PSNI: Persistent Stochastic Non-Interference in PEPA

• PSNI is a confidentiality property defined for stochastic systems in PEPA, ensuring high-level actions do not influence low-level steady-state probabilities.
• It employs lumpability-based bisimulation to guarantee that the CTMC’s steady-state distribution remains invariant despite high-level interactions.
• PSNI is persistent and compositional, requiring every reachable state to satisfy non-interference, which enhances prevention of covert information leaks.

Persistent Stochastic Non-Interference (PSNI) is an information-flow security property for stochastic, cooperating processes expressed in the Performance Evaluation Process Algebra (PEPA). It formalizes the requirement that a high/confidential level must not influence what a low/public observer can infer from the stochastic behavior of a system, not only at the initial state but at every reachable state. In the PEPA setting, the relevant indistinguishability notion is based on lumpability of the induced continuous-time Markov chain (CTMC), so the intended consequence is that, for a secure process, the steady state probability of observing the system in a specific low-observable state is independent from its possible high level interactions (Hillston et al., 2018).

1. Security setting and observational objective

PSNI is formulated for stochastic cooperating systems written in PEPA, with the explicit goal of preventing information leaking from a high/confidential level to a low/public level. The motivating point is that classical access control is not enough: covert channels and malicious “Trojan Horse” behavior may still leak secrets. The security interpretation is therefore behavioral rather than merely authorization-based. A low-level observer should not be able to distinguish the system’s behavior in isolation from its behavior when cooperating with any high-level environment; in the stochastic setting, this indistinguishability is not about traces alone, but about the steady-state probabilities of the induced Markov chain (Hillston et al., 2018).

The visible actions $\mathcal A \setminus \{\tau\}$ are partitioned into $\mathcal H$ and $\mathcal L$, where $\mathcal H$ contains high-level actions and $\mathcal L$ contains low-level actions. A high-level PEPA component $H$ is one such that every derivative only enables high actions: $$\forall H' \in ds(H),\quad \mathcal A(H') \subseteq \mathcal H.$$ This makes $H$ an abstract model of an arbitrary malicious or secret-bearing high-level environment.

The central design objective is to obtain a security notion for PEPA components that is behavioral, stochastic, compositional, and persistent. The persistence clause is decisive: a process may appear secure initially yet reach a derivative in which high activity changes low-observable stochastic behavior. PSNI is designed to exclude exactly that situation.

2. PEPA background and stochastic semantics

The underlying formalism is the standard PEPA grammar

$\begin{array}{cclccl} P & ::= & P \sync{L} P \mid P/L \mid S\qquad S & ::= & (\alpha, r).S \mid S+S \mid A \end{array}$

where $P$ is a model component, $\mathcal H$0 is a sequential component, $\mathcal H$1 is an activity with action type $\mathcal H$2 and rate $\mathcal H$3, $\mathcal H$4 is choice, $\mathcal H$5 is cooperation on action set $\mathcal H$6, $\mathcal H$7 is hiding, and $\mathcal H$8 is a constant with a defining equation $\mathcal H$9. The set of action types is countable and includes a distinguished internal action $\mathcal L$0. Rates are positive reals or the passive symbol $\mathcal L$1 (Hillston et al., 2018).

The structural operational semantics supplies the labeled transition system from which the stochastic model is extracted. Representative rules are: $\mathcal L$2

$\mathcal L$3

$\mathcal L$4

and, for synchronization on $\mathcal L$5,

$\mathcal L$6

with

$\mathcal L$7

A finite PEPA model induces a CTMC whose derivative set is $\mathcal L$8 and whose infinitesimal generator is $\mathcal L$9. The steady-state distribution $\mathcal H$0 is given by

$\mathcal H$1

Transition rates are written $\mathcal H$2, and the conditional transition rate via action type $\mathcal H$3 is $\mathcal H$4. For a set $\mathcal H$5,

$\mathcal H$6

PSNI depends on this stochastic semantics rather than on a purely qualitative reduction semantics.

3. Lumpable bisimilarity and the basic non-interference condition

The observation equivalence underlying PSNI is a bisimulation-like relation based on lumpability. An equivalence relation $\mathcal H$7 is a lumpable bisimulation if whenever $\mathcal H$8, then for all $\mathcal H$9 and all equivalence classes $\mathcal L$0 such that either $\mathcal L$1, or $\mathcal L$2 and $\mathcal L$3, it holds that

$\mathcal L$4

The largest such relation is lumpable bisimilarity, written

$\mathcal L$5

The paper notes that $\mathcal L$6 is a congruence for prefix, cooperation, and hiding, which is essential for compositional reasoning (Hillston et al., 2018).

The low-level view of a process is written $\mathcal L$7, intuitively “$\mathcal L$8 with high actions blocked/hidden”. Formally, it is represented by cooperating with a high-level process $\mathcal L$9 that does not interfere, so that the low-level view is well-defined up to isomorphism of derivation graphs.

On this basis, the basic security notion is Stochastic Non-Interference (SNI): $H$0 Here $H$1 is the low view of $H$2 in isolation, while $H$3 is the low view of $H$4 when interacting with an arbitrary high-level process $H$5. If these are lumpably bisimilar, a low observer cannot distinguish whether high-level interaction occurred. The security meaning is that steady-state probabilities over low-observable states are independent of the high-level context.

4. Persistent Stochastic Non-Interference

SNI alone is not persistent: a process may satisfy SNI initially but reach an insecure state later. PSNI strengthens SNI by requiring security at every reachable state. Its formal definition is

$H$6

Equivalently, every state reachable from $H$7 must itself satisfy SNI (Hillston et al., 2018).

To avoid explicit quantification over all high-level processes, the paper introduces high contexts of the form

$H$8

with $H$9. For such contexts it defines context-sensitive rates

$$\forall H' \in ds(H),\quad \mathcal A(H') \subseteq \mathcal H.$$0

and

$$\forall H' \in ds(H),\quad \mathcal A(H') \subseteq \mathcal H.$$1

An equivalence relation is a lumpable bisimulation on high contexts if the lumpability condition holds for all high contexts. The induced largest relation is written

$$\forall H' \in ds(H),\quad \mathcal A(H') \subseteq \mathcal H.$$2

The first main characterization is

$$\forall H' \in ds(H),\quad \mathcal A(H') \subseteq \mathcal H.$$3

This replaces universal quantification over all high-level environments with a single equivalence check. The meaning is that a process is persistently secure precisely when its low view is indistinguishable from the process itself in every high context.

5. Local characterizations, unwinding, and proof obligations

A second characterization removes even the explicit quantification over all high contexts. An equivalence relation $$\forall H' \in ds(H),\quad \mathcal A(H') \subseteq \mathcal H.$$4 is a lumpable bisimulation up to $$\forall H' \in ds(H),\quad \mathcal A(H') \subseteq \mathcal H.$$5 if whenever $$\forall H' \in ds(H),\quad \mathcal A(H') \subseteq \mathcal H.$$6, then for all $$\forall H' \in ds(H),\quad \mathcal A(H') \subseteq \mathcal H.$$7 and all $$\forall H' \in ds(H),\quad \mathcal A(H') \subseteq \mathcal H.$$8:

• if $$\forall H' \in ds(H),\quad \mathcal A(H') \subseteq \mathcal H.$$9, then

$H$0

• if $H$1 and $H$2, then

$H$3

The largest such relation is denoted

$H$4

The paper proves the equivalence

$H$5

hence the compact PSNI characterization

$H$6

This is a local “ignore high actions” formulation of the same security property (Hillston et al., 2018).

The paper also gives an unwinding characterization: $H$7 Thus, whenever a reachable state $H$8 can perform a high action $H$9 to $\begin{array}{cclccl} P & ::= & P \sync{L} P \mid P/L \mid S\qquad S & ::= & (\alpha, r).S \mid S+S \mid A \end{array}$0, the two resulting low views must be lumpably bisimilar. Operationally, high-level steps must be invisible at the low level even after arbitrary evolution.

These results establish two proof styles. PSNI can be checked as a single equivalence condition, or via local unwinding conditions on all reachable states. The second style is especially close to classical non-interference proof obligations, but the equivalence being checked is now quantitatively grounded in CTMC lumpability.

6. Structural properties, examples, and later developments

PSNI has several closure properties. If $\begin{array}{cclccl} P & ::= & P \sync{L} P \mid P/L \mid S\qquad S & ::= & (\alpha, r).S \mid S+S \mid A \end{array}$1, then

• $\begin{array}{cclccl} P & ::= & P \sync{L} P \mid P/L \mid S\qquad S & ::= & (\alpha, r).S \mid S+S \mid A \end{array}$2 for all $\begin{array}{cclccl} P & ::= & P \sync{L} P \mid P/L \mid S\qquad S & ::= & (\alpha, r).S \mid S+S \mid A \end{array}$3,
• $\begin{array}{cclccl} P & ::= & P \sync{L} P \mid P/L \mid S\qquad S & ::= & (\alpha, r).S \mid S+S \mid A \end{array}$4 for all $\begin{array}{cclccl} P & ::= & P \sync{L} P \mid P/L \mid S\qquad S & ::= & (\alpha, r).S \mid S+S \mid A \end{array}$5,
• $\begin{array}{cclccl} P & ::= & P \sync{L} P \mid P/L \mid S\qquad S & ::= & (\alpha, r).S \mid S+S \mid A \end{array}$6 for all $\begin{array}{cclccl} P & ::= & P \sync{L} P \mid P/L \mid S\qquad S & ::= & (\alpha, r).S \mid S+S \mid A \end{array}$7.

Hence PSNI is compositional with respect to low prefix, hiding, and cooperation over low actions. By contrast, PSNI is not preserved by choice, because lumpable bisimilarity is not a congruence for choice. Another invariance result is that if $\begin{array}{cclccl} P & ::= & P \sync{L} P \mid P/L \mid S\qquad S & ::= & (\alpha, r).S \mid S+S \mid A \end{array}$8 and $\begin{array}{cclccl} P & ::= & P \sync{L} P \mid P/L \mid S\qquad S & ::= & (\alpha, r).S \mid S+S \mid A \end{array}$9, then $P$0; PSNI is therefore invariant under lumpable bisimilarity (Hillston et al., 2018).

The examples in the original development clarify both strictness and intended meaning. A simple two-state model is secure in the CCS-style sense after forgetting rates, but not PSNI in PEPA. This shows that stochastic rates matter: a process can be behaviorally secure at the untimed level yet fail the stochastic non-interference condition. A three-state example exhibits the steady-state interpretation directly. For $P$1, the steady-state equations are

$P$2

with solution

$P$3

For $P$4, the equations are

$P$5

with solution

$P$6

In both cases, the low-observable probability of $P$7 is $P$8. This is the intended semantic consequence: the low-level steady-state view does not reveal whether high-level synchronization on $P$9 occurred.

Within the original comparison, PSNI is related to BNDC for CCS-like nondeterministic processes, P_BNDC as a persistent CCS property, and BSSLNI for Markovian process calculus. The emphasized distinctions are that PSNI is persistent, stochastic, and based on rates and steady-state probabilities, with observation equivalence grounded in lumpability (Hillston et al., 2018).

Subsequent work has refined or contrasted this notion. "Exact Persistent Stochastic Non-Interference" defines Exact PSNI (EPSNI) by replacing lumpable bisimilarity with weak-exact equivalence, while retaining analogous bisimulation-based, unwinding-style, and compositional characterizations (Piazza et al., 26 Aug 2025). A distinct line of work uses the acronym PSNI to mean progress-sensitive noninterference in session-typed concurrency; there the property is established through a recursive session logical relation for intuitionistic linear logic session types, and well-typed programs are shown to be self-related and thus enjoy PSNI in that different sense (Balzer et al., 2023). The earlier "Session Logical Relations for Noninterference" is also nonstochastic and provides a flow-sensitive, type-based, logical-relations account rather than a CTMC-based one (Derakhshan et al., 2021). Another probabilistic framework for irreversible and reversible systems does not explicitly name PSNI, but develops persistent counterparts such as SBSNNI and P_BNDC, defined over probabilistic weak or branching bisimilarity, which are close in spirit to persistent stochastic non-interference reasoning (Esposito et al., 31 Jan 2025).

In summary, PSNI denotes a PEPA-based confidentiality property requiring that, from every reachable state, the low-level stochastic behavior of a process be indistinguishable from the low-level behavior of that same state under interaction with any high-level environment. Its technical core is the use of lumpability-based observation equivalence to connect process-algebraic non-interference with CTMC steady-state behavior.