Introduction Information Flow Qualitative IF Quantitative IF Conclusion From Qualitative to Quantitative Program Analysis: Permissive Enforcement of Secure Information Flow Mounir Assaf Software Security Lab, CEA LIST, Saclay CIDre, Inria/Irisa/CentraleSupélec, Rennes Since 2015-09, Stevens Institute of Technology, Hoboken, US Mounir Assaf From Qualitative to Quantitative Information Flow 1 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Security Information security : Confidentiality Integrity Availability Traditionally, dissemination of information is prevented through Access control : Deals with what piece of information can be accessed? by whom? Yet, is this piece of information handled correctly when accessed? Information Flow Control : Tracks how information is propagated through a program Verifies that information flows are secure with respect to a security policy Mounir Assaf From Qualitative to Quantitative Information Flow 2 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion A Security Property Attacker model : They know the source of programs and public outputs They control public inputs PUBLIC inputs PUBLIC outputs SECRET inputs SECRET outputs Mounir Assaf From Qualitative to Quantitative Information Flow 3 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion A Security Property Attacker model : They know the source of programs and public outputs They control public inputs PUBLIC inputs PUBLIC outputs X SECRET inputs SECRET outputs A program is secure if non-interfering Roughly, non-interference (in the case of confidentiality) is independance of public outputs from secret inputs Mounir Assaf From Qualitative to Quantitative Information Flow 3 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Termination-Insensitive Non-Interference Termination-Insensitive Non-Interference (TINI) Two terminating executions which differ only on secret inputs deliver the same public outputs PUBLIC output PUBLIC input SECRET input SECRET output PUBLIC output PUBLIC input SECRET ′ SECRET ′ input output Mounir Assaf From Qualitative to Quantitative Information Flow 4 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Termination-Insensitive Non-Interference Termination-Insensitive Non-Interference (TINI) Two terminating executions which differ only on secret inputs deliver the same public outputs ✎ ☞ PUBLIC output PUBLIC input ✍ ✌ SECRET input SECRET output ✓ ✏ PUBLIC output PUBLIC input ✒ ✑ SECRET ′ SECRET ′ input output Mounir Assaf From Qualitative to Quantitative Information Flow 4 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Explicit Information Flows Explicit flows produced when information is transfered directly from source to destination destination := source Assignments generate explicit flows Explicit flow from variable source to destination Mounir Assaf From Qualitative to Quantitative Information Flow 5 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Implicit Information Flows Implicit flows produced when an assignment is conditioned on the value of an expression public := false if (secret) e execution path execution path l s e public := true else skip print public Implicit flow from variable secret to variable public Mounir Assaf From Qualitative to Quantitative Information Flow 6 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Pointer-induced flows Pointer-induced flows produced whenever a pointer is dereferenced if (secret) x := &public_a x := &public_b print *x Attackers knowing the values of variables public_a and public_b can deduce information about variable secret when observing the output *x . Mounir Assaf From Qualitative to Quantitative Information Flow 7 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Pointer-induced flows Pointer-induced flows produced whenever a pointer is dereferenced if (secret) x := &public_a x := &public_b print *x Attackers knowing the values of variables public_a and public_b can deduce information about variable secret when observing the output *x . Implicit flow from secret to pointer x Mounir Assaf From Qualitative to Quantitative Information Flow 7 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Pointer-induced flows Pointer-induced flows produced whenever a pointer is dereferenced if (secret) x := &public_a x := &public_b print *x Attackers knowing the values of variables public_a and public_b can deduce information about variable secret when observing the output *x . Implicit flow from secret to pointer x Pointer-induced flow from pointer x to *x Mounir Assaf From Qualitative to Quantitative Information Flow 7 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Contents I Information Flow II Qualitative IF Value Analysis 1 Information Flow Control for C programs 2 PWhile monitor 3 III Quantitative IF IV Conclusion Mounir Assaf From Qualitative to Quantitative Information Flow 8 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Value Analysis pc1 := secret_lab or public_lab; if (secret > public) e l s e y_lab y_lab := pc1 or 0; skip y := -1 assert y_lab == 0; z := 1/y Frama-C, an industrial-quality framework for source code analysis of C [Kirchner et al.,2015] Value Analysis plug-in a tool based on Abstract Interpretation [Cousot & Cousot,77] over-approximating the variation domains of variables aimed at the detection of runtime errors Mounir Assaf From Qualitative to Quantitative Information Flow 9 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Value Analysis secret _ lab [1 , 1] , public _ lab [0 , 0] pc1 := secret_lab or public_lab; y _ lab [0 , 0] , pc 1 [1 , 1] if (secret > public) secret [ minI , maxI ] , public [ minI , maxI ] , y [3 , 3] e l s e y_lab y_lab := pc1 or 0; skip y := -1 assert y_lab == 0; z := 1/y Frama-C, an industrial-quality framework for source code analysis of C [Kirchner et al.,2015] Value Analysis plug-in a tool based on Abstract Interpretation [Cousot & Cousot,77] over-approximating the variation domains of variables aimed at the detection of runtime errors Mounir Assaf From Qualitative to Quantitative Information Flow 9 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Value Analysis secret _ lab [1 , 1] , public _ lab [0 , 0] pc1 := secret_lab or public_lab; y _ lab [0 , 0] , pc 1 [1 , 1] if (secret > public) secret [ minI , maxI ] , public [ minI , maxI ] , y [3 , 3] e l s e y_lab y_lab := pc1 or 0; y _ lab [0 , 0] y _ lab [1 , 1] y [3 , 3] y [ − 1 , − 1] skip y := -1 assert y_lab == 0; z := 1/y Frama-C, an industrial-quality framework for source code analysis of C [Kirchner et al.,2015] Value Analysis plug-in a tool based on Abstract Interpretation [Cousot & Cousot,77] over-approximating the variation domains of variables aimed at the detection of runtime errors Mounir Assaf From Qualitative to Quantitative Information Flow 9 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Value Analysis secret _ lab [1 , 1] , public _ lab [0 , 0] pc1 := secret_lab or public_lab; y _ lab [0 , 0] , pc 1 [1 , 1] if (secret > public) secret [ minI , maxI ] , public [ minI , maxI ] , y [3 , 3] e l s e y_lab y_lab := pc1 or 0; y _ lab [0 , 0] y _ lab [1 , 1] y [3 , 3] y [ − 1 , − 1] skip y := -1 assert y_lab == 0; y _ lab [0 , 1] y [ − 1 , 3] z := 1/y Frama-C, an industrial-quality framework for source code analysis of C [Kirchner et al.,2015] Value Analysis plug-in a tool based on Abstract Interpretation [Cousot & Cousot,77] over-approximating the variation domains of variables aimed at the detection of runtime errors Mounir Assaf From Qualitative to Quantitative Information Flow 9 / 36
Introduction Information Flow Qualitative IF Quantitative IF Conclusion Value Analysis secret _ lab [1 , 1] , public _ lab [0 , 0] pc1 := secret_lab or public_lab; y _ lab [0 , 0] , pc 1 [1 , 1] if (secret > public) secret [ minI , maxI ] , public [ minI , maxI ] , y [3 , 3] e l s e y_lab y_lab := pc1 or 0; y _ lab [0 , 0] y _ lab [1 , 1] y [3 , 3] y [ − 1 , − 1] skip y := -1 assert y_lab == 0; y _ lab [0 , 1] � zdiv z [ − 1 , 1] y [ − 1 , 3] z := 1/y Frama-C, an industrial-quality framework for source code analysis of C [Kirchner et al.,2015] Value Analysis plug-in a tool based on Abstract Interpretation [Cousot & Cousot,77] over-approximating the variation domains of variables aimed at the detection of runtime errors Mounir Assaf From Qualitative to Quantitative Information Flow 9 / 36
Recommend
More recommend
