per thread compositional compilation for confidentiality
play

Per-Thread Compositional Compilation for Confidentiality-Preserving - PowerPoint PPT Presentation

Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs Robert Sison 13 Jan 2018 THE UNIVERSITY OF NEW SOUTH WALES www.data61.csiro.au A confidentiality-preserving program Cross Domain Desktop Compositor


  1. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low part of state must remain indistinguishable. Classification of state as H or L can vary over time. 9 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  2. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low part of state must remain indistinguishable. Classification of state as H or L can vary over time. 9 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  3. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low part of state must remain indistinguishable. Classification of state as H or L can vary over time. 9 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  4. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low part of state must remain indistinguishable. Classification of state as H or L can vary over time. 9 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  5. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low part of state must remain indistinguishable. Classification of state as H or L can vary over time. 9 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  6. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low part of state must remain indistinguishable. Classification of state as H or L can vary over time. 10 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  7. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low part of state must remain indistinguishable. Classification of state as H or L can vary over time. 10 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  8. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low part of state must remain indistinguishable. Classification of state as H or L can vary over time. Per-thread, subject to havoc. 10 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  9. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low, unlocked part of state must remain indistinguishable. Classification of state as H or L can vary over time. Per-thread, subject to havoc that obeys locking discipline. 10 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  10. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low, unlocked part of state must remain indistinguishable. Classification of state as H or L can vary over time. Per-thread compositional property: 10 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  11. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low, unlocked part of state must remain indistinguishable. Classification of state as H or L can vary over time. Per-thread compositional property: 10 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  12. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low, unlocked part of state must remain indistinguishable. Classification of state as H or L can vary over time. Per-thread compositionality theorem [Murray+, CSF’16]: Under the hood: assume-guarantee on variable access. 10 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  13. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low, unlocked part of state must remain indistinguishable. Classification of state as H or L can vary over time. Per-thread compositionality theorem: [Murray+, CSF’16] instantiated with locking primitives. 10 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  14. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low, unlocked part of state must remain indistinguishable. Classification of state as H or L can vary over time. Whole-system property: [Murray+, CSF’16] instantiated with locking primitives. 10 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  15. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low, unlocked part of state must remain indistinguishable. Classification of state as H or L can vary over time. Whole-system property: 10 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  16. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low, unlocked part of state must remain indistinguishable. Classification of state as H or L can vary over time. Whole-system property: 10 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  17. The confidentiality property Concurrent value-dependent noninterference. Simplest policy: H igh �→ L ow Low, unlocked part of state must remain indistinguishable. Classification of state as H or L can vary over time. Whole-system property: i.e. Locked state still not considered to be observable. 10 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  18. This talk Part 1: Concurrent value-dependent noninterference Part 2: Per-thread compositional refinement Part 3: While-to-RISC compiler verification 11 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  19. This talk Part 1: Concurrent value-dependent noninterference Part 2: Per-thread compositional refinement Part 3: While-to-RISC compiler verification 11 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  20. Proof technique for compilation Per-thread compositional refinement [Murray+, CSF’16] 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  21. Proof technique for compilation Per-thread compositional refinement [Murray+, CSF’16] 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  22. Proof technique for compilation Per-thread compositional refinement [Murray+, CSF’16] Given bisimulation B establishing the property, 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  23. Proof technique for compilation Per-thread compositional refinement [Murray+, CSF’16] Given bisimulation B establishing the property, nominate R , I s.t.: 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  24. Proof technique for compilation Per-thread compositional refinement [Murray+, CSF’16] Given bisimulation B establishing the property, nominate R , I s.t.: 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  25. Proof technique for compilation Per-thread compositional refinement [Murray+, CSF’16] Given bisimulation B establishing the property, nominate R , I s.t.: 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  26. Proof technique for compilation Per-thread compositional refinement [Murray+, CSF’16] Given bisimulation B establishing the property, nominate R , I s.t.: 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  27. Proof technique for compilation Per-thread compositional refinement [Murray+, CSF’16] Given bisimulation B establishing the property, nominate R , I s.t.: 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  28. Proof technique for compilation Per-thread compositional refinement [Murray+, CSF’16] Then B ′ (= B T of B R I ) establishes the target-level property: 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  29. Proof technique for compilation Simpler proof technique than this! 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  30. Proof technique for compilation Simpler proof technique! Nominate R , I , abs steps s.t. (See: https://www.isa-afp.org/entries/Dependent_SIFUM_Refinement.html ) 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  31. Proof technique for compilation Simpler proof technique! Nominate R , I , abs steps s.t. Easy to prove if no H-branching in A (See: https://www.isa-afp.org/entries/Dependent_SIFUM_Refinement.html ) 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  32. Proof technique for compilation Simpler proof technique! Nominate R , I , abs steps s.t. ( I as pc-security) Easy to prove if no H-branching in A , and no new H-branching. (See: https://www.isa-afp.org/entries/Dependent_SIFUM_Refinement.html ) 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  33. Proof technique for compilation Simpler proof technique! Nominate R , I , abs steps. Then it suffices to prove: i.e. R a simulation of A’ by A . 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  34. Proof technique for compilation Simpler proof technique! Nominate R , I , abs steps. Then it suffices to prove: i.e. R a simulation of A’ by A , with provisos... 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  35. Proof technique for compilation Provisos for R , I : • R must preserve shared memory contents and locking state. ◮ Under the hood: preserve assumptions and guarantees. 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  36. Proof technique for compilation Provisos for R , I : • R must preserve shared memory contents and locking state. ◮ Under the hood: preserve assumptions and guarantees. 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  37. Proof technique for compilation Provisos for R , I : • R must preserve shared memory contents and locking state. ◮ Under the hood: preserve assumptions and guarantees. + any new locations permanently locked. i.e. No new shared state. 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  38. Proof technique for compilation Provisos for R , I : • R must preserve shared memory contents and locking state. ◮ Under the hood: preserve assumptions and guarantees. • R must be closed under lock-permitted shared memory havoc. 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  39. Proof technique for compilation Provisos for R , I : • R must preserve shared memory contents and locking state. ◮ Under the hood: preserve assumptions and guarantees. • R must be closed under lock-permitted shared memory havoc. 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  40. Proof technique for compilation Provisos for R , I : • R must preserve shared memory contents and locking state. ◮ Under the hood: preserve assumptions and guarantees. • R must be closed under lock-permitted shared memory havoc. 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  41. Proof technique for compilation Provisos for R , I : • R must preserve shared memory contents and locking state. ◮ Under the hood: preserve assumptions and guarantees. • R must be closed under lock-permitted shared memory havoc. 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  42. Proof technique for compilation Provisos for R , I : • R must preserve shared memory contents and locking state. ◮ Under the hood: preserve assumptions and guarantees. • R must be closed under lock-permitted shared memory havoc. Similar for I . 12 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  43. This talk Part 1: Concurrent value-dependent noninterference Part 2: Per-thread compositional refinement Part 3: While-to-RISC compiler verification 13 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  44. This talk Part 1: Concurrent value-dependent noninterference Part 2: Per-thread compositional refinement Part 3: While-to-RISC compiler verification 13 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  45. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  46. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler (Note: Constant-time execution steps, no cache effects) 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  47. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler Based on Fault-Resilient Non-interference [Tedesco et al, 2016]. 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  48. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler Based on Fault-Resilient Non-interference [Tedesco et al, 2016]. Implemented in Isabelle/HOL, executable, verified. 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  49. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler e.g. R cases for If construct 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  50. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler e.g. R cases for If construct 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  51. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler e.g. R cases for If construct, c 1 case: 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  52. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler e.g. R cases for If construct, c 1 case: Relation is inductive for smaller program pairs c 1 , c 2 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  53. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler e.g. R cases for If construct, c 1 case: Relation is inductive for smaller program pairs c 1 , c 2 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  54. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler e.g. R cases for If construct, c 1 case: Relation is inductive for smaller program pairs c 1 , c 2 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  55. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler e.g. R cases for If construct, c 1 case: Relation is inductive for smaller program pairs c 1 , c 2 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  56. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler • Theorem: R preserves per-thread compositional value-dependent noninterference property ◮ for B produced by our type system (no H-branching). ◮ for I asserting equal pc and program text. + 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  57. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler • Theorem: R preserves per-thread compositional value-dependent noninterference property ◮ for B produced by our type system (no H-branching). ◮ for I asserting equal pc and program text. • Theorem: Compiler input is related to its output by R ◮ Started with same observable initial state. ◮ No branching on H values. (Same as for type system.) 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  58. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  59. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  60. Compiler verification Per-thread simpler compositional refinement [Murray+, AFP] , instantiated with R characterising a compiler. Proof of concept: a While-to-RISC compiler Exercised on verified Cross Domain Desktop Compositor model. 14 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  61. Limitations and future work ideas • Optimisations to non-observable shared memory? 15 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

  62. Limitations and future work ideas • Optimisations to non-observable shared memory? Possibly too strict. 15 | Per-Thread Compositional Compilation for Confidentiality-Preserving Concurrent Programs | Robert Sison

Recommend


More recommend