---
title: 'PSNI: Persistent Stochastic Non-Interference in PEPA'
url: https://www.emergentmind.com/topics/persistent-stochastic-non-interference-psni
type: topic
---

# PSNI: Persistent Stochastic Non-Interference in PEPA

Persistent Stochastic Non-Interference (PSNI) is an information-flow security property for stochastic, cooperating processes expressed in the Performance Evaluation Process Algebra (PEPA). It formalizes the requirement that a high/confidential level must not influence what a low/public observer can infer from the stochastic behavior of a system, not only at the initial state but at every reachable state. In the PEPA setting, the relevant indistinguishability notion is based on lumpability of the induced continuous-time Markov chain (CTMC), so the intended consequence is that, for a secure process, the steady state probability of observing the system in a specific low-observable state is independent from its possible high level interactions [1808.08650].

## 1. Security setting and observational objective

PSNI is formulated for stochastic cooperating systems written in PEPA, with the explicit goal of preventing information leaking from a high/confidential level to a low/public level. The motivating point is that classical access control is not enough: covert channels and malicious “Trojan Horse” behavior may still leak secrets. The security interpretation is therefore behavioral rather than merely authorization-based. A low-level observer should not be able to distinguish the system’s behavior in isolation from its behavior when cooperating with any high-level environment; in the stochastic setting, this indistinguishability is not about traces alone, but about the steady-state probabilities of the induced Markov chain [1808.08650].

The visible actions $\mathcal A \setminus \{\tau\}$ are partitioned into $\mathcal H$ and $\mathcal L$, where $\mathcal H$ contains high-level actions and $\mathcal L$ contains low-level actions. A high-level PEPA component $H$ is one such that every derivative only enables high actions:
\[
\forall H' \in ds(H),\quad \mathcal A(H') \subseteq \mathcal H.
\]
This makes $H$ an abstract model of an arbitrary malicious or secret-bearing high-level environment.

The central design objective is to obtain a security notion for PEPA components that is behavioral, stochastic, compositional, and persistent. The persistence clause is decisive: a process may appear secure initially yet reach a derivative in which high activity changes low-observable stochastic behavior. PSNI is designed to exclude exactly that situation.

## 2. PEPA background and stochastic semantics

The underlying formalism is the standard PEPA grammar
\[
\begin{array}{cclccl}
P & ::= & P \sync{L} P \mid P/L \mid S\qquad
S & ::= & (\alpha, r).S \mid S+S \mid A
\end{array}
\]
where $P$ is a model component, $S$ is a sequential component, $(\alpha,r)$ is an activity with action type $\alpha$ and rate $r$, $+$ is choice, $\sync{L}$ is cooperation on action set $L$, $P/L$ is hiding, and $A$ is a constant with a defining equation $A \defeq P$. The set of action types is countable and includes a distinguished internal action $\tau$. Rates are positive reals or the passive symbol $\top$ [1808.08650].

The structural operational semantics supplies the labeled transition system from which the stochastic model is extracted. Representative rules are:
\[
\dfrac{}{(\alpha,r).P \transits{(\alpha,r)} P}
\]
\[
\dfrac{P \transits{(\alpha,r)} P'}{P+Q \transits{(\alpha,r)} P'}
\qquad
\dfrac{Q \transits{(\alpha,r)} Q'}{P+Q \transits{(\alpha,r)} Q'}
\]
\[
\dfrac{P \transits{(\alpha,r)} P'}{P/L \transits{(\alpha,r)} P'/L} \quad (\alpha \not \in L)
\qquad
\dfrac{P \transits{(\alpha,r)} P'}{P/L \transits{(\tau,r)} P'/L} \quad (\alpha \in L)
\]
and, for synchronization on $\alpha \in L$,
\[
\dfrac{P \transits{(\alpha,r_1)} P' \quad Q \transits{(\alpha,r_2)} Q'}{P \sync{L} Q \transits{(\alpha,R)} P' \sync{L} Q'}
\]
with
\[
R = \dfrac{r_1}{r_{\alpha}(P)} \dfrac{r_2}{r_{\alpha}(Q)} \min(r_{\alpha}(P),r_{\alpha}(Q)).
\]

A finite PEPA model induces a CTMC whose derivative set is $ds(P)$ and whose infinitesimal generator is $\mathbf Q$. The steady-state distribution $\Pi(\cdot)$ is given by
\[
\sum_{P_i \in ds(P)} \Pi(P_i) = 1, \qquad \Pi \mathbf Q = \mathbf 0.
\]
Transition rates are written $q(P_i,P_j)$, and the conditional transition rate via action type $\alpha$ is $q(P_i,P_j,\alpha)$. For a set $S \subseteq ds(P)$,
\[
q[P,S,\alpha]=\sum_{P'\in S} q(P,P',\alpha).
\]
PSNI depends on this stochastic semantics rather than on a purely qualitative reduction semantics.

## 3. Lumpable bisimilarity and the basic non-interference condition

The observation equivalence underlying PSNI is a bisimulation-like relation based on lumpability. An equivalence relation $\mathcal R \subseteq \mathcal C \times \mathcal C$ is a lumpable bisimulation if whenever $(P,Q)\in\mathcal R$, then for all $\alpha \in \mathcal A$ and all equivalence classes $S \in \mathcal C/\mathcal R$ such that either $\alpha \neq \tau$, or $\alpha=\tau$ and $P,Q \notin S$, it holds that
\[
q[P,S,\alpha] = q[Q,S,\alpha].
\]
The largest such relation is lumpable bisimilarity, written
\[
P \approx_l Q.
\]
The paper notes that $\approx_l$ is a congruence for prefix, cooperation, and hiding, which is essential for compositional reasoning [1808.08650].

The low-level view of a process is written $P \setminus \mathcal H$, intuitively “$P$ with high actions blocked/hidden”. Formally, it is represented by cooperating with a high-level process $\bar H$ that does not interfere, so that the low-level view is well-defined up to isomorphism of derivation graphs.

On this basis, the basic security notion is Stochastic Non-Interference (SNI):
\[
P \in SNI \text{ iff } P\setminus \mathcal H \approx_l (P \sync{\mathcal H} H)/{\mathcal H}.
\]
Here $P\setminus \mathcal H$ is the low view of $P$ in isolation, while $(P \sync{\mathcal H} H)/{\mathcal H}$ is the low view of $P$ when interacting with an arbitrary high-level process $H$. If these are lumpably bisimilar, a low observer cannot distinguish whether high-level interaction occurred. The security meaning is that steady-state probabilities over low-observable states are independent of the high-level context.

## 4. Persistent Stochastic Non-Interference

SNI alone is not persistent: a process may satisfy SNI initially but reach an insecure state later. PSNI strengthens SNI by requiring security at every reachable state. Its formal definition is
\[
P \in PSNI \text{ iff } \forall P' \in ds(P),\ \forall H \in \mathcal C_H,\quad P'\setminus \mathcal H \approx_l (P' \sync{\mathcal H} H)/{\mathcal H}.
\]
Equivalently, every state reachable from $P$ must itself satisfy SNI [1808.08650].

To avoid explicit quantification over all high-level processes, the paper introduces high contexts of the form
\[
C[\_] = (\_ \sync{\mathcal H} H)/{\mathcal H}
\]
with $H \in \mathcal C_H$. For such contexts it defines context-sensitive rates
\[
q_C(P,P',\alpha)=\sum_{C[P] \xrightarrow{(\alpha,r_{\alpha})} C'[P']} r_{\alpha}
\]
and
\[
q_C[P,S,\alpha]=\sum_{P'\in S} q_C(P,P',\alpha).
\]
An equivalence relation is a lumpable bisimulation on high contexts if the lumpability condition holds for all high contexts. The induced largest relation is written
\[
P \approx_l^{hc} Q.
\]

The first main characterization is
\[
P \in PSNI \iff P\setminus{\mathcal H}\approx^{hc}_l P.
\]
This replaces universal quantification over all high-level environments with a single equivalence check. The meaning is that a process is persistently secure precisely when its low view is indistinguishable from the process itself in every high context.

## 5. Local characterizations, unwinding, and proof obligations

A second characterization removes even the explicit quantification over all high contexts. An equivalence relation $\mathcal R$ is a lumpable bisimulation up to $\mathcal H$ if whenever $(P,Q)\in\mathcal R$, then for all $\alpha\in\mathcal A$ and all $S\in \mathcal C/\mathcal R$:

- if $\alpha \notin \mathcal H \cup \{\tau\}$, then
  \[
  q[P,S,\alpha]=q[Q,S,\alpha];
  \]
- if $\alpha \in \mathcal H \cup \{\tau\}$ and $P,Q \notin S$, then
  \[
  q[P,S,\alpha]=q[Q,S,\alpha].
  \]

The largest such relation is denoted
\[
P \approx_l^{\mathcal H} Q.
\]
The paper proves the equivalence
\[
P \approx^{hc}_l Q \iff P \approx^{\mathcal H}_l Q,
\]
hence the compact PSNI characterization
\[
P \in PSNI \iff P\setminus{\mathcal H}\approx^{\mathcal H}_l P.
\]
This is a local “ignore high actions” formulation of the same security property [1808.08650].

The paper also gives an unwinding characterization:
\[
P \in PSNI \iff \forall P' \in ds(P),\  \bigl(P' \transits{(h,r)} P'' \implies P' \setminus {\mathcal H}\approx_l P''\setminus{\mathcal H}\bigr).
\]
Thus, whenever a reachable state $P'$ can perform a high action $h$ to $P''$, the two resulting low views must be lumpably bisimilar. Operationally, high-level steps must be invisible at the low level even after arbitrary evolution.

These results establish two proof styles. PSNI can be checked as a single equivalence condition, or via local unwinding conditions on all reachable states. The second style is especially close to classical non-interference proof obligations, but the equivalence being checked is now quantitatively grounded in CTMC lumpability.

## 6. Structural properties, examples, and later developments

PSNI has several closure properties. If $P,Q \in PSNI$, then
- $(\alpha,r).P \in PSNI$ for all $\alpha \in \mathcal L \cup \{\tau\}$,
- $P/L \in PSNI$ for all $L \subseteq \mathcal A$,
- $P \sync{L} Q \in PSNI$ for all $L \subseteq \mathcal L$.

Hence PSNI is compositional with respect to low prefix, hiding, and cooperation over low actions. By contrast, PSNI is not preserved by choice, because lumpable bisimilarity is not a congruence for choice. Another invariance result is that if $P \in PSNI$ and $P \approx_l Q$, then $Q \in PSNI$; PSNI is therefore invariant under lumpable bisimilarity [1808.08650].

The examples in the original development clarify both strictness and intended meaning. A simple two-state model is secure in the CCS-style sense after forgetting rates, but not PSNI in PEPA. This shows that stochastic rates matter: a process can be behaviorally secure at the untimed level yet fail the stochastic non-interference condition. A three-state example exhibits the steady-state interpretation directly. For $P_1/{\mathcal H}$, the steady-state equations are
\[
\begin{array}{rcl}
\pi_1*2\lambda& =& \pi_3*\rho\\
\pi_2*\lambda& =& \pi_1*\lambda\\
\pi_3*\rho& =& \pi_1*\lambda+\pi_2*\lambda\\
\pi_1+\pi_2+\pi_3& =& 1
\end{array}
\]
with solution
\[
\pi_1=\frac{\rho}{2(\lambda+\rho)},\quad
\pi_2=\frac{\rho}{2(\lambda+\rho)},\quad
\pi_3=\frac{\lambda}{\lambda+\rho}.
\]
For $P_1 \setminus {\mathcal H}$, the equations are
\[
\begin{array}{rcl}
\pi_1*\lambda& =& \pi_3*\rho\\
\pi_3*\rho& =& \pi_1*\lambda\\
\pi_1+\pi_3& =& 1
\end{array}
\]
with solution
\[
\pi_1=\frac{\rho}{\lambda+\rho},\quad
\pi_3=\frac{\lambda}{\lambda+\rho}.
\]
In both cases, the low-observable probability of $P_3$ is $\lambda/(\lambda+\rho)$. This is the intended semantic consequence: the low-level steady-state view does not reveal whether high-level synchronization on $h$ occurred.

Within the original comparison, PSNI is related to BNDC for CCS-like nondeterministic processes, P\_BNDC as a persistent CCS property, and BSSLNI for Markovian process calculus. The emphasized distinctions are that PSNI is persistent, stochastic, and based on rates and steady-state probabilities, with observation equivalence grounded in lumpability [1808.08650].

Subsequent work has refined or contrasted this notion. "Exact Persistent Stochastic Non-Interference" defines Exact PSNI (EPSNI) by replacing lumpable bisimilarity with weak-exact equivalence, while retaining analogous bisimulation-based, unwinding-style, and compositional characterizations [2508.19110]. A distinct line of work uses the acronym PSNI to mean progress-sensitive noninterference in session-typed concurrency; there the property is established through a recursive session logical relation for intuitionistic linear logic session types, and well-typed programs are shown to be self-related and thus enjoy PSNI in that different sense [2309.00192]. The earlier "Session Logical Relations for Noninterference" is also nonstochastic and provides a flow-sensitive, type-based, logical-relations account rather than a CTMC-based one [2104.14094]. Another probabilistic framework for irreversible and reversible systems does not explicitly name PSNI, but develops persistent counterparts such as SBSNNI and P\_BNDC, defined over probabilistic weak or branching bisimilarity, which are close in spirit to persistent stochastic non-interference reasoning [2501.19290].

In summary, PSNI denotes a PEPA-based confidentiality property requiring that, from every reachable state, the low-level stochastic behavior of a process be indistinguishable from the low-level behavior of that same state under interaction with any high-level environment. Its technical core is the use of lumpability-based observation equivalence to connect process-algebraic non-interference with CTMC steady-state behavior.

Source: https://www.emergentmind.com/topics/persistent-stochastic-non-interference-psni