A Semantic Hierarchy for Erasure Policies

We consider the problem of logical data erasure, contrasting with physical erasure in the same way that end-to-end information flow control contrasts with access control. We present a semantic hierarchy for erasure policies, using a possibilistic knowledge-based semantics to define policy satisfaction such that there is an intuitively clear upper bound on what information an erasure policy permits to be retained. Our hierarchy allows a rich class of erasure policies to be expressed, taking account of the power of the attacker, how much information may be retained, and under what conditions it may be retained. While our main aim is to specify erasure policies, the semantic framework allows quite general information-flow policies to be formulated for a variety of semantic notions of secrecy.Comment: 18 pages, ICISS 201

Completeness of string analysis for dynamic languages

In Abstract Interpretation, completeness ensures that the analysis does not lose information with respect to the property of interest. In particular, for dynamic languages like JavaScript, completeness of string analysis is a key security issue, as poorly managed string manipulation code may easily lead to significant security flaws. In this paper, we provide a systematic and constructive approach for generating the completion of string domains for dynamic languages, and we apply it to the refinement of existing string abstractions. We also provide an effective procedure to measure the precision improvement obtained when lifting the analysis to complete domains

Modeling Declassification Policies using Abstract Domain Completeness

This paper explores a three dimensional characterisation of a declassification-basednon-interference policy and its consequences. Two of the dimensions consist of specifying:(a) the power of the attacker, that is, what public information a program has that anattacker can observe; and(b) what secret information a program has that needs to be protected.Both these dimensions are regulated by the third dimension:(c) the choice of program semantics, for example, trace semantics or denotationalsemantics, or any semantics in Cousot\u2019s semantics hierarchy.To check whether a program satisfies a non-interference policy, one can compute an abstractdomain that over-approximates the information released by the policy and then checkwhether program execution can release more information than permitted by the policy.Counterexamples to a policy can be generated by using a variant of the Paige\u2013Tarjanalgorithm for partition refinement. Given the counterexamples, the policy can be refined sothat the least amount of confidential information required for making the program secure isdeclassified

Monoclonal Antibodies of a Diverse Isotype Induced by an O-Antigen Glycoconjugate Vaccine Mediate In Vitro and In Vivo Killing of African Invasive Nontyphoidal Salmonella.

Nontyphoidal Salmonella (NTS), particularly Salmonella enterica serovars Typhimurium and Enteritidis, is responsible for a major global burden of invasive disease with high associated case-fatality rates. We recently reported the development of a candidate O-antigen-CRM197 glycoconjugate vaccine against S. Typhimurium. Here, using a panel of mouse monoclonal antibodies generated by the vaccine, we examined the relative efficiency of different antibody isotypes specific for the O:4 antigen of S. Typhimurium to effect in vitro and in vivo killing of the invasive African S. Typhimurium strain D23580. All O:4-specific antibody isotypes could mediate cell-free killing and phagocytosis of S. Typhimurium by mouse blood cells. Opsonization of Salmonella with O:4-specific IgA, IgG1, IgG2a, and IgG2b, but not IgM, resulted in cell-dependent bacterial killing. At high concentrations, O:4-specific antibodies inhibited both cell-free complement-mediated and cell-dependent opsonophagocytic killing of S. Typhimurium in vitro. Using passive immunization in mice, the O:4-specific antibodies provided in vivo functional activity by decreasing the bacterial load in the blood and tissues, with IgG2a and IgG2b being the most effective isotypes. In conclusion, an O-antigen-CRM197 glycoconjugate vaccine can induce O-antigen-specific antibodies of different isotypes that exert in vitro and in vivo killing of S. Typhimurium.This work was supported by a European Union FP7 Industry and Academia Partnerships and Pathways award, GENDRIVAX (Genome-driven vaccine development for bacterial infections). This is a collaboration between the Novartis Vaccines Institute for Global Health, Wellcome Trust Sanger Institute, Swiss Tropical and Public Health Institute and Kenyan Medical Research Institute [grant number 251522]. CAM is the recipient of a Clinical Research Fellowship from GlaxoSmithKline.This is the final version of the article. It first appeared from the American Society for Microbiology via http://dx.doi.org/10.1128/IAI.00547-1

The effects of vaccination and immunity on bacterial infection dynamics in vivo.

Salmonella enterica infections are a significant global health issue, and development of vaccines against these bacteria requires an improved understanding of how vaccination affects the growth and spread of the bacteria within the host. We have combined in vivo tracking of molecularly tagged bacterial subpopulations with mathematical modelling to gain a novel insight into how different classes of vaccines and branches of the immune response protect against secondary Salmonella enterica infections of the mouse. We have found that a live Salmonella vaccine significantly reduced bacteraemia during a secondary challenge and restrained inter-organ spread of the bacteria in the systemic organs. Further, fitting mechanistic models to the data indicated that live vaccine immunisation enhanced both the bacterial killing in the very early stages of the infection and bacteriostatic control over the first day post-challenge. T-cell immunity induced by this vaccine is not necessary for the enhanced bacteriostasis but is required for subsequent bactericidal clearance of Salmonella in the blood and tissues. Conversely, a non-living vaccine while able to enhance initial blood clearance and killing of virulent secondary challenge bacteria, was unable to alter the subsequent bacterial growth rate in the systemic organs, did not prevent the resurgence of extensive bacteraemia and failed to control the spread of the bacteria in the body.This work was supported by the Biotechnology and Biological Sciences Research Council [grant number BB/I002189/1].This is the published manuscript. It was originally published by PLOS One here: http://www.plospathogens.org/article/info%3Adoi%2F10.1371%2Fjournal.ppat.1004359

Verifying Bounded Subset-Closed Hyperproperties

Hyperproperties are quickly becoming very popular in the context of systems security, due to their expressive power. They differ from classic trace properties since they are represented by sets of sets of executions instead of sets of executions. This allows us, for instance, to capture information flow security specifications, which cannot be expressed as trace properties, namely as predicates over single executions. In this work, we reason about how it is possible to move standard abstract interpretation-based static analysis methods, designed for trace properties, towards the verification of hyperproperties. In particular, we focus on the verification of bounded subset-closed hyperproperties which are easier to verify than generic hyperproperties. It turns out that a lot of interesting specifications (e.g., Non-Interference) lie in this category

Modifying bacterial flagellin to evade Nod-like Receptor CARD 4 recognition enhances protective immunity against Salmonella.

Pattern recognition receptors (PRRs) expressed in antigen-presenting cells are thought to shape pathogen-specific immunity by inducing secretion of costimulatory cytokines during T-cell activation, yet data to support this notion in vivo are scarce. Here, we show that the cytosolic PRR Nod-like Receptor CARD 4 (NLRC4) suppresses, rather than facilitates, effector and memory CD4+ T-cell responses against Salmonella in mice. NLRC4 negatively regulates immunological memory by preventing delayed activation of the cytosolic PRR NLR pyrin domain 3 (NLRP3) that would otherwise amplify the production of cytokines important for the generation of Th1 immunity such as intereukin-18. Consistent with a role for NLRC4 in memory immunity, primary challenge with Salmonella expressing flagellin modified to largely evade NLRC4 recognition notably increases protection against lethal rechallenge. This finding suggests flagellin modification to reduce NLRC4 activation enhances protective immunity, which could have important implications for vaccine development against flagellated microbial pathogens.Wellcome Trus

Salmonella Paratyphi A Outer Membrane Vesicles Displaying Vi Polysaccharide as a Multivalent Vaccine against Enteric Fever.

Typhoid and paratyphoid fevers have a high incidence worldwide and coexist in many geographical areas, especially in low-middle-income countries (LMIC) in South and Southeast Asia. There is extensive consensus on the urgent need for better and affordable vaccines against systemic Salmonella infections. Generalized modules for membrane antigens (GMMA), outer membrane exosomes shed by Salmonella bacteria genetically manipulated to increase blebbing, resemble the bacterial surface where protective antigens are displayed in their native environment. Here, we engineered S Paratyphi A using the pDC5-viaB plasmid to generate GMMA displaying the heterologous S Typhi Vi antigen together with the homologous O:2 O antigen. The presence of both Vi and O:2 was confirmed by flow cytometry on bacterial cells, and their amount was quantified on the resulting vesicles through a panel of analytical methods. When tested in mice, such GMMA induced a strong antibody response against both Vi and O:2, and these antibodies were functional in a serum bactericidal assay. Our approach yielded a bivalent vaccine candidate able to induce immune responses against different Salmonella serovars, which could benefit LMIC residents and travelers.BactiVac catalyst Grant in collaboration with GSK