Detecting data leakage? - alloy

Question

I have a tree of elements. I harvest data from some of the elements and use that data to create a set of nodes. I want an assert to check that, given access to only the set of nodes, there is no possibility of accessing other data, such as data in other elements of the tree. That is, I want to ensure no data leakage.
Here is my tree of elements:
sig Element {
data: Data,
children: set Element
}
I harvest data from some elements. I stuff the data into nodes:
sig Node {
data: Data
}
If someone has access to just the set of nodes, then there is no data leakage because the nodes contain just the data that was deliberately harvested from elements in the tree.
However, for debugging purposes I added a field to Node to reference the Element that was the source of the Node's data:
sig Node {
data: Data,
represents: Element
}
Through accidental oversight, the represents field was not removed. Now a person with access to the set of Node also has access to the tree and therefore can see more data than the person should. Thus, there is the potential for data leakage.
I want to create an assert that checks the model for potential data leakage:
assert No_data_leakage { ??? }
Intuitively, I want the assert to say something like this: Of the universe (univ) of values in this model, a person with access to only the set of Nodes just has access to the data values in the set of Nodes and nothing else. How do I express that?
Below is a simplified version of my model.
open util/ordering[Element]
open util/ordering[Node]
sig Element {
data: Data,
children: set Element
}
one sig Root extends Element {}
sig Data {}
sig Node {
data: Data,
represents: Element
}
fact No_disconnected_elements {
all e: Element |
(e = Root) or (e in Root.^children)
}
fact Each_element_has_one_parent {
no disj e, e', e'': Element |
(e in e'.children) and (e in e''.children)
}
fact No_loops {
no e: Element | e in e.^children
}
fact First_Node_data_is_first_Element_data {
(Node <: first).data = (Element <: first).data
(Node <: first).represents = (Element <: first)
}
fact Last_Node_data_is_last_Element_data {
(Node <: last).data = (Element <: last).data
(Node <: last).represents = (Element <: last)
}
fact Every_element_has_different_data {
no disj e, e': Element | e.data = e'.data
}
run {} for 3 but 2 Node
assert No_data_leaks {
// How to express this?
}

Answer 1

See http://alloytools.org/quickguide/meta.html
There is a meta capability that allows you to 'iterate' over the fields of an Atom.
assert no_data_leaks {
all f : Node$.subfields| f.value[Node] in Data
}