Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference KeY Symposium | 27.07.2016 INSTITUTE FOR APPLICATION-ORIENTED FORMAL VERIFICATION , FACULTY OF INFORMATICS KIT – University of the State of Baden-Wuerttemberg and www.kit.edu National Research Center of the Helmholtz Association
Agenda Motivation Objective Preliminary Combined Approach Demonstration Conclusion and future work Marko Kleine Büning – Deduktive Informationsfluss-Analyse 2 16-07-27 Institute for Application-oriented Formal Verification, anhand eines E- Voting Systems Faculty of Informatics
Motivation Current hybrid approach needs high degree of user interaction Program code has to be manually modified Proving of functional properties But KeY is capable of creating information flow proofs There should be a way to use KeY’s information flow capabilities in a hybrid approach. Motivation Objective Preliminary Combined Approach Demonstration Conclusion 3 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Objective Development and implementation of an approach, that can prove non- interference for complex systems ! ? Objective Status Quo ● Two types of tools for ● Combined approach for information flow control information flow proofs ● Joana runs automatic but ● The approach should be creates false positives automatic and precise ● KeY proofs are precise but ● KeY is called for as few as interactive and time-costly possible methods Objective: Creation of an approach that creates automatic and precise information flow proofs. Motivation Objective Preliminary Combined Approach Demonstration Conclusion 4 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Preliminary – Information Flow Observation of an information flow No flow from secret input to public output Guarantees End-to-End Security Source: KlUl15 Motivation Objective Preliminary Combined Approach Demonstration Conclusion 5 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Preliminary – Non-Interference Non-Interference • A variation of the secret input must not lead to a variation of the public output. Source: SchSch12 Example: Secure, the results of 𝑚 only depends on 𝑚 Motivation Objective Preliminary Combined Approach Demonstration Conclusion 6 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Preliminary – Non-Interference Non-Interference • A variation of the secret input must not lead to a variation of the public output. Source: SchSch12 Example: Not secure, because the result of 𝑚 depends on ℎ Motivation Objective Preliminary Combined Approach Demonstration Conclusion 7 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Preliminary – Joana Source: Joa16 Motivation Objective Preliminary Combined Approach Demonstration Conclusion 8 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Preliminary – Joana Program Dependency Graph: Source: Griff12 Motivation Objective Preliminary Combined Approach Demonstration Conclusion 9 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Preliminary – Joana Extension of PDG‘s are System Dependency Graphs (SDGs) Source: Griff12 Motivation Objective Preliminary Combined Approach Demonstration Conclusion 10 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Preliminary – Joana Summary Edges • Additional edge between actual-in and actual-out nodes • Represent transitive flow from a parameter to a return value Motivation Objective Preliminary Combined Approach Demonstration Conclusion 11 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Preliminary – Joana Motivation Objective Preliminary Combined Approach Demonstration Conclusion 12 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Preliminary – Joana Motivation Objective Preliminary Combined Approach Demonstration Conclusion 13 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Preliminary – Joana Motivation Objective Preliminary Combined Approach Demonstration Conclusion 14 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Combined Approach Joana SDG Motivation Objective Preliminary Combined Approach Demonstration Conclusion 15 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Combined Approach low high Joana SDG All path from low to high low Validate summary edges high Motivation Objective Preliminary Combined Approach Demonstration Conclusion 16 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Combined Approach low high Joana SDG All path from low to high low Information Flow leak Validate summary edges high Motivation Objective Preliminary Combined Approach Demonstration Conclusion 17 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Combined Approach low high Joana SDG All path from low to high low Non-Interference guarantee Validate summary edges high Motivation Objective Preliminary Combined Approach Demonstration Conclusion 18 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Combined Approach - Distinction of cases Main Act-In Param 1 secure Act-Out Return 1 Act-In Param 2 mulZero Act-Out The path is interrupted if we can prove non- Return 2 interference for one of the methods Return Motivation Objective Preliminary Combined Approach Demonstration Conclusion 19 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Combined Approach - Distinction of cases Main Act-In Param 1 minus Act-Out Return 1 Act-In Param 2 plus Act-Out It can be that the two methods together have to Return 2 be proven Return Motivation Objective Preliminary Combined Approach Demonstration Conclusion 20 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Combined Approach - Distinction of cases Main Act-In Act-In Param 2 Param 1 Act-Out Act-Out Two methods are called independently Return 2 Return 1 and are both relevant to the result Non-Interference has to be proven for Return both methods Motivation Objective Preliminary Combined Approach Demonstration Conclusion 21 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Combined Approach - Distinction of cases Main Act-In Act-In Param 1 Param 1 Act-Out Act-Out Return 1 Return 1 We always try to delete summary edges Return bottom up Motivation Objective Preliminary Combined Approach Demonstration Conclusion 22 16-07-27 Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with Institute for Application-oriented Formal Verification, KeY for Proving Non-Interference Faculty of Informatics
Recommend
More recommend
