A BSTRACT N ON -I NTERFERENCE (N ARROW ) Public Input Private Input - PowerPoint PPT Presentation

A BSTRACT N ON -I NTERFERENCE A N A BSTRACT I NTERPRETATION - BASED VIEW ON C ODE S ECURITY Roberto Giacobazzi and Isabella Mastroeni Dipartimento di Informatica Universit` a di Verona Italy London, April 2012 � Giaco – London 2012 – p.1/31 c

T HE DIMENSIONS OF N ON -I NTERFERENCE We distinguish two points of view [ Sabelfeld & Sands 2005 ] : ➪ W HO observes the information flows? ➪ W HAT information flows? � Giaco – London 2012 – p.2/31 c

T HE DIMENSIONS OF N ON -I NTERFERENCE We distinguish two points of view [ Sabelfeld & Sands 2005 ] : ➪ W HO observes the information flows? How can we weaken non-interference by characterizing the observational capability of who observes? ✔ By means of Equivalence relations : PER MODEL , R OBUST DECLASSIFICATION ; ✔ By means of Abstract domains : A BSTRACT N ON -I NTERFERENCE ; ➪ W HAT information flows? � Giaco – London 2012 – p.2/31 c

T HE DIMENSIONS OF N ON -I NTERFERENCE We distinguish two points of view [ Sabelfeld & Sands 2005 ] : ➪ W HO observes the information flows? How can we weaken non-interference by characterizing the observational capability of who observes? ➪ W HAT information flows? How can we weaken non-interference by characterizing what of the private information flows? � Giaco – London 2012 – p.2/31 c

T HE DIMENSIONS OF N ON -I NTERFERENCE We distinguish two points of view [ Sabelfeld & Sands 2005 ] : ➪ W HO observes the information flows? How can we weaken non-interference by characterizing the observational capability of who observes? ➪ W HAT information flows? How can we weaken non-interference by characterizing what of the private information flows? ✔ Declassifying what can flow: S ELECTIVE DEPENDENCY , E NFORCING ROBUST DECLASSIFICATION , A BSTRACT NON - INTERFERENCE , D ELIMITED RELEASE , R ELAXED NONINTERFERENCE ; � Giaco – London 2012 – p.2/31 c

T HE DIMENSIONS OF N ON -I NTERFERENCE We distinguish two points of view [ Sabelfeld & Sands 2005 ] : ➪ W HO observes the information flows? How can we weaken non-interference by characterizing the observational capability of who observes? ➪ W HAT information flows? How can we weaken non-interference by characterizing what of the private information flows? ✔ Declassifying what can flow: S ELECTIVE DEPENDENCY , E NFORCING ROBUST DECLASSIFICATION , A BSTRACT NON - INTERFERENCE , D ELIMITED RELEASE , R ELAXED NONINTERFERENCE ; ✔ Classifying what cannot flow: A BSTRACT NON - INTERFERENCE . � Giaco – London 2012 – p.2/31 c

D EFINING A BSTRACT N ON -I NTERFERENCE � Giaco – London 2012 – p.3/31 c

O UR I DEA Secret H Public L SW H L Secret H External observer Public L � Giaco – London 2012 – p.4/31 c

O UR I DEA Secret H Public L SW Observer: ρ H L ρ Secret H External observer Public L � Giaco – London 2012 – p.4/31 c

O UR I DEA Secret H Public L SW Observable: φ φ ( H ) L ρ Secret φ ( H ) External observer Public L � Giaco – London 2012 – p.4/31 c

A BSTRACT I NTERPRETATION Design approximate semantics of programs [Cousot & Cousot ’77, ’79]. ⊤ ⊤ γ γ ( α ( x )) α Abstract α x Concrete Galois Connection: � C , α, γ, A � , A and C are complete lattices. Closures: � Abs ( C ) , ⊑� set of all possible abstract domains, A 1 ⊑ A 2 if A 1 is more concrete than A 2 � Giaco – London 2012 – p.5/31 c

A BSTRACT I NTERPRETATION Design approximate semantics of programs [Cousot & Cousot ’77, ’79]. ⊤ γ ( α ( x )) Abstract x γ ◦ α ∈ Abs ( C ) Concrete Galois Connection: � C , α, γ, A � , A and C are complete lattices. Closures: � Abs ( C ) , ⊑� set of all possible abstract domains, A 1 ⊑ A 2 if A 1 is more concrete than A 2 � Giaco – London 2012 – p.6/31 c

S TANDARD N ON -I NTERFERENCE Public Input Private Input � P � Public Output ∀ l : L , ∀ h 1 , h 2 : H . � P � ( h 1 , l ) L = � P � ( h 2 , l ) L � Giaco – London 2012 – p.7/31 c

S TANDARD N ON -I NTERFERENCE Public Input Private Input � P � Public Output ∀ l : L , ∀ h 1 , h 2 : H . � P � ( h 1 , l ) L = � P � ( h 2 , l ) L � Giaco – London 2012 – p.7/31 c

S TANDARD N ON -I NTERFERENCE Public Input Private Input � P � Public Output ∀ l : L , ∀ h 1 , h 2 : H . � P � ( h 1 , l ) L = � P � ( h 2 , l ) L � Giaco – London 2012 – p.7/31 c

S TANDARD N ON -I NTERFERENCE Public Input Private Input � P � Public Output ∀ l : L , ∀ h 1 , h 2 : H . � P � ( h 1 , l ) L = � P � ( h 2 , l ) L � Giaco – London 2012 – p.7/31 c

S TANDARD N ON -I NTERFERENCE Public Input Private Input � P � Public Output ∀ l : L , ∀ h 1 , h 2 : H . � P � ( h 1 , l ) L = � P � ( h 2 , l ) L � Giaco – London 2012 – p.7/31 c

S TANDARD N ON -I NTERFERENCE Public Input Private Input � P � Public Output ∀ l : L , ∀ h 1 , h 2 : H . � P � ( h 1 , l ) L = � P � ( h 2 , l ) L � Giaco – London 2012 – p.7/31 c

A BSTRACT N ON -I NTERFERENCE (N ARROW ) Public Input Private Input η [Giacobazzi & Mastroeni ’04] � P � Public Output ρ ρ, η ∈ Abs ( ℘ ( V L )) : [ η ] P ( ρ ) : η ( l 1 ) = η ( l 2 ) ⇒ ρ ( � P � ( h 1 , l 1 ) L ) = ρ ( � P � ( h 2 , l 2 ) L ) � Giaco – London 2012 – p.8/31 c

A BSTRACT N ON -I NTERFERENCE (N ARROW ) Public Input Private Input η [Giacobazzi & Mastroeni ’04] � P � Public Output ρ ρ, η ∈ Abs ( ℘ ( V L )) : [ η ] P ( ρ ) : η ( l 1 ) = η ( l 2 ) ⇒ ρ ( � P � ( h 1 , l 1 ) L ) = ρ ( � P � ( h 2 , l 2 ) L ) � Giaco – London 2012 – p.8/31 c

A BSTRACT N ON -I NTERFERENCE (N ARROW ) Public Input Private Input η [Giacobazzi & Mastroeni ’04] � P � Public Output ρ ρ, η ∈ Abs ( ℘ ( V L )) : [ η ] P ( ρ ) : η ( l 1 ) = η ( l 2 ) ⇒ ρ ( � P � ( h 1 , l 1 ) L ) = ρ ( � P � ( h 2 , l 2 ) L ) � Giaco – London 2012 – p.8/31 c

A BSTRACT N ON -I NTERFERENCE (N ARROW ) Public Input Private Input η [Giacobazzi & Mastroeni ’04] � P � Public Output ρ ρ, η ∈ Abs ( ℘ ( V L )) : [ η ] P ( ρ ) : η ( l 1 ) = η ( l 2 ) ⇒ ρ ( � P � ( h 1 , l 1 ) L ) = ρ ( � P � ( h 2 , l 2 ) L ) � Giaco – London 2012 – p.8/31 c

A BSTRACT N ON -I NTERFERENCE (N ARROW ) Public Input Private Input η [Giacobazzi & Mastroeni ’04] � P � Public Output ρ ρ, η ∈ Abs ( ℘ ( V L )) : [ η ] P ( ρ ) : η ( l 1 ) = η ( l 2 ) ⇒ ρ ( � P � ( h 1 , l 1 ) L ) = ρ ( � P � ( h 2 , l 2 ) L ) � Giaco – London 2012 – p.8/31 c

A BSTRACT N ON -I NTERFERENCE (N ARROW ) Public Input Private Input η � P � [Giacobazzi & Mastroeni ’04] Public Output ρ Deceptive flow!! ρ, η ∈ Abs ( ℘ ( V L )) : [ η ] P ( ρ ) : η ( l 1 ) = η ( l 2 ) ⇒ ρ ( � P � ( h 1 , l 1 ) L ) = ρ ( � P � ( h 2 , l 2 ) L ) � Giaco – London 2012 – p.8/31 c

A BSTRACT N ON -I NTERFERENCE (ANI) Public Input Private Input η � P � [Giacobazzi & Mastroeni ’04] Public Output ρ ρ, η ∈ Abs ( ℘ ( V L )) : ( η ) P ( ρ ) : η ( l 1 )= η ( l 2 ) ⇒ ρ ( � P � ( h 1 , η ( l 1 )) L )= ρ ( � P � ( h 2 , η ( l 2 )) L ) � Giaco – London 2012 – p.9/31 c

A BSTRACT N ON -I NTERFERENCE (ANI) Public Input Private Input η � P � [Giacobazzi & Mastroeni ’04] Public Output ρ ρ, η ∈ Abs ( ℘ ( V L )) : ( η ) P ( ρ ) : η ( l 1 )= η ( l 2 ) ⇒ ρ ( � P � ( h 1 , η ( l 1 )) L )= ρ ( � P � ( h 2 , η ( l 2 )) L ) � Giaco – London 2012 – p.9/31 c

A BSTRACT N ON -I NTERFERENCE (ANI) Public Input Private Input η � P � [Giacobazzi & Mastroeni ’04] Public Output ρ ρ, η ∈ Abs ( ℘ ( V L )) : ( η ) P ( ρ ) : η ( l 1 )= η ( l 2 ) ⇒ ρ ( � P � ( h 1 , η ( l 1 )) L )= ρ ( � P � ( h 2 , η ( l 2 )) L ) � Giaco – London 2012 – p.9/31 c

A BSTRACT N ON -I NTERFERENCE (ANI) Public Input Private Input η � P � [Giacobazzi & Mastroeni ’04] Public Output ρ ρ, η ∈ Abs ( ℘ ( V L )) : ( η ) P ( ρ ) : η ( l 1 )= η ( l 2 ) ⇒ ρ ( � P � ( h 1 , η ( l 1 )) L )= ρ ( � P � ( h 2 , η ( l 2 )) L ) � Giaco – London 2012 – p.9/31 c

A BSTRACT N ON -I NTERFERENCE (ANI) Public Input Private Input η � P � [Giacobazzi & Mastroeni ’04] Public Output ρ ρ, η ∈ Abs ( ℘ ( V L )) : ( η ) P ( ρ ) : η ( l 1 )= η ( l 2 ) ⇒ ρ ( � P � ( h 1 , η ( l 1 )) L )= ρ ( � P � ( h 2 , η ( l 2 )) L ) � Giaco – London 2012 – p.9/31 c

E XAMPLES E XAMPLE I : while h do ( l := l + 2 ; h := h − 1 ). Standard Non-Interference ≡ [ id ] P ( id ) h = 0, l = 1 ❀ l = 1 h = 1, l = 1 ❀ l = 3 h = n , l = 1 ❀ l = 1 + 2 n � Giaco – London 2012 – p.10/31 c

E XAMPLES E XAMPLE I : while h do ( l := l + 2 ; h := h − 1 ). Standard Non-Interference ≡ [ id ] P ( id ) h = 0, l = 1 ❀ l = 1 h = 1, l = 1 ❀ l = 3 h = n , l = 1 ❀ l = 1 + 2 n ⇓ [ id ] P ( Par ) h = 0, l = 1 ❀ Par ( l ) = odd h = 1, l = 1 ❀ Par ( l ) = odd h = n , l = 1 ❀ Par ( l ) = odd � Giaco – London 2012 – p.10/31 c