tau}$ explicitly labels a value (of type
$\tau$) with label~$\ell$. In {FG}'s notation, this would be
analogous to $\tau^\ell$. The difference is that this labeling can
be used \emph{selectively} in {CG}; unlike {FG}, not every type must
be labeled. Also, the reference type $\kw{ref}~\ell~\tau$ carries an
explicit label $\ell$ in {CG}. Such a reference stores a value of
type $\tlabeled{\ell}{\tau}$. \update{Labels on references are
  necessary to prevent implicit leaks via control dependencies---the
  type system relates the pc-label to the label of the written value
  at every assignment. Similar labels on references were unnecessary
  in {FG} since every written value always carries a label anyhow.}

\medskip
\noindent\textbf{Typing rules.}  {CG} uses the standard typing
judgment $\Gamma \vdash e: \tau$. There is no need for a $\mathit{pc}$ on the
judgment since effects are confined to the monad. {CG} uses the
typing rules of the simply typed $\lambda$-calculus for the type
constructs $\kw{b}$, $\kw{unit}$, $\times$, $+$ and $\rightarrow$. We do
not re-iterate these standard rules, and focus here only on the new
constructs. The construct $\kw{ret}(e)$ is the monadic return that
immediately returns $e$, without any heap access. Consequently, it can
be given the type $\tslio{\top}{\bot}{\tau}$ (rule
\rname{{CG}-ret}). The pc-label is $\top$ since the computation has
no write effect, while the taint label is $\bot$ since the computation
has not analyzed any value.

The monadic construct $\kw{bind}(e_1, x.e_2)$ sequences the computation
$e_2$ after $e_1$, binding the return value of $e_1$ to $x$ in
$e_2$. The typing rule for this construct, \rname{{CG}-bind}, is
important and interesting. The rule says that $\kw{bind}(e_1, x.e_2)$ can
be given the type $\tslio {\ell} {\ell_4} {\tau'}$ if $(e_1:
\tslio{\ell_1}{\ell_2}{\tau})$, $(e_2:
\tslio{\ell_3}{\ell_4}{\tau'})$ and four conditions hold. The
conditions $\ell \sqsubseteq \ell_1$ and $\ell \sqsubseteq \ell_3$
check that the pc-label of $\kw{bind}(e_1, x.e_2)$, which is $\ell$,
is below the pc-label of $e_1$ and $e_2$, which are $\ell_1$ and
$\ell_3$, respectively. This ensures that the write effects of
$\kw{bind}(e_1, x.e_2)$ are indeed above its pc-label, $\ell$. The
conditions $\ell_2 \sqsubseteq \ell_3$ and $\ell_2 \sqsubseteq
\ell_4$ prevent leaking the output of $e_1$ via
the write effects and the output of $e_2$, respectively. Observe how
these conditions together track labels at the level of entire
computations, i.e., coarsely.

Next, we describe rules pertaining to the type
$\tlabeled{\ell}{\tau}$. This type is introduced using the
expression constructor $\elabel{}$, as in rule
\rname{{CG}-label}. Dually, if $e: \tlabeled{\ell}{\tau}$, then
the construct $\kw{unlabel}(e)$ eliminates this label. This construct has
the monadic type $\tslio{\top}{\ell}{\tau}$. The taint label
$\ell$ indicates that the computation has (internally) analyzed
something labeled $\ell$. The pc-label is $\top$ since nothing has
been written.

Rule \rname{{CG}-deref} says that dereferencing (reading) a location
of type $\kw{ref}~\ell'~\tau$ produces a computation of type
$\tslio{\top}{\bot}{(\tlabeled{\ell'}{\tau})}$. The type is monadic
because dereferencing accesses the heap. The value the computation
returns is explicitly labeled at $\ell'$. The pc-label is $\top$
since the computation does not write, while the taint label is $\bot$
since the computation does not analyze the value it reads from the
reference. (The taint label will change to $\ell'$ if the read value
is subsequently unlabeled.) Dually, the rule \rname{{CG}-assign}
allows assigning a value labeled $\ell$ to a reference labeled
$\ell$. The result is a computation of type
$\tslio{\ell}{\bot}{\kw{unit}}$. The pc-label $\ell$ indicates a
write effect at level $\ell$.

The last typing rule we highlight pertains to a special construct,
$\kw{toLabeled}(e)$. This construct transforms $e$ of monadic type
$\tslio{\ell}{\ell'}{\tau}$ to the type
$\tslio{\ell}{\bot}{(\tlabeled{\ell'}{\tau})}$. This is
perfectly safe since the only way to observe the output of a monad is
by binding its result and that result is explicitly labeled in the
final type. The purpose of using this construct is to reduce the taint
label of a computation to $\bot$. This allows a subsequent
computation, which will \emph{not} analyze the output of the current
computation, to avoid raising its own taint label to
$\ell'$. Hence, this construct limits the scope of the taint label
to a single computation, and prevents overtainting subsequent
computations. We make extensive use of this construct in our
translation from {FG} to {CG}. We note that HLIO's original typing
rule for $\kw{toLabeled}$ is different, and does not always allow
reducing the taint to $\bot$. We discuss the consequences of this
difference in Section~\ref{sec:discussion}.

We briefly comment on subtyping for specific constructs in
{CG}. Subtyping of $\tlabeled{\ell}{\tau}$ is co-variant in
$\ell$, since it is always safe to increase a confidentiality
label. Subtyping of $\tslio{\ell_1}{\ell_2}{\tau}$ is
contra-variant in the pc-label $\ell_1$ and co-variant in the taint
label $\ell_2$ since the former is a lower bound while the latter
is an upper bound.

We prove soundness for {CG} by showing that every well-typed
expression satisfies noninterference. Due to the presence of monadic
types, the soundness theorem takes a specific form (shown below), and
refers to a \emph{forcing semantics}. These semantics operate on
monadic types and actually perform reads and writes on the heap (in
contrast, the pure evaluation semantics simply return suspended
computations for monadic types). The forcing semantics are the
expected ones, so we defer their details to the appendix.

\begin{thm}[Noninterference for {CG}]
  \label{thm:ni-cg}
  Suppose (1) $\ell_i \not\sqsubseteq \ell$, (2)
  $x: \tlabeled{\ell_i}{\tau} \vdash e: \tslio{\_}{\ell}{\kw{bool}}$, and (3)
  $v_1, v_2: \tlabeled{\ell_i}{\tau}$. If both $e[v_1/x]$ and $e[v_2/x]$ terminate when forced,
  then they produce the same value (of type $\kw{bool}$).
\end{thm}

\subsubsection{Semantic model of {CG}}
We build a semantic model of {CG}'s types. The model is very similar
in structure to the model of {FG}'s types. We use two
interpretations, unary and binary, and worlds exactly as in {FG}'s
model. The difference is that since state effects are confined to a
monad in {CG}, all the constraints on heap updates move from the
expression relations to the value relations at the monadic
types. Owing to lack of space, and the similarity in the structures of
the models, we defer {CG}'s model and the fundamental theorems to the
appendix.

\subsection{Translating {CG} to {FG}}
\label{sec:cg2fg}

\input{expr-trans-cg-to-fg}

This section describes the translation in the other direction---from
{CG} to {FG}. The overall structure (but not the details!) of this
translation are similar to that of the earlier {FG} to {CG}
translation, so we skip some boilerplate material here. The
superscript or subscript $s$ (source) now marks elements of {CG} and
$t$ (target) marks elements of {FG}.

The key idea of the translation is to map a source ({CG}) expression
$e_s$ satisfying $\vdash e_s: \tau$ to a target ({FG}) expression
$e_t$ satisfying $\vdash_\top e_t: \trans{\tau}$. The type translation
$\trans{\tau}$ is defined below. The $\mathit{pc}$ for the translated
expression is $\top$ because, in {CG}, all effects are confined to a
monad, so at the top-level, there are no effects. In particular, there
are no write effects, so we can pick any $\mathit{pc}$; we pick the most
informative $\mathit{pc}$, $\top$.

The type translation, $\trans{\tau}$, is defined by induction on
$\tau$.
\[
    \begin{array}{l@{~}c@{~}l}
      \trans{\kw{b}} 						& = & \kw{b}^\bot \\
      \trans{\tau_1 \to \tau_2} 			& = &
                                                              (\trans{\tau_1} \overset{\top}{\to} \trans{\tau_2})^\bot \\
      \trans{\tau_1 \times \tau_2} 		& = & (\trans{\tau_1} \times \trans{\tau_2})^\bot \\
      \trans{\tau_1 + \tau_2} 			& = & (\trans{\tau_1} + \trans{\tau_2})^\bot \\
  \trans{\kw{ref}~ \ell~ \tau} 		& = & (\kw{ref}~ (\trans{\tau} + \kw{unit})^\ell)^\bot \\
  \trans{\tslio{\ell_1}{\ell_2}{\tau}}
                                  & = &
                                        (\kw{unit} \overset{\ell_1}{\to} (\trans{\tau} + \kw{unit})^{\ell_2})^\bot\\
  \trans{\tlabeled{\ell}{\tau}} & = & (\trans{\tau} + \kw{unit})^\ell
    \end{array}
\]

The most interesting case of the translation is that for
$\tslio{\ell_1}{\ell_2}{\tau}$. Since a {CG} value of this type
is a suspended computation, we map this type to a \emph{thunk}---a
suspended computation implemented as a function whose argument has
type $\kw{unit}$. The pc-label on the function matches the pc-label
$\ell_1$ of the source type. The taint label $\ell_2$ is placed
on the output type $\trans{\tau}$ using a coding trick: $(\trans{\tau}
+ \kw{unit})^{\ell_2}$. The expression translation of monadic
expressions only ever produces values labeled $\kw{inl}$, so the right
type of the sum, $\kw{unit}$, is never reached during the execution of a
translated expression. The same coding trick is used to translate
labeled and ref types. We could also have used a different coding in
place of $(\trans{\tau} + \kw{unit})^{\ell_2}$. For example,
$(\trans{\tau} \times \kw{unit})^{\ell_2}$ works equally well.

The expression translation is directed by source typing derivations
and is defined by the judgment $\Gamma \vdash e_s: \tau \leadsto e_t$,
some of whose rules are shown in Figure~\ref{fig:cg-to-fg-term}. The
translation is fairly straightforward (given the type
translation). The only noteworthy aspect is the use of the injection
$\kw{inl}$ wherever an expression of the type form $(\trans{\tau} +
\kw{unit})^{\ell}$ needs to be constructed.

\medskip \noindent \textbf{Properties.}  The translation preserves
typing by construction, as formalized in the following theorem. The
context translation $\trans{\Gamma}$ is defined pointwise on all types
in $\Gamma$.
\begin{thm}[Typing preservation]\label{thm:cg-2-fg-typePres}
  If $\Gamma \vdash e_s: \tau$ in {CG}, then there is a unique $e_t$
  such that $\Gamma \vdash e_s: \tau \leadsto e_t$ and that $e_t$
  satisfies $\trans{\Gamma} \vdash_\top e_t: \trans{\tau}$ in {FG}.
\end{thm}
Again, a corollary of this theorem is that well-typed source programs
translate to noninterfering target programs.

We further prove that the translation preserves the semantics of
programs. Our approach is the same as that for the {FG} to {CG}
translation---we set up a cross-language logical relation, this time
indexed by {CG} types, and show the fundamental theorem. From this,
we derive that the translation preserves the meanings of
programs. Additionally, we derive the noninterference theorem for
{CG} using the binary fundamental theorem of {FG}, thus gaining
confidence that our translation maps security labels properly. Since
this development mirrors that for our earlier translation, we defer
the details to the appendix.

\section{Conclusion}
\label{sec:conclusion}

\update{This paper has examined the question of whether information
  flow type systems that label at fine granularity and those that
  label at coarse granularity are equally expressive.} We answer this
question in the affirmative, assuming that the coarse-grained type
system has a construct to limit the scope of the taint label. A more
foundational contribution of our work is a better understanding of
semantic models of information flow types. To this end, we have
presented logical relations models of types in both the fine-grained
and the coarse-grained settings, for calculi with mutable higher-order
state.

\medskip \noindent \textbf{\update{Acknowledgments.}}  \update{This
  work was partly supported by the German Science Foundation (DFG)
  through the project ``Information Flow Control for Browser Clients
  -- IFC4BC'' in the priority program ``Reliably Secure Software
  Systems -- RS$^3$'', and also through the Collaborative Research
  Center ``Methods and Tools for Understanding and Controlling
  Privacy'' (SFB 1223). We thank our anonymous reviewers and anonymous
  shepherd for their helpful feedback.}

\section{Discussion}
\label{sec:discussion}

\noindent \update{\textbf{Practical implications.}} \update{Our
  results establish that a coarse-grained IFC type system that labels
  at the granularity of entire computations can be as expressive as a
  fine-grained IFC type system that labels every individual value, if
  the coarse-grained type system has a construct like $\kw{toLabeled}$ to
  limit the scope of taints. It is also usually the case that a
  coarse-grained type system burdens a programmer less with
  annotations as compared to a fine-grained type system. This leads to
  the conclusion that, in general, there is merit to preferring
  coarse-grained IFC type systems with taint-scope limiting constructs
  over fine-grained IFC type systems. In a coarse-grained type system,
  the programmer can benefit from the reduced annotation burden and
  simulate the fine-grained type system when the fine-grained labeling
  is absolutely necessary for verification. Since our embedding of the
  fine-grained type system in the coarse-grained type system is
  compositional, it can be easily implemented in the coarse-grained
  type system as a library of macros, one for each construct of the
  language of the fine-grained type system.}

\medskip
\noindent\textbf{Original HLIO.} The original HLIO
system~\cite{icfp15-HLIO}, from whose static fragment {CG} is
adapted, differs from {CG} in the interpretation of the labels
$\ell_1$ and $\ell_2$ in the monadic type
$\tslio{\ell_1}{\ell_2}{\tau}$. {CG} interprets these labels as
the pc-label and the taint label, respectively. HLIO interprets these
labels as the \emph{starting taint} and the \emph{ending taint} of the
computation. This implies an \emph{invariant} that $\ell_1 \sqsubseteq
\ell_2$ and makes HLIO more restrictive that {CG}. The relevant
consequence of this difference is that the rule for $\kw{toLabeled}$
cannot always lower the final taint to $\bot$. HLIO's rule is:
\[   \inferrule
   { \Gamma \vdash e: \tslio{\ell}{\ell'}{\tau} }
   {
    \Gamma \vdash \kw{toLabeled}(e)
   		: \tslio{\ell}{\ell}{(\tlabeled{\ell'}{\tau})}
   }
   \rname{{CG}-toLabeled}
\]
This restrictive rule makes it impossible to translate from {FG} to
HLIO in the way we translate from {FG} to {CG}. In
fact,~\cite{siglog17-ifcComp} already explains how this restriction
makes a translation from {FG} to the static fragment of HLIO very
difficult. Our observation here is that HLIO's restriction, inherited
from a prior system called LIO, is not important for statically
enforced IFC and eliminating it allows a simple embedding of a
fine-grained IFC type system.

Nonetheless, we did investigate further whether we can embed {FG}
into the static fragment of the unmodified HLIO. The answer is still
affirmative, but the embedding is complex and requires nontrivial
quantification over labels. Part II of our appendix contains a
complete account of this embedding (in fact, the appendix contains a
parallel account of all our results using the original HLIO in place
of {CG}).

\update{HLIO also has two constructs, getLabel and labelOf, that allow
  reflection on labels. However, these constructs are meaningful only
  because HLIO uses hybrid (both static and dynamic) enforcement and
  carries labels at runtime. In a purely static enforcement, such as
  {CG}'s, labels are not carried at runtime, so reflection on them is
  not meaningful.}

\medskip
\noindent \textbf{Full abstraction.}  Since our translations preserve
typed-ness, they map well-typed source programs to noninterfering
target programs. However, an open question is whether they preserve
contextual equivalence, i.e., whether they are fully
abstract. Establishing full abstraction will allow translated source
expressions to be freely co-linked with target expressions. We haven't
attempted a proof of full abstraction yet, but it looks like an
interesting next step. \update{We note that since our dynamic
  semantics (big-step evaluation) are not cognizant of IFC (which is
  enforced completely statically), it may be sufficient to generalize
  our translations to simply-typed variants of FG and CG, and prove
  those fully abstract.}

\medskip
\noindent \textbf{Other IFC properties.}  Our current setup is geared
towards proving \emph{termination-insensitive} noninterference, where
the adversary cannot observe nontermination. We believe that the
approach itself and the equivalence result should generalize to
termination-sensitive noninterference, but will require nontrivial
changes to our development. For example, we will have to change our
binary logical relations to imply co-termination of related
expressions and, additionally, modify the type systems to track
nontermination as a separate effect.

Another relevant question in whether our equivalence result can be
extended to type systems that support declassification and, more
foundationally, whether our logical relations can handle
declassification. This is a nuanced question, since it is unclear
hitherto how declassification can be given a compositional semantic
model. We are working on this problem currently.

\subsection{The fine-grained type system, {FG}}
\label{sec:fg}

\input{fg-typesystem}

{FG} is based on the SLam calculus~\cite{popl98-SLAM}, but uses a
presentation similar to Flow Caml, an IFC type system for
ML~\cite{toplas03-flowcaml}. It works on a call-by-value, eager
language, which is a simplification of ML. The syntax of the language
is shown at the top of Figure~\ref{fig:fg-ts}. The language has all
the usual expected constructs: Functions, pairs, sums, and mutable
references (heap locations). The expression ${!}e$ dereferences the
location that $e$ evaluates to, while ${e_1 := e_2}$ assigns the value
that $e_2$ evaluates to, to the location that $e_1$ evaluates to. The
dynamic semantics of the language are defined by a ``big-step''
judgment $(\mathit{H}, e) \ReducesTo{j} (\mathit{H}', \mathit{v})$, which means that
starting from heap $\mathit{H}$, expression $e$ evaluates to value $\mathit{v}$,
ending with heap $H'$. This evaluation takes $j$ steps. The number of
steps is important only for our logical relations models. The rules
for the big-step judgment are standard, hence omitted here.

Every type $\tau$ in {FG}, including a type nested inside another,
carries a security label. The security label represents the
confidentiality level of the values the type ascribes. It is also
convenient to define unlabeled types, denoted $\kw{A}$, as shown in
Figure~\ref{fig:fg-ts}.

\medskip
\noindent\textbf{Typing rules.}  {FG} uses the typing judgment
$\Gamma \vdash_\mathit{pc} e: \tau$. As usual, $\Gamma$ maps free variables of
$e$ to their types. The judgment means that, given the types for free
variables as in $\Gamma$, $e$ has type $\tau$. The annotation $\mathit{pc}$ is
also a label drawn from $\mathcal{L}$, often called the ``program
counter'' label. This label is a \emph{lower bound} on the write
effects of $e$. The type system ensures that any reference that $e$
writes to is at a level $\mathit{pc}$ or higher. This is necessary to prevent
information leaks via the heap. A similar annotation, $\ell_e$,
appears in the function type $\tau_1 \overset{\llabel_e}\to \tau_2$. Here, $\ell_e$
is a lower bound on the write effects of the body of the function.

{FG}'s typing rules are shown in Figure~\ref{fig:fg-ts}. We describe
some of the important rules. In the rule for case analysis
({{FG}-case}), if the case analyzed expression $e$ has label
$\ell$, then both the case branches are typed in a $\mathit{pc}$ that is
\emph{joined} with $\ell$. This ensures that the branches do not
have write effects below $\ell$, which is necessary for IFC since
the execution of the branches is control dependent on a value (the
case condition) of confidentiality $\ell$. Similarly, the type of
the result of the case branches, $\tau$, must have a top-level label
at least $\ell$. This is indicated by the premise $\tau \searrow
\ell$ and prevents implicit leaks via the result. The relation
$\tau \searrow \ell$, read ``$\tau$ protected at
$\ell$''~\cite{popl99-DCC}, means that if $\tau =
\kw{A}^{\ell'}$, then $\ell \sqsubseteq \ell'$.

The rule for function application ({{FG}-app}) follows similar
principles. If the function expression $e_1$ being applied has type
$(\tau_1 \overset{\llabel_e}\to \tau_2)^{\ell}$, then $\ell$ must be below
$\ell_e$ and the result $\tau_2$ must be protected at $\ell$ to
prevent implicit leaks arising from the identity of the function that
$e_1$ evaluates to.

In the rule for assignment ({{FG}-assign}), if the expression
$e_1$ being assigned has type $(\kw{ref}~ \tau)^\ell$, then $\tau$
must be protected at $\mathit{pc} \sqcup \ell$ to ensure that the written
value (of type $\tau$) has a label above $\mathit{pc}$ and $\ell$. The
former enforces the meaning of the judgment's $\mathit{pc}$, while the latter
protects the identity of the reference that $e_1$ evaluates to.

All introduction rules such as those for $\lambda$s, pairs and sums
produce expressions labeled $\bot$. This label can be weakened
(increased) freely with the subtyping rule {{FG}sub-label}. The
other subtyping rules are the expected ones, e.g., subtyping for
unlabeled function types $\tau_1 \overset{\llabel_e}\to \tau_2$ is co-variant in
$\tau_2$ and contra-variant in $\tau_1$ and $\ell_e$
(contra-variance in $\ell_e$ is required since $\ell_e$ is a
\emph{lower} bound on an effect). Subtyping for $\kw{ref}~\tau$ is
invariant in $\tau$, as usual.

The main meta-theorem of interest to us is soundness. This theorem
says that every well-typed expression is \emph{noninterferent}, i.e.,
the result of running an expression of a type labeled low is
independent of substitutions used for its high-labeled free
variables. This theorem is formalized below. Note that we work here
with what is called termination-insensitive noninterference; we
briefly discuss the termination-sensitive variant in
Section~\ref{sec:discussion}.
\begin{thm}[Noninterference for {FG}]
    \label{thm:ni-fg}
  Suppose (1) $\ell_i \not\sqsubseteq \ell$, (2)
  $x : \kw{A}^{\ell_i} \vdash_\mathit{pc} e: \kw{bool}^\ell$, and (3)
  $ v_1, v_2: \smash{\smash{\kw{A}}^{\smash{\ell}_i}}$. If both $e[v_1/x]$ and $e[v_2/x]$
  terminate, then they produce the same value (of type $\kw{bool}$).
\end{thm}

By definition, noninterference, as stated above is a relational
(binary) property, i.e., it relates two runs of a program. Next, we
show how to build a semantic model of {FG}'s types that allows
proving this property.

\subsubsection{Semantic model of {FG}}\label{sec:fg-sem}
\input{fg-semantic-model}
We now describe our semantic model of {FG}'s types. We use this model
to show that the type system is sound (Theorem~\ref{thm:ni-fg}) and
later to prove the soundness of our translations. Our semantic model
uses the technique of step-indexed Kripke logical
relations~\cite{DBLP:conf/popl/AhmedDR09} and is more directly based
on a model of types in a different domain, namely, incremental
computational complexity~\cite{DBLP:conf/icfp/CicekP016}. In
particular, our model captures all the invariants necessary to prove
noninterference.

The central idea behind our model is to interpret each type in two
different ways---as a set of values (unary interpretation), and as a
set of pairs of values (binary interpretation). The binary
interpretation is used to relate \emph{low}-labeled types in the two
runs mentioned in the noninterference theorem, while the unary
interpretation is used to interpret \emph{high}-labeled types
independently in the two runs (since high-labeled values may be
unrelated across the two runs). What is high and what is low is
determined by the level of the observer (adversary), which is a
parameter to our binary interpretation.

\textit{Remark.} Readers familiar with earlier models of IFC type
systems~\cite{popl98-SLAM,popl99-DCC,esop99-PER-IFC} may wonder why we
need a unary relation, when prior work did not. The reason is that we
handle an effect (mutable state) in our model, which prior work did
not. In the absence of effects, the unary model is unnecessary. In the
presence of effects, the unary relation captures what is often called
the ``confinement lemma'' in proofs of noninterference---we need to
know that while the two runs are executing high branches
independently, neither will modify low-labeled locations.

\medskip
\noindent \textbf{Unary interpretation.}
The unary interpretation of types is shown in
Figure~\ref{fig:ulr-fg}. The interpretation is actually a Kripke
model. It uses \emph{worlds}, written $\theta$, which specify the
type for each valid (allocated) location in the heap. For example,
$\theta(a) = \kw{bool}^H$ means that location $a$ should hold a high
boolean. The world can grow as the program executes and allocates more
locations. A second important component used in the interpretation is
a \emph{step-index}, written $m$
or~$n$~\cite{esop06-SILR}. Step-indices are natural numbers, and are
merely a technical device to break a non-well-foundedness issue in
Kripke models of higher-order state, like this one. Our use of
step-indices is standard and readers may ignore them.

The interpretation itself consists of three mutually inductive
relations---a \emph{value relation} for types (labeled and unlabeled),
written $\Ulrv {\tau}$; an \emph{expression relation} for labeled
types, written $\Ulre {\tau}$; and a \emph{heap conformance relation},
written $(n,\mathit{H}) \wDefined{} \theta$. These relations are
well-founded by induction on the step indices $n$ and types. This is
the only role of step-indices in our model.

The value relation $\Ulrv {\tau}$ defines, for each type, which values
(at which worlds and step-indices) lie in that type. For base types
$\kw{b}$, this is straightforward: All syntactic values of type
$\kw{b}$ (written $\llbracket \kw{b} \rrbracket$) lie in $\Ulrv
{\kw{b}}$ at any world and any step index. For pairs, the relation is
the intuitive one: $(v_1,v_2)$ is in $\Ulrv{\tau_1 \times \tau_2}$ iff
$v_1$ is in $\Ulrv{\tau_1}$ and $v_2$ is in $\Ulrv{\tau_2}$. The
function type $\tau_1 \overset{\llabel_e}\to \tau_2$ contains a value $\lambda x.e$ at
world $\theta$ if in any world $\theta'$ that extends $\theta$, if $v$
is in $\Ulrv{\tau_1}$, then $(\lambda x.e)\ v$ or, equivalently,
$e[v/x]$, is in the \emph{expression relation} $\lreu {\tau_2}
{\ell_e}$. We describe this expression relation below. Importantly,
we allow for the world $\theta$ to be extended to $\theta'$ since
between the time that the function $\lambda x.e$ was created and the
time that the function is applied, new locations could be
allocated. The type $\kw{ref}~\tau$ contains all locations $a$ whose type
according to the world $\theta$ matches $\tau$. Finally, security
labels play no role in the unary interpretation, so $\Ulrv
{\kw{A}^{\ell}} = \Ulrv {\kw{A}}$ (in contrast, labels play a
significant role in the binary interpretation).

The expression relation $\Ulre {\tau}$ defines, for each type, which
expressions lie in the type (at each $\mathit{pc}$, each world $\theta$ and
each step index $n$). The definition may look complex, but is
relatively straightforward: $e$ is in $\Ulre {\tau}$ if for any heap
$\mathit{H}$ that conforms to the world $\theta$ such that running $e$
starting from $\mathit{H}$ results in a value $\mathit{v}'$ and a heap $\mathit{H}'$,
there is a some extension $\theta'$ of $\theta$ to which $\mathit{H}'$
conforms and at which $v'$ is in $\Ulrv{\tau}$. Additionally, all
writes performed during the execution (defined as the locations at
which $\mathit{H}$ and $\mathit{H}'$ differ) must have labels above the program
counter, $\mathit{pc}$. In simpler words, the definition simply says that $e$
lies in $\Ulre {\tau}$ if its resulting value is in $\Ulrv{\tau}$, it
preserves heap conformance with worlds and, importantly, its write
effects are at labels above $\mathit{pc}$. (Readers familiar with proofs of
noninterference should note that the condition on write effects is our
model's analogue of the so-called ``confinement lemma''.)

The heap conformance relation $(n,\mathit{H}) \wDefined{} \theta$ defines
when a heap $\mathit{H}$ conforms to a world $\theta$. The relation is
simple; it holds when the heap $\mathit{H}$ maps every location to a value
in the semantic interpretation of the location's type given by the
world $\theta$.

\medskip
\noindent \textbf{Binary interpretation.}
The binary interpretation of types is shown in
Figure~\ref{fig:blr-fg}. This interpretation relates two executions of
a program with different inputs. Like the unary interpretation, this
interpretation is also a Kripke model. Its worlds, written $\mathit{W}$,
are different, though. Each world is a triple $\mathit{W} = (\theta_1,
\theta_2, \hat{\beta})$. $\theta_1$ and $\theta_2$ are unary worlds that
specify the types of locations allocated in the two executions. Since
executions may proceed in sync on the two sides for a while, then
diverge in a high-labeled branch, then possibly re-synchronize, and so
on, some locations allocated on one side may have analogues on the
other side, while other locations may be unique to either side. This
is captured by $\hat{\beta}$, which is a \emph{partial bijection} between the
domains of $\theta_1$ and $\theta_2$. If $(a_1, a_2) \in \hat{\beta}$, then
location $a_1$ in the first run corresponds to location $a_2$ in the
second run. Any location not in $\hat{\beta}$ has no analogue on the other
side.

As before, the interpretation itself consists of three mutually
inductive relations---a \emph{value relation} for types (labeled and
unlabeled), written $\Blrv {\tau}$; an \emph{expression relation} for
labeled types, written $\Blre {\tau}$; and a \emph{heap conformance
  relation}, written $(n, \mathit{H}_1, \mathit{H}_2) \wDefined{\mathcal{A}}
\mathit{W}$. These relations are all parametrized by the level of the
observer (adversary), $\mathcal{A}$, which is an element of $\mathcal{L}$.

The value relation $\Blrv {\tau}$ defines, for each type, which pairs
of values from the two runs are related by that type (at each world,
each step-index and each adversary). At base types, $\kw{b}$, only
identical values are related. For pairs, the relation is the intuitive
one: $(v_1,v_2)$ and $(v_1',v_2')$ are related in $\Blrv{\tau_1 \times
  \tau_2}$ iff $v_i$ and $v_i'$ are related in $\Blrv{\tau_i}$ for $i
\in \{1,2\}$. Two values are related at a sum type only if they are
both left injections or both right injections. At the function type
$\tau_1 \overset{\llabel_e}\to \tau_2$, two functions are related if they map values
related at the argument type $\tau_1$ to expressions related at the
result type $\tau_2$. For technical reasons, we also need both the
functions to satisfy the conditions of the \emph{unary} relation. At a
reference type $\kw{ref}~\tau$, two locations $a_1$ and $a_2$ are related
at world $\mathit{W} = (\theta_1, \theta_2, \hat{\beta})$ only if they are
related by $\hat{\beta}$ (i.e., they are correspondingly allocated locations)
and their types as specified by $\theta_1$ and $\theta_2$ are equal
to $\tau$.

Finally, and most importantly, at a labeled type $\kw{A}^{\ell}$,
$\Blrv{\kw{A}^{\ell}}$ relates values depending on the ordering
between $\ell$ and the adversary $\mathcal{A}$. When $\ell \sqsubseteq
\mathcal{A}$, the adversary can see values labeled $\ell$, so
$\Blrv{\kw{A}^{\ell}}$ contains exactly the values related in
$\Blrv{\kw{A}}$. When $\ell \not\sqsubseteq \mathcal{A}$, values labeled
$\ell$ are opaque to the adversary (in colloquial terms, they are
``high''), so they can be arbitrary. In this case,
$\Blrv{\kw{A}^{\ell}}$ is the cross product of the \emph{unary}
interpretation of $\kw{A}$ with itself. This is the only place in our
model where the binary and unary interpretations interact.

The expression relation $\Blre {\tau}$ defines, for each type, which
pairs of expressions from the two executions lie in the type (at each
world $\mathit{W}$, each step index $n$ and each
adversary~$\mathcal{A}$). The definition is similar to that in the unary
case: $e_1$ and $e_2$ lie in $\Blre{\tau}$ if the values they produce
are related in the value relation $\Blrv{\tau}$, and the expressions
preserve heap conformance.

The heap conformance relation $(n, \mathit{H}_1, \mathit{H}_2)
\wDefined{\mathcal{A}} \mathit{W}$ defines when a pair of heaps $\mathit{H}_1$,
$\mathit{H}_2$ conforms to a world $\mathit{W}=(\theta_1, \theta_2,
\hat{\beta})$. The relation requires that any pair of locations related by
$\hat{\beta}$ have the same types (according to $\theta_1$ and $\theta_2$),
and that the values stored in $\mathit{H}_1$ and $\mathit{H}_2$ at these
locations lie in the binary value relation of that common type.

\medskip
\noindent \textbf{Meta-theory.}  The primary meta-theoretic property
of a logical relations model like ours is the so-called
\emph{fundamental theorem}. This theorem says that any expression
syntactically in a type (as established via the type system) also lies
in the semantic interpretation (the expression relation) of that
type. Here, we have two such theorems---one for the unary
interpretation and one for the binary interpretation.

To write these theorems, we define unary and binary interpretations of
contexts, $\Ulrv{\Gamma}$ and $\Blrv{\Gamma}$, respectively. These
interpretations specify when unary and binary substitutions conform to
$\Gamma$. A unary substitution $\delta$ maps each variable to a
value whereas a binary substitution $\gamma$ maps each variable to
two values, one for each run.
\begin{mathpar}
  \begin{array}{@{}l@{\,}l@{\,}l@{}}
    \Ulrv {\Gamma} & \triangleq &
    \begin{array}[t]{@{}l@{}}
      \{(\theta, n, \delta) ~|~  \mathtt{dom}(\Gamma) \subseteq \mathtt{dom}(\delta) \wedge
                                  \forall x \in \mathtt{dom}(\Gamma). \\
~~~~~~~~~~~~~~~~(\theta, n, \delta(x)) \in \Ulrv {\Gamma(x)}
       \}
    \end{array}\\
  \Blrv {\Gamma} & \triangleq &
  \begin{array}[t]{@{}l@{}}
    \{(\mathit{W}, n, \gamma) ~|~
    \mathtt{dom}(\Gamma) \subseteq \mathtt{dom}(\gamma) \wedge \forall x \in
    \mathtt{dom}(\Gamma). \\
~~~~~~~~~~~~    (\mathit{W}, n, \pi_1(\gamma(x)), \pi_2(\gamma(x)))
    \in \Blrv {\Gamma(x)} \}
    \end{array}
  \end{array}
\end{mathpar}

\begin{thm}[Unary fundamental theorem]
\label{thm:fundUnary-fg}
If $\Gamma \vdash_{\mathit{pc}} e:\tau$
and $(\theta, n, \delta) \in \Ulrv {\Gamma }$, then
$(\theta, n, e ~ \delta) \in \lreu {\tau} {\mathit{pc}}$.
\end{thm}

\begin{thm}[Binary fundamental theorem]
  \label{thm:fundBinary-fg}
  If $\Gamma \vdash_{\mathit{pc}} e:\tau$ and $(\mathit{W}, n, \gamma) \in \Blrv
  {\Gamma}$, then $(\mathit{W}, n, e ~ (\gamma \proj{1}), e ~ (\gamma
  \proj {2})) \in \Blre {\tau} $, where $\gamma\proj{1}$ and
  $\gamma\proj{2}$ are the left and right projections of $\gamma$.
\end{thm}

The proofs of these theorems proceed by induction on the given
derivations of $\Gamma \vdash_{\mathit{pc}} e:\tau$. The proofs are tedious,
but not difficult or surprising. The primary difficulty, as with all
logical relations models, is in setting up the model correctly, not in
proving the fundamental theorems.

{FG}'s noninterference theorem (Theorem~\ref{thm:ni-fg}) is a simple
corollary of these two theorems.

\subsection{Translating {FG} to {CG}}
\label{sec:fg-2-cg}

\input{expr-trans-fg-to-cg}

Our goal in translating {FG} to {CG} is to show how a fine-grained
IFC type system can be simulated in a coarse-grained one. Our
translation is directed by the type derivations in {FG} and preserves
typing and semantics. We describe the translation below, followed by
formal properties of the translation. As a convention, we use the
subscript or superscript $s$ to indicate source ({FG}) elements, and
$t$ to indicate target ({CG}) elements. Thus $e_s$ denotes a source
expression, whereas $e_t$ denotes a target expression.

The key idea of our translation is to map a source expression $e_s$
satisfying $\vdash_{\mathit{pc}} e_s: \tau$ to a monadic target expression
$e_t$ satisfying $\vdash e_t: \tslio{\mathit{pc}}{\bot}{\transFC{\tau}}$. The
$\mathit{pc}$ used to type the source expression is mapped as-is to the
pc-label of the monadic computation. The type of the source
expression, $\tau$, is translated by the function $\transFC{\cdot}$
that is described below. However---and this is the crucial bit---the
taint label on the translated monadic computation is $\bot$. To get
this $\bot$ taint we use the $\kw{toLabeled}$ construct judiciously. Not
setting the taint to $\bot$ can cause a taint explosion in translated
expressions, which would make it impossible to simulate the
fine-grained dependence tracking of {FG}.

The function $\transFC{\cdot}$ defines how the types of source values
are translated. This function is defined by induction on labeled and
unlabeled source types.

\[
  \begin{array}{lll}
      \transFC{\kw{b}} & = & \kw{b} \\

      \transFC{\kw{unit}} & = & \kw{unit}\\

      \transFC{\tau_1 \overset{\ell_e}{\to} \tau_2} & = &
                                                             \transFC{\tau_1} \to \tslio{\ell_e}{\bot}{\transFC{\tau_2}} \\

      \transFC{\tau_1 \times \tau_2} & = & \transFC{\tau_1} \times \transFC{\tau_2} \\

      \transFC{\tau_1 + \tau_2} & = & \transFC{\tau_1} + \transFC{\tau_2} \\

      \transFC{\kw{ref} ~\tau} & = & \kw{ref} ~\ell ~\transFC{\kw{A}}~~~~\mbox{ when $\tau = \kw{A}^{\ell}$}\\

      \transFC{\kw{A}^{\ell}} & = & \tlabeled{\ell}{\transFC{\kw{A}}}
  \end{array}
\]
The translation should be self-explanatory. The only nontrivial case
is the translation of the function type $\tau_1
\overset{\ell_e}{\to} \tau_2$. A source function of this type is
mapped to a target function that takes an argument of type
$\transFC{\tau_1}$ and returns a monadic computation (the translation
of the body of the source function) that has pc-label $\ell_e$ and
eventually returns a value of type $\transFC{\tau_2}$.

Given this translation of types, we next define a type
derivation-directed translation of expressions. This translation is
formalized by the judgment $\Gamma \vdash_{\mathit{pc}} e_s:\tau \leadsto
e_t$. The judgment means that translating the source expression $e_s$,
which has the typing derivation $\Gamma \vdash_{\mathit{pc}} e_s$, yields the
target expression $e_t$. This judgment is \emph{functional}: For each
type derivation $\Gamma \vdash_{\mathit{pc}} e_s: \tau$, it yields exactly one
$e_t$.  It is also easily implemented by induction on typing
derivations. The rules for the judgment are shown in
Figure~\ref{fig:fg-2-cg-expr}. The thing to keep in mind while reading
the rules is that $e_t$ should have the type
$\tslio{\mathit{pc}}{\bot}{\transFC{\tau}}$.

We illustrate how the translation works using one rule,
\rname{FC-app}. In this rule, we know inductively that the
translation of $e_1$, i.e., $e_{c1}$ has type
$\tslio{\mathit{pc}}{\bot}{\transFC{(\tau_1 \overset{\ell_e}{\to}
    \tau_2)^\ell}}$, which is equal to
$\tslio{\mathit{pc}}{\bot}{(\tlabeled{\ell}{(\transFC{\tau_1} \to
    \tslio{\ell_e}{\bot}{\transFC{\tau_2}})})}$. The translation of
$e_2$, i.e., $e_{c2}$ has type
$\tslio{\mathit{pc}}{\bot}{\transFC{\tau_1}}$. We wish to construct something
of type $\tslio{\mathit{pc}}{\bot}{\transFC{\tau_2}}$.

To do this, we bind $e_{c1}$ to the variable $a$, which has the type
$\tlabeled{\ell}{(\transFC{\tau_1} \to
  \tslio{\ell_e}{\bot}{\transFC{\tau_2}})}$. Similarly, we bind
$e_{c2}$ to the variable $b$, which has the type
$\transFC{\tau_1}$. Next, we unlabel $a$ and bind the result to
variable $c$, which has the type $\transFC{\tau_1} \to
\tslio{\ell_e}{\bot}{\transFC{\tau_2}}$. However, due to the
unlabeling, the \emph{taint label on whatever computation we sequence
  after this bind must be at least $\ell$}. Next, we apply $b$ to
$c$, which yields a value of type
$\tslio{\ell_e}{\bot}{\transFC{\tau_2}}$. Via subtyping, using the
assumption $\mathit{pc} \sqsubseteq \ell_e$, we can weaken this to
$\tslio{\mathit{pc}}{\ell}{\transFC{\tau_2}}$. This satisfies the
constraint that the taint label be at least $\ell$ and is
\emph{almost} what we need, except that we need the taint $\bot$ in
place of $\ell$.

To reduce the taint back to $\bot$, we use the \emph{defined} {CG}
function $\ensuremath{\mathtt{coerce\_taint}}$, which has the type $\tslio{\mathit{pc}}{\ell}{\tau} \to
\tslio{\mathit{pc}}{\bot}{\tau}$, when $\tau$ has the form
$\tlabeled{\ell'}{\tau'}$ with $\ell \sqsubseteq \ell'$. This
last constraint is satisfied here since we know that $\tau_2 \searrow
\ell$. The function $\ensuremath{\mathtt{coerce\_taint}}$ uses $\kw{toLabeled}$ internally and is
defined in the figure.

This pattern of using $\ensuremath{\mathtt{coerce\_taint}}$, which internally contains
$\kw{toLabeled}$, to restrict the taint to $\bot$ is used to translate
all elimination forms (application, projection, case, etc.). Overall,
our translation uses $\kw{toLabeled}$ judiciously to prevent taint from
exploding in the translated expressions.

\textit{Remark.} Readers familiar with monads may note that our
translation from {FG} to {CG} is based on the standard
interpretation of the call-by-value $\lambda$-calculus in the
computational $\lambda$-calculus~\cite{moggi91:notions}. Our
translation additionally accounts for the pc and security labels, but
is structurally the same.

\input{fg-to-cg-lr.tex}

\medskip\noindent \textbf{Properties.}  Our translation preserves
typing by construction. This is formalized in the following
theorem. The context translation $\transFC{\Gamma}$ is defined
pointwise on all types in~$\Gamma$.
\begin{thm}[Typing preservation]\label{thm:fg-2-cg-typePres}
  If $\Gamma \vdash_\mathit{pc} e_s: \tau$ in {FG}, then there is a unique
  $e_t$ such that $\Gamma \vdash_\mathit{pc} e_s: \tau \leadsto e_t$ and that
  $e_t$ satisfies $\transFC{\Gamma} \vdash e_t:
  \tslio{\mathit{pc}}{\bot}{\transFC{\tau}}$ in {CG}.
\end{thm}
An immediate corollary of this theorem is that well-typed source
programs translate to noninterfering target programs (since target
typing implies noninterference in the target).

Next, we show that our translation preserves the meaning of programs,
i.e., it is semantically ``correct''. For this, we define a
\emph{cross-language} logical relation, which relates source values
(expressions) to target values (expressions) at each source type. This
relation has three key properties: (A) A source expression and its
translation are always in the relation
(Theorem~\ref{thm:fg2cg-FundThm}), (B) Related expressions reduce to
related values, and (C) At base types, the relation is the
identity. Together, these imply that our translation preserves the
meanings of programs in the sense that a function from base types to
base types maps to a target function with the same extension.

An excerpt of the relation is shown in
Figure~\ref{fig:crossLangfg2cg}. The relation is defined over source
({FG}) types, and is divided (like our earlier relations) into a
value relation$\fcUlrvn{\cdot}$, an expression relation
$\fcUlren{\cdot}$, and a heap relation $(n, \mathit{H}_s, \mathit{H}_t)
\wDefined{\hat{\beta}} {^s}\theta$, which we omit here. The relations specify
when a source value (resp.\ expression, heap) is related to a target
value (resp.\ expression, heap) at a source unary world ${^s}\theta$, a
step index $n$ and a partial bijection $\hat{\beta}$ that relates source
locations to corresponding target locations. The relation actually
mirrors the unary logical relation for {FG}. The definition of the
expression relation forces property (B) above, while the value
relation at base types forces property (C).

Our main result is again a fundamental theorem, shown below. The
symbols $\delta^s$ and $\delta^t$ denote unary substitutions in the
source and target, respectively. The relation $\fcUlrvn {\Gamma }$ is
the obvious one, obtained by pointwise lifting of the value relation;
its definition is in the appendix.

\begin{thm}[Fundamental theorem]\label{thm:fg2cg-FundThm}
If
  $\Gamma \vdash_{\mathit{pc}} e_s:\tau \leadsto e_t$
and
  $({^s}\theta, n, \delta^s, \delta^t) \in \fcUlrvn  {\Gamma }$,
then
  $({^s}\theta, n, e_s ~ \delta^s, e_t ~ \delta^t) \in \fclreun {\tau } {\hat{\beta}}$.
\end{thm}

The proof of this theorem is by induction on the derivation of $\Gamma
\vdash_{\mathit{pc}} e_s:\tau \leadsto e_t$. This theorem has two important
consequences. First, it immediately implies property (A) above and,
hence, completes the argument that our translation is semantically
correct. Second, the theorem, along with the binary fundamental
theorem for {CG}, allows us to re-derive the noninterference theorem
for {FG} (Theorem~\ref{thm:ni-fg}) directly. This re-derivation is
important because it provides confidence that our translation
preserves the meaning of security labels. As a simple counterexample,
it is perfectly possible to translate {FG} programs to {CG}
programs, preserving both typing and semantics, by mapping all source
labels to the same target label (say, $\bot$). However, we would not
be able to re-derive the source noninterference theorem using the
target's properties if this were the case.

\section{Introduction}
\label{sec:intro}

Information flow control (IFC) is the problem of tracking flows of
information within a computer system and controlling or prohibiting
flows that contravene the policy in effect. In a language-based
setting, IFC requires tracking \emph{dependencies} between a program's
inputs, intermediate values and outputs. This can be done dynamically
with runtime monitoring~\cite{plas09-austinFlanagan,
  plas10-austinFlanagan} or statically using some form of abstraction
interpretation such as a type system. Our focus in this paper is the
second of these methods---IFC enforced through type systems.
In fact, literature has proposed several type systems for IFC, e.g.,
\cite{toplas03-flowcaml,jcs96-volpanoSmith,tosem00-jif,aplas13-paragon,popl98-SLAM,DBLP:journals/jcs/MatosB09,DBLP:conf/Boudol08,icfp15-HLIO,popl99-DCC}. All
these type systems have one aspect in common: \update{They all
  introduce \emph{security labels} or \emph{levels}, elements of a
  security lattice, that abstract program values. These labels are
  used to track dependencies between program values.}

\update{A significant design consideration for an IFC type system is
  the granularity (or extent) of the label abstraction, and the effect
  of this granularity on the expressiveness of the type system. By
  expressiveness here we mean the ability of a type system to type as
  many semantically secure programs as possible.\footnote{No sound
    type system can type all semantically secure programs, since
    freedom from bad flows (specifically, the standard information
    flow security property called noninterference~\cite{goguen82:ni})
    is undecidable.}  More specifically, we call a type system $T$
  more expressive than a type system $T'$ if there is a compositional,
  semantics-preserving transformation of programs typed under $T'$ to
  programs typed under $T$.\footnote{This notion of expressiveness is
    closely related to what Felleisen calls macro
    expressibility~\cite{DBLP:journals/scp/Felleisen91}.}}

\update{
The question of granularity has at least two aspects.
First, one may vary the granularity of the \emph{labels}
themselves. For example, a fine-grained label on a value may precisely
specify the program variables or inputs that the value depends on. On
the other hand, a coarse-grained label may specify only an upper-bound
on the confidentiality level (e.g., ``secret'', ``top-secret'', etc.)
of all inputs on which the labeled value depends. The effect of
varying this notion of granularity (of the labels) on the
expressiveness of the type system has been studied in prior
work~\cite{DBLP:conf/popl/HuntS06}.}

\update{A different kind of granularity, whose expressiveness is the
  focus of this paper, is the granularity of \emph{labeling} (not
  \emph{labels}).%
  %
  \footnote{In the rest of the paper, granularity refers to the
    granularity of labeling, not the granularity of labels.}
  %
  Here,} a \emph{fine-grained type
  system} is one that labels every program value individually. For
instance, Flow Caml, a type system for IFC on
ML~\cite{toplas03-flowcaml}, adds a label on every type constructor
and, hence, on every value, top-level and nested. As an example, the
type $(A^H \times B^L)^L$ might ascribe low (public) pairs, whose
first projection is high (private) and whose second projection is
low. ($H$ and $L$ are standard labels for high and low confidentiality
data, respectively.) Since fine-grained type systems label individual
values, they also track dependencies at the granularity of individual
values. For example, combining a high value with a low value using a
primitive operator in the language results in a high value. Many other
type systems are similarly
fine-grained~\cite{jcs96-volpanoSmith,tosem00-jif,aplas13-paragon,popl98-SLAM}.

In contrast, a \emph{coarse-grained type system} labels an entire
sub-computation using a single label. All values produced within the
scope of the sub-computation implicitly have that label. Hence, it not
necessary to label individual values.
As an example, the SLIO and HLIO systems~\cite{icfp15-HLIO} introduce
a monad for heap I/O (similar to Haskell's IO monad), but refine the
monadic type to include two labels, $\ell_i$ and $\ell_o$, as in
$(SLIO~\ell_i~\ell_o~\tau)$. This type represents stateful
computations of type $\tau$ that start from the confidentiality label
$\ell_i$ and end with the confidentiality label
$\ell_o$. $\ell_i$ is an upper-bound on the confidentiality of
all prior computations that the current computation depends on;
accordingly, the current computation can have write effects at levels
above $\ell_i$ only. $\ell_o$ is an upper-bound on the
confidentiality of the current computation; accordingly, the current
computation can have read effects only at levels below
$\ell_o$. Importantly, there is no need to label individual values
or nested types. Instead, every value produced by the current
computation implicitly inherits the label $\ell_o$, and labels are
tracked via monadic sequencing (bind) at the granularity of
computations. Other type
systems~\cite{DBLP:journals/jcs/MatosB09,DBLP:conf/Boudol08,popl99-DCC}
are also coarse-grained,
although~\cite{DBLP:journals/jcs/MatosB09,DBLP:conf/Boudol08} do not
use monads to confine effects.

Given these vastly contrasting labeling granularities for the same
end-goal---information flow control, a natural question is one of
their relative expressiveness~\cite{siglog17-ifcComp}.
In general, it seems that fine-grained type systems should be at least
as expressive as coarse-grained type systems, since the former track
flows at finer granularity \update{(individual values as opposed to
  entire sub-computations)} and, hence, should abstract flows less
than the latter. In the other direction, the situation is less
clear. Upfront, it seems that coarse-grained type systems \emph{may}
be less expressive than fine-grained type systems, but then one
wonders whether by structuring programs as extremely small
computations in a coarse-grained type system, one may recover the
expressiveness of a fine-grained type system.

In this paper, we show constructively that both these intuitions are,
in fact, correct. We do this using specific instances of the two kinds
of type systems in the setting of a higher-order language with state
(similar to ML). For the fine-grained type system we use a system very
close to SLam~\cite{popl98-SLAM} and the exception-free fragment of
Flow Caml~\cite{toplas03-flowcaml}. For the coarse-grained type system
we use a variant of the static fragment of
HLIO~\cite{icfp15-HLIO}. This calculus has a specific construct to
limit the scope of a computation's label in a safe way. We then show
that well-typed programs in each type system can be translated to the
other, preserving typability and meaning. This establishes that the
type systems are equally expressive.

We believe this settles an open question about the relative
expressiveness of setting up IFC type systems \update{with different
  labeling granularities}. Our result also has an immediate practical
consequence: Since coarse-grained IFC type systems usually burden a
programmer less with annotations (since not every value has to be
labeled) and we have shown now that they are as expressive as
fine-grained IFC type systems, there seems to be some merit to
preferring coarse-grained IFC type systems over fine-grained ones in
general.

As a second contribution of independent interest, we show how to set
up semantic, logical relations models of IFC types in both the
fine-grained and the coarse-grained settings, over calculi with
higher-order state. While models of IFC types have been considered
before~\cite{popl98-SLAM,popl99-DCC,esop99-PER-IFC,DBLP:conf/csfw/MantelSS11},
we do not know of any development that covers higher-order state.  In
fact, models of types in the presence of higher-order state are
notoriously difficult. Here, we have the added complication of
information flow labels. Fortunately, enough development has occurred
in the programming languages community in the past decade to give us a
good starting point. Specifically, our models are based on
step-indexed Kripke logical
relations~\cite{DBLP:conf/popl/AhmedDR09}. Like earlier work, our
models are relational, i.e., they relate two runs of a program to each
other. This is essential since we are interested in proving
noninterference~\cite{goguen82:ni}, the standard security property
which says that public outputs of a program are not influenced by
private inputs (i.e., there are no bad flows). This property is
naturally defined using two runs. Using our models, we derive proofs
of the soundness of both the fine-grained and the coarse-grained type
systems.

We also use our logical relations to show that our translations are
meaningful. Specifically, we set up \emph{cross-language logical
  relations} to prove that our translations preserve program
semantics, and from this, we derive a crucial result for each
translation: Using the noninterference theorem of the target language
as a lemma, we are able to re-prove the noninterference theorem for
the source language directly. These results imply that our
translations preserve label annotations
meaningfully~\cite{DBLP:journals/cl/BartheRB07}. Like all logical
relations models, we expect that our models can be used for other
purposes as well.

To summarize, the two contributions of this work are:
\begin{itemize}
\item Typability- and meaning-preserving translations between a
  fine-grained and a coarse-grained IFC type system, showing that
  these type systems are equally expressive.
\item Logical relations models of both type systems, covering both
  higher-order functions and higher-order state.
\end{itemize}

Due to lack of space, many technical details and proofs are omitted
from this paper. These are provided in an appendix available online
from the authors' homepages.

\medskip
\noindent \textbf{Note.} Readers interested only in our translations
but not the details of our semantic models can skip sections
pertaining to the latter (e.g., Section~\ref{sec:fg-sem}). This will
not affect the readability of the rest of the paper.

\if 0
Information Flow Control (IFC) is a form of dependence analysis which aims at prohibiting secret
(high) inputs to flow into public (low) outputs of the program. The secrets can flow into public
outputs either directly via explicit assignments, file outputs, etc. or they can flow indirectly via
the choice of conditional branches and various subtle side channels. A sound IFC analysis must
prohibit leaks via all channels that can be observed by an attacker. Such analysis can be performed,
for instance, either dynamically ~\cite{plas09-austinFlanagan, plas10-austinFlanagan} by monitoring
the program's execution or statically~\cite{toplas03-flowcaml,popl98-SLAM} by analyzing its source
code. The soundness (no covert flows have been missed) of such dependence analysis is often stated
as a variant of a well-known criterion called \textit{non-interference}, which basically states that a secure program must
always produce public outputs which remain unaffected by the choice of its secret inputs.

Irrespective of the stage at which IFC is performed (statically or dynamically), IFC analysis (in
general) requires a) association of secrecy label (like confidential, top secret, public) with the
sources (inputs) and sinks (outputs) of the program and b) tracking these labels through the
program's execution to make sure that the public outputs remain independent of the secret
inputs. While labeling of sources and sinks (requirement a) remains invariant across the different
kinds of IFC analysis, tracking of these labels (requirement b) can vary based on the level of
granularity of dependencies being tracked. A fine-grained approach tracks label on every individual
value of the program while a coarse-grained approach tracks label on the entire process (or
context). This leads to a trade-off between the two. On one hand, coarse-grained approaches are
observed to be much easier (as also more efficient) to implement than fine-grained approaches
because the complexity (and the overhead) of tracking just the context label is far less than the
complexity (and overhead) of tracking labels on all individual values. But on the other hand,
coarse-grained approaches often suffer from an \textit{over-tainting} (also referred to as the
\textit{label creep}) problem -- an unnecessarily high context label which leads to rejection of
several benign programs, while the fine-grained approaches don't. Consequently, it is believed that
fine-grained approaches are more expressive (accept more secure programs) than coarse-grained
approaches. For example, a program that reads a secret file but always outputs a fixed constant will
be rejected by a coarse-grained approach (despite being completely secure). But such a benign
program will be accepted by a fine-grained approach because the constant will be given a public
label and thus sending it on a public output is, rightfully, not considered a leak. This trade-off
has lead to an interest in the development of separate enforcement methods (both static and dynamic)
based on fine-grained and coarse-grained tracking. In this paper, we will only focus on the static
methods (type systems in particular) for both granularities of tracking.

IFC using fine-grained tracking was historically envisioned and incorporated by Denning into a form
of static analysis for program certification~\cite{purdue75-denning}. Volpano, Irvine and Smith's
type system~\cite{jcs96-volpanoSmith} was the first satisfactory embodiment of Denning's analysis
into a type system for a while language. Later Pottier and Simonet extended this approach to a type
system~\cite{toplas03-flowcaml} for a higher-order, ML like, language.
Various other type systems for fine-grained IFC (like JIF~\cite{tosem00-jif},
Paragon~\cite{aplas13-paragon}) have been studied in the past, we refer
to~\cite{jsac06-surveySabelfeld} for a comprehensive review. Despite the versatility in the
landscape of fine-grained IFC type systems, a common denominator amongst all of them is the presence
of security labels on \textit{all} types (unlike coarse-grained type systems which only add labels
to some of the types, and use the context label to infer the rest). A label on a type represents an
upper-bound on the confidentiality of the secrets that have influenced the computation of an
expression of this type. The type rules of the language track and use these labels to control the
flow of information through the program, making sure that no secret information flows to public
outputs. These type systems also use a concept of the context label (like coarse-grained type
systems) but are often more precise in dealing with false leaks, mainly because context label
doesn't have to be an implicit label on all the values computed in that context (thanks to
fine-grained labeling).

IFC using coarse-grained tracking, on the other hand, was historically used mainly at the operating
system level~\cite{sosp05-asbestosOS,osdi06-histarOS,sosp07-flumeOS}. However, of-late we are seeing
language-based methods also making use of coarse-grained tracking. For instance, IFC using a labeled
IO (LIO for short) monad~\cite{haskell11-LIO,icfp15-HLIO} has been used in the context of Haskell
programming language to enforce IFC using the coarse-grained approach. A purely dynamic
enforcement~\cite{haskell11-LIO} of this concept uses the IO monad for handling input and output
effects (as usual) but additionally it also tracks the context label (referred to as the current
label) to prevent information leaks via such effects. And a hybrid (static + dynamic)
enforcement~\cite{icfp15-HLIO} of this concept uses monadic types to achieve the same statically
whenever possible and falls back to the dynamic version~\cite{haskell11-LIO} otherwise. The context
label of an LIO computation (doesn't matter how it is tracked - dynamically or statically) is an
upper-bound on the level of secrets it has read and the monadic $\kw{bind}$ makes sure that the
continuation is always executed with a context label that is at least equally high. Along with that,
LIO has a construct ($\elabel {\ell}$) to add discretionary labels (labels are not always
required to be added by the user, a term inherits the label from its context) to terms, and a dual
construct ($\kw{unlabel}$) to remove label from such labeled terms, by pushing it into the context
(this is in sync with the coarse-grained tracking philosophy -- reading a secret should make the
context secret too). All these constructs described so far implements the kind of coarse-grained
tracking which suffers from an \textit{over-tainting} problem. However, LIO also has a scoping
construct ($\kw{toLabeled}$) which can be used to execute a computation without raising its context
label, by instead pushing that extra label into the value returned by the computation, and thus can
potentially avoid the \textit{label creep}. For example, without the use of $\kw{toLabeled}$, a
computation that adds two labeled values would raise the context label by the label on the
individual values being added (as the computation has to unlabel them before the addition can be
performed). But with the use of $\kw{toLabeled}$, we would get the same context label before and after
the computation, and the returned result would get the extra label (the join of the individual
labels on the values being added) instead.

This modern view of coarse-grained tracking with the $\kw{toLabeled}$ construct raises a question about
the relative expressiveness of the two type systems -- does the addition of $\kw{toLabeled}$ reconcile
the differences in expressivity of the two granularities ? In other words, can this modern view of
coarse-grained tracking scale up to the expressiveness of the fine-grained tracking with diligent
use of $\kw{toLabeled}$ ? This question has been investigated partially in~\cite{siglog17-ifcComp} by
studying the relative expressiveness of {FG} (a variant of FlowCaml~\cite{toplas03-flowcaml}, as a
representative of fine-grained IFC enforcement) and {CG} (a static variant of
HLIO~\cite{icfp15-HLIO}, as a representative of coarse-grained IFC enforcement). It was shown that
the whole of {CG} can be embedded into {FG} but only a subset of {FG} (referred to as {$\mbox{\fg}^-$}) can
be embedded in {CG}. This was shown by presenting type-preserving translations from one to the
other. The embedding from {$\mbox{\fg}^-$} to {CG} makes clever use of label polymorphism and constraint
types to achieve type-preservation. And it leaves a translation from the whole of {FG} to {CG} as
an open problem. We believe that~\cite{siglog17-ifcComp} is an important step towards relating the
expressiveness of {FG} and {CG} but has the following gaps a) the non-standard addition of label
polymorphism and constraint types to both FlowCaml~\cite{toplas03-flowcaml} and
HLIO~\cite{icfp15-HLIO} raises concerns about the semantic foundations of the two type systems
especially when the proof theories of both FlowCaml~\cite{toplas03-flowcaml} and
HLIO~\cite{icfp15-HLIO} (on which {FG} and {CG} type systems are based) haven't been proven sound
and b) type-preservation should be seen as a necessary but not a sufficient step when it comes to
embedding {FG} to {CG} and vice versa. We must also show that the embeddings (which ever exist)
preserve semantics and security of the source program.

In this paper we extend the efforts of \cite{siglog17-ifcComp} by coming up with a type-preserving
translation from the whole of {FG} to {CG}. We fill the gaps highlighted in the previous paragraph
by a) giving semantic models to both the type systems (for {FG} and {CG}). Our models use a
standard technique of Kripke step-indexed logical relations~\cite{esop06-SILR}, and are based on
basic set-theory and higher-order logic. We use these models to give foundational
proofs~\cite{popl00-semanticModelPCC} of {\textit{non-interference}} for both {FG} and {CG}; and b) by building
cross-language models (again based on Kripke step-indexed logical relations) for both the
translations ({CG} to {FG} and {FG} to {CG}) to show the semantics and security preservation of
the source.

\noindent{\textbf{Outline:}}

In Section~\ref{sec:ts} we begin by describing the type systems we work with (both {FG} and
{CG}). Before jumping to the translation, we first prove the soundness of the proof-theory for both
{FG} and {CG} in Section~\ref{sec:sm-fg-cg}. In Section~\ref{sec:trans} we first quickly recap the
translation from {$\mbox{\fg}^-$} to {CG} from \cite{siglog17-ifcComp} which uses label polymorphism and
constraint types, then we describe a translation from {FG} to {$\mbox{\fg}^-$} as a proof of the existence of
the translation from the whole of {FG} to {CG}. This turns out to very insightful and the insights
learned from {FG} to {$\mbox{\fg}^-$} help us in obtaining a direct translation from the whole of {FG} to
{CG}. We describe the soundness of this translation by showing semantics and security preservation
of the source. In Section~\ref{sec:related} we describe some related work. And finally in
Section~\ref{sec:conclusion} we conclude and describe some future directions.
\fi

\section{Related work}
\label{sec:related}

We focus on related work directly connected to our
contributions---logical relations for IFC type systems and language
translations that care about IFC.

\medskip \noindent \textbf{Logical relations for IFC type systems.}
Logical relations for IFC type systems have been studied before to a
limited extent. Sabelfeld and Sands develop a general theory of models
of information flow types based on partial-equivalence relations
(PERs), the mathematical foundation of logical
relations~\cite{esop99-PER-IFC}. However, they do not use these models
for proving any specific type system or translation sound. The pure
fragment of the SLam calculus was proven sound (in the sense of
noninterference) using a logical relations argument~\cite[Appendix
  A]{popl98-SLAM}. However, to the best of our knowledge, the relation
and the proof were not extended to mutable state. The proof of
noninterference for Flow Caml~\cite{toplas03-flowcaml}, which is very
close to SLam, considers higher-order state (and exceptions), but the
proof is syntactic, not based on logical relations. The dependency
core calculus (DCC)~\cite{popl99-DCC} also has a logical relations
model but, again, the calculus is pure. The DCC paper also includes a
state-passing embedding from the IFC type system of Volpano, Irvine
and Smith~\cite{jcs96-volpanoSmith}, but the state is
first-order. \update{Mantel \emph{et al.} use a security criterion
  based on an indistinguishability relation that is a PER to prove the
  soundness of a flow-sensitive type system for a concurrent
  language~\cite{DBLP:conf/csfw/MantelSS11}.  Their proof is also
  semantic, but the language is first-order.} In contrast to these
prior pieces of work, our logical relations handle higher-order state,
and this complicates the models substantially; we believe we are the
first to do so in the context of IFC.

Our models are based on the now-standard step-indexed Kripke logical
relations~\cite{DBLP:conf/popl/AhmedDR09}, which have been used
extensively for showing the soundness of program verification
logics. Our model for {FG} is directly inspired by Cicek \emph{et
  al.}'s model for a pure calculus of incremental
programs~\cite{DBLP:conf/icfp/CicekP016}. That calculus does not
include state, but the model is structurally very similar to our model
of {FG} in that it also uses a unary and a binary relation that
interact at labeled types. Extending that model with state was a
significant amount of work, since we had to introduce Kripke
worlds. Our model for {CG} has no direct predecessor; we developed it
using ideas from our model of {FG}. (DCC is also coarse-grained and
uses a labeled monad to track dependencies, but its model is quite
different from ours in the treatment of the monadic type.)

\medskip \noindent \textbf{Language translations that care about IFC.}
Language translations that preserve information flow properties appear
in the DCC paper. The translations start from SLam's pure fragment and
the type system of Volpano, Irvine and Smith and go into DCC. The
paper also shows how to recover the noninterference theorem of the
source of a translation from properties of the target, a theorem we
also prove for our translations.
Barthe \emph{et al.}~\cite{DBLP:journals/cl/BartheRB07} describe a
compilation from a high-level imperative language to a low-level
assembly-like language. They show that their compilation is type and
semantics preserving. They also derive noninterference for the source
from the noninterference of the target.
Fournet and
Rezk~\cite{popl08-cryptoIFC} describe a compilation from an IFC-typed
language to a low-level language where confidentiality and integrity
are enforced using cryptography. They prove that well-typed source
programs compile to noninterfering target programs, where the target
noninterference is defined in a computational sense.
Algehed and Russo~\cite{plas17-DCCinHaskell} define an embedding of
DCC into Haskell. They also consider an extension of DCC with state
but, to the best of our knowledge, they do not prove any formal
properties of the translation.

\section{Translations}
\label{sec:trans}

In this section, we describe our translations from {FG} to {CG} and
vice-versa, thus showing that these two type systems are equally
expressive. We start with the translation from {FG} to {CG}.

\input{fg-to-cg}

\input{cg-to-fg}

\section{The Two Type Systems}
\label{sec:ts}

In this section, we describe the fine-grained and coarse-grained type
systems we work with. Both type systems are set up for higher-order
stateful languages, but differ considerably in how they enforce
IFC. The fine-grained type system, called {FG}, works on a language
with pervasive side-effects like ML, and associates a security label
with every expression in the language. The coarse-grained type system,
{CG}, works on a language that isolates state in a monad (like
Haskell's IO monad) and tracks flows coarsely at the granularity of a
monadic computation, not on pure values within a monadic computation.

Both {FG} and {CG} use security labels (denoted by $\ell$) drawn
from an arbitrary security lattice ($\mathcal{L}, \sqsubseteq$). We denote
the least and top element of the lattice by $\bot$ and $\top$
respectively. As usual, the goal of the type systems is to ensure that
outputs labeled $\ell$ depend only on inputs with security labels
$\ell$ or lower. \update{For drawing intuitions, we find it
  convenient to think of a confidentiality lattice (labels higher in
  the lattice represent higher confidentiality). However, nothing in
  our technical development is specific to a confidentiality
  lattice---the development works for any security lattice including
  an integrity lattice and a product lattice for confidentiality and
  integrity.}

\input{fg}

\input{cg}

redpajama_set_name: RedPajamaArXiv