A proof of secrecy for a network security model

The network security model originally developed for the SNet secure system is generally applicable to all secure networks. Although it was recognized that allowing message loss in the model permits a covert channel, this operational model was accepted on an intuitive basis as enforcing some concept of secrecy. The paper presents a formal argument that the model, augmented with a no-loss requirement, does indeed satisfy a formal abstract secrecy policy. This secrecy policy, called INF, has previously been defined in terms of security logic. The proof contains two steps. First, the network model augmented with a no-loss requirement (and called NM) is shown to satisfy the non-deducibility (ND) condition. ND satisfies INF, therefore, NM satisfies INF