An Automata Based Approach for Verification of Information Flow - PowerPoint PPT Presentation

An Automata Based Approach for Verification of Information Flow Properties Deepak D’Souza, Raghavendra K.R., Barbara Sprick Indian Institute of Science, Bangalore, India An Automata Based Approach for Verification of Information Flow Properties – p.1/14

Framework Events. V isible, C onfidential, N either An Automata Based Approach for Verification of Information Flow Properties – p.2/14

Framework Events. V isible, C onfidential, N either Trace: finite sequence of events An Automata Based Approach for Verification of Information Flow Properties – p.2/14

Framework Events. V isible, C onfidential, N either Trace: finite sequence of events System: sets of traces An Automata Based Approach for Verification of Information Flow Properties – p.2/14

Framework Events. V isible, C onfidential, N either Trace: finite sequence of events System: sets of traces Information flow properties for all x in L with some conditions ⇒ there exists y in L with some conditions An Automata Based Approach for Verification of Information Flow Properties – p.2/14

� Framework Events. V isible, C onfidential, N either Trace: finite sequence of events System: sets of traces Information flow properties for all x in L with some conditions ⇒ there exists y in L with some conditions Non-Inference( NF ) ∀ τ ∈ L ⇒ τ V ∈ L An Automata Based Approach for Verification of Information Flow Properties – p.2/14

An Example snd - enc - new rcv - enc - acc e f gen - new - pin gen - new - pin snd - enc - old e An Automata Based Approach for Verification of Information Flow Properties – p.3/14

An Example snd - enc - new rcv - enc - acc e f gen - new - pin gen - new - pin snd - enc - old e V = { e, f } C = { gen - new - pin } N = φ An Automata Based Approach for Verification of Information Flow Properties – p.3/14

An Example snd - enc - new rcv - enc - acc e f gen - new - pin gen - new - pin snd - enc - old e V = { e, f } C = { gen - new - pin } N = φ Tr = { gen - new - pin e f , e } + prefixes An Automata Based Approach for Verification of Information Flow Properties – p.3/14

An Example snd - enc - new rcv - enc - acc e f gen - new - pin gen - new - pin snd - enc - old e V = { e, f } C = { gen - new - pin } N = φ Tr = { gen - new - pin e f , e } + prefixes Confidentiality compromised. Noninference fails An Automata Based Approach for Verification of Information Flow Properties – p.3/14

Example ...contd snd - enc - new rcv - enc - acc e f gen - new - pin gen - new - pin snd - enc - old rcv - enc - rej e f An Automata Based Approach for Verification of Information Flow Properties – p.4/14

Example ...contd snd - enc - new rcv - enc - acc e f gen - new - pin gen - new - pin snd - enc - old rcv - enc - rej e f V = { e, f } C = { gen - new - pin } N = φ An Automata Based Approach for Verification of Information Flow Properties – p.4/14

Example ...contd snd - enc - new rcv - enc - acc e f gen - new - pin gen - new - pin snd - enc - old rcv - enc - rej e f V = { e, f } C = { gen - new - pin } N = φ Tr = { gen - new - pin e f , e f } + prefixes An Automata Based Approach for Verification of Information Flow Properties – p.4/14

Example ...contd snd - enc - new rcv - enc - acc e f gen - new - pin gen - new - pin snd - enc - old rcv - enc - rej e f V = { e, f } C = { gen - new - pin } N = φ Tr = { gen - new - pin e f , e f } + prefixes Confidentiality maintained. Noninference holds An Automata Based Approach for Verification of Information Flow Properties – p.4/14

Background Non−Interference Goguen, Meseguer − 82 Noninference Separability Generalized Non−Interference Non−Deducibility An Automata Based Approach for Verification of Information Flow Properties – p.5/14

Background Mantel − BSPs FCIA Non−Interference R Goguen, Meseguer − 82 FCD Noninference D Separability I BSI BSIA Generalized IA Non−Interference FCI BSD Non−Deducibility An Automata Based Approach for Verification of Information Flow Properties – p.5/14

Basic Security Predicates (BSPs) Trace based information flow properties in BSPs An Automata Based Approach for Verification of Information Flow Properties – p.6/14

Basic Security Predicates (BSPs) Trace based information flow properties in BSPs BSP Removal ( R ) new N events An Automata Based Approach for Verification of Information Flow Properties – p.6/14

Basic Security Predicates (BSPs) Trace based information flow properties in BSPs BSP Deletion ( D ) α c β new N events β ′ α ′ An Automata Based Approach for Verification of Information Flow Properties – p.6/14

Basic Security Predicates (BSPs) Trace based information flow properties in BSPs BSP Insertion ( I ) α β β ′ α ′ new C An Automata Based Approach for Verification of Information Flow Properties – p.6/14

� � Basic Security Predicates (BSPs) Trace based information flow properties in BSPs BSP Insert- X Admissable ( IA ) α β β ′ α ′ new C γc in L with γ X = α X An Automata Based Approach for Verification of Information Flow Properties – p.6/14

� � Basic Security Predicates (BSPs) Trace based information flow properties in BSPs BSP Insert- X Admissable ( IA ) α β β ′ α ′ new C γc in L with γ X = α X Generalized Non-Interference - I and D Noninference - R An Automata Based Approach for Verification of Information Flow Properties – p.6/14

Model Checking Can we automate Verification of Information Flow properties? An Automata Based Approach for Verification of Information Flow Properties – p.7/14

Model Checking Can we automate Verification of Information Flow properties? Properties of sets of traces, Classical Model-checking techniques like LTL, CTL cannot be used An Automata Based Approach for Verification of Information Flow Properties – p.7/14

Model Checking Can we automate Verification of Information Flow properties? Properties of sets of traces, Classical Model-checking techniques like LTL, CTL cannot be used Unwinding verification technique - Not complete An Automata Based Approach for Verification of Information Flow Properties – p.7/14

Model Checking Can we automate Verification of Information Flow properties? Properties of sets of traces, Classical Model-checking techniques like LTL, CTL cannot be used Unwinding verification technique - Not complete Good News. For finite systems, Yes An Automata Based Approach for Verification of Information Flow Properties – p.7/14

Model Checking Can we automate Verification of Information Flow properties? Properties of sets of traces, Classical Model-checking techniques like LTL, CTL cannot be used Unwinding verification technique - Not complete Good News. For finite systems, Yes Model Check - BSP on Finite State Automaton An Automata Based Approach for Verification of Information Flow Properties – p.7/14

Language-theoretic Operations L be a language over Σ , X subset of Σ An Automata Based Approach for Verification of Information Flow Properties – p.8/14

� � � Language-theoretic Operations L be a language over Σ , X subset of Σ L X := { τ X | τ in L } , τ X , deletes events that are not elements of X An Automata Based Approach for Verification of Information Flow Properties – p.8/14

� � � Language-theoretic Operations L be a language over Σ , X subset of Σ L X := { τ X | τ in L } , τ X , deletes events that are not elements of X l-del ( L ) := { αβ | αcβ in L , no C events in β } deletes the last occuring C -event An Automata Based Approach for Verification of Information Flow Properties – p.8/14

� � � Language-theoretic Operations L be a language over Σ , X subset of Σ L X := { τ X | τ in L } , τ X , deletes events that are not elements of X l-del ( L ) := { αβ | αcβ in L , no C events in β } deletes the last occuring C -event l-ins ( L ) := { αcβ | αβ in L , no C events in β } inserts a C -event in a position after which no C -events occur An Automata Based Approach for Verification of Information Flow Properties – p.8/14

� � � � � Language-theoretic Operations L be a language over Σ , X subset of Σ L X := { τ X | τ in L } , τ X , deletes events that are not elements of X l-del ( L ) := { αβ | αcβ in L , no C events in β } deletes the last occuring C -event l-ins ( L ) := { αcβ | αβ in L , no C events in β } inserts a C -event in a position after which no C -events occur l-ins-adm X ( L ):= { αcβ | αβ in L , no C events in β , there exists γc in L , γ X = α X inserts a C -event in a position after which no C -events occur subject to a condition An Automata Based Approach for Verification of Information Flow Properties – p.8/14

� � � � � Language-theoretic Operations L be a language over Σ , X subset of Σ L X := { τ X | τ in L } , τ X , deletes events that are not elements of X l-del ( L ) := { αβ | αcβ in L , no C events in β } deletes the last occuring C -event l-ins ( L ) := { αcβ | αβ in L , no C events in β } inserts a C -event in a position after which no C -events occur l-ins-adm X ( L ):= { αcβ | αβ in L , no C events in β , there exists γc in L , γ X = α X inserts a C -event in a position after which no C -events occur subject to a condition . . . An Automata Based Approach for Verification of Information Flow Properties – p.8/14