Secure Multi-Execution Dominique Devriese Frank Piessens K.U.Leuven May 14, 2010 Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 1 / 24
Secure Multi-Execution Outline Secure Multi-Execution Introduction Informal Overview Formal Properties Experimental Results Conclusion Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 2 / 24
Secure Multi-Execution Introduction Introduction ◮ Information Flow Analysis has received much attention: ◮ Static analysis methods: From Denning to JFlow/JIF and FlowCaml But: ◮ Substantial Programmer Effort ◮ In general undecidable statically ◮ Hard to handle exceptions, parallellism, timing covert channel ◮ Dynamic methods: Many practical but unsound methods, some sound and somewhat practical methods But: ◮ Some use cases require sound methods (e.g. web page scripts) ◮ No existing monitor can precisely enforce non-interference ◮ Hard to handle exceptions, parallellism, timing covert channel Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 3 / 24
Secure Multi-Execution Introduction Secure Multi-Execution Secure Multi-Execution ◮ A novel dynamic enforcement technique for non-interference ◮ Nice theoretical properties ◮ Strong soundness guarantee ◮ The first (afawk) sound and precise enforcement method ◮ Practical in some scenario’s ◮ Performance measurements ◮ Browser implementation possible? Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 4 / 24
Secure Multi-Execution Informal Overview Outline Secure Multi-Execution Introduction Informal Overview Formal Properties Experimental Results Conclusion Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 5 / 24
Secure Multi-Execution Informal Overview Information Flow Analysis 1 var text = document.getElementById (’email-input’).text; 2 3 var abc = 0; 4 if(text.indexOf(’abc’)!=-1) { abc = 1 }; 5 var url = ’http://example.com/img.jpg’ + ’?t=’ + escape(text) + abc; 6 7 document.getElementById(’banner-img’) .src = url; 8 Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 6 / 24
Secure Multi-Execution Informal Overview Information Flow Analysis 1 var text = document.getElementById Input at level H (’email-input’).text; 2 3 var abc = 0; 4 if(text.indexOf(’abc’)!=-1) { abc = 1 }; 5 var url = ’http://example.com/img.jpg’ + ’?t=’ + escape(text) + abc; 6 7 document.getElementById(’banner-img’) .src = url; Output at level L 8 Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 6 / 24
Secure Multi-Execution Informal Overview Timing Covert Channel 1 function time(f) { var t = new Date().getTime(); 2 f(); 3 return new Date().getTime() - t; 4 5 } 6 function f() { if(abc != 0) { 7 for(var i = 0; i < 10000; ++i) {} 8 } 9 10 } 11 var abcLo = 0 12 if(time(f) > 10) { abcLo = 1; 13 14 } Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 7 / 24
Secure Multi-Execution Informal Overview Termination Covert Channel 1 while(abc == 0) {} 2 img.url = ’http://example.com/img.jpg’; Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 8 / 24
Secure Multi-Execution Informal Overview Secure Multi-Execution L H 1 var t = (...).text 1 var t = (...).text 2 var abc = 0 2 var abc = 0 3 if(t.indexOf(’abc’)!=-1) 3 if(t.indexOf(’abc’)!=-1) { abc = 1 } { abc = 1 } 4 4 5 var url = baseUrl + ’?t=’ 5 var url = baseUrl + ’?t=’ + escape(t) + abc + escape(t) + abc 6 6 7 (...).src = url 7 (...).src = url Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 9 / 24
Secure Multi-Execution Informal Overview Secure Multi-Execution L H undefined 1 var t = (...).text 1 var t = (...).text 2 var abc = 0 2 var abc = 0 3 if(t.indexOf(’abc’)!=-1) 3 if(t.indexOf(’abc’)!=-1) { abc = 1 } { abc = 1 } 4 4 5 var url = baseUrl + ’?t=’ 5 var url = baseUrl + ’?t=’ + escape(t) + abc + escape(t) + abc 6 6 7 (...).src = url 7 (...).src = url Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 9 / 24
Secure Multi-Execution Informal Overview Secure Multi-Execution L H undefined 1 var t = (...).text 1 var t = (...).text 2 var abc = 0 2 var abc = 0 3 if(t.indexOf(’abc’)!=-1) 3 if(t.indexOf(’abc’)!=-1) { abc = 1 } { abc = 1 } 4 4 5 var url = baseUrl + ’?t=’ 5 var url = baseUrl + ’?t=’ + escape(t) + abc + escape(t) + abc 6 6 7 (...).src = url 7 (...).src = url Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 9 / 24
Secure Multi-Execution Informal Overview Input Side Effects L H undefined 1 var t = (...).text 1 var t = (...).text 2 var c = window.confirm 2 var c = window.confirm 3 if( c("Send e-mail?") ) 3 if( c("Send e-mail?") ) { (...) } { (...) } 4 4 5 var abc = 0 5 var abc = 0 6 if(t.indexOf(’abc’)!=-1) 6 if(t.indexOf(’abc’)!=-1) { abc = 1 } { abc = 1 } 7 7 8 var url = baseUrl + ’?t=’ 8 var url = baseUrl + ’?t=’ + escape(t) + abc + escape(t) + abc 9 9 10 (...).src = url 10 (...).src = url Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 10 / 24
Secure Multi-Execution Informal Overview Input Side Effects L H undefined 1 var t = (...).text 1 var t = (...).text 2 var c = window.confirm 2 var c = window.confirm 3 if( c("Send e-mail?") ) 3 if( c("Send e-mail?") ) { (...) } { (...) } 4 4 5 var abc = 0 5 var abc = 0 6 if(t.indexOf(’abc’)!=-1) 6 if(t.indexOf(’abc’)!=-1) { abc = 1 } { abc = 1 } 7 7 8 var url = baseUrl + ’?t=’ 8 var url = baseUrl + ’?t=’ + escape(t) + abc + escape(t) + abc 9 9 10 (...).src = url 10 (...).src = url Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 10 / 24
Secure Multi-Execution Informal Overview Secure Multi-Execution Properties ◮ “Obviously” sound: Only execution at high level can see the real high inputs Only execution at low level can produce low outputs ◮ “Obviously” precise: If a program is non-interferent, then changing high inputs in low executions will not change their low behaviour Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 11 / 24
Secure Multi-Execution Formal Properties Outline Secure Multi-Execution Introduction Informal Overview Formal Properties Experimental Results Conclusion Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 12 / 24
Secure Multi-Execution Formal Properties Non-interference A formalization of information flow policies Assume: ◮ sets of input channels C i , output channels C o ◮ security level lattice L ◮ σ in : C i → L , σ out : C o → L ◮ inputs I : C i → ( N → Int ), outputs O : C o → List [ Int ] ◮ I = l I ′ iff I ( c i ) = I ′ ( c i ) for all c i such that σ in ( c i ) ≤ l Definition A program P is (termination-insensitively) non-interferent if for all security levels l and inputs I = l I ′ , where P terminates for I and I ′ with outputs O and O ′ , we have that O = l O ′ . Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 13 / 24
Secure Multi-Execution Formal Properties Soundness Definition (Strong non-interference) A program P is timing-sensitively non-interferent or strongly → ∗ if for all security non-interferent with relation to a given semantics ֒ levels l ∈ L , for all n ≥ 0, for all program inputs I and I ′ such that I = l I ′ holds that if → n ( p , O ) , ( P , I ) ֒ then → n � � P , I ′ � p ′ , O ′ � , ֒ and p ′ = l p and O ′ = l O . Theorem (Soundness of Secure Multi-Execution) Any program P is strongly non-interferent under secure multi-execution, using the select lowprio scheduler function. Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 14 / 24
Secure Multi-Execution Formal Properties Precision Theorem (Precision of Secure Multi-Execution) Suppose we have a (termination-sensitively) non-interferent program P. Suppose that ( P , I ) � ∗ ( p , O ) (terminates) for some I, p and O. Then ( P , I ) = ⊲ ∗ ( p , O ) . Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 15 / 24
Secure Multi-Execution Experimental Results Outline Secure Multi-Execution Introduction Informal Overview Formal Properties Experimental Results Conclusion Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 16 / 24
Secure Multi-Execution Experimental Results Experimental Results ◮ Spidermonkey Javascript engine, no real browser ◮ 2 security levels ◮ Dual-core PC ◮ 3 types of execution: ◮ Standard execution ◮ Serial Multi-Execution ◮ Parallel Multi-Execution ◮ Benchmarks: ◮ Google Chrome V8 Benchmark Suite: crypto, deltablue, earley-boyer, raytrace, regexp, richards, splay ◮ io: model I/O functions: hi input, hi output, lo input, lo output: some calculations + I/O at different security levels Dominique Devriese, Frank Piessens (K.U.Leuven) Secure Multi-Execution May 14, 2010 17 / 24
Recommend
More recommend
