Introduction Definitions Results Conclusion Synthesis of non-interferent systems Gilles Benattar † Franck Cassez ‡ Didier Lime † Olivier H.Roux † † IRCCyN/CNRS UMR 6597, Nantes, France ‡ CNRS and National ICT Australia, Sydney, Australia Formal Modelling and Analysis of Timed Systems 2009 (FORMATS09) 1
Introduction Definitions Results Conclusion Introduction 1 Studies of information flow security properties has been a very active domain. 2 Information flow analysis defines secrecy as: “high level information never flows into low level channels” i.e. , non-interference . 3 There are many results on model checking of non-interference properties. 4 We consider the problem of the synthesis of non-interferent systems for timed and untimed automata. 2
Introduction Definitions Results Conclusion Introduction 1 Definitions 2 Preliminaries Non-interference Control problem Results 3 SNNI verification problem SNNI control problem SNNI control synthesis problem Conclusion 4 3
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion Restriction definition h 1 l 1 0 1 2 h 2 l 1 l 2 3 4 5 Figure: B 4
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion Restriction definition h 1 l 1 h 1 l 1 0 1 2 0 1 2 h 2 l 1 l 1 l 2 3 4 5 3 (a) Automaton B (b) B\{ h 2 } 4
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion Abstraction (hiding) definition h 1 l 1 0 1 2 h 2 l 1 l 2 3 4 5 Figure: B 5
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion Abstraction (hiding) definition h 1 l 1 h 1 l 1 0 1 2 0 1 2 h 2 ε l 1 l 1 l 2 l 2 3 4 5 3 4 5 (a) Automaton B (b) B / { h 2 } 5
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion Strong Non-deterministic Non-Interference (SNNI) 1/4 1 The systems is defined by an automaton A over an alphabet Σ divided into two sub-alphabets : Σ h the high level actions and Σ l the low level actions 2 A system defined by an automaton A is non-interferent if the low level user cannot distinguish A / Σ h from A\ Σ h . Definition (SNNI) A TA A has the strong non-deterministic non-interference property (in short “ A is SNNI”) if A / Σ h ≈ L A\ Σ h , where A 1 ≈ L A 2 mean that A 1 and A 2 are language equivalent . 6
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion SNNI finite automata example 1/2 h 1 l 1 0 1 2 h 2 l 1 l 2 3 4 5 Figure: B that is not SNNI L ( B / { h 1 , h 2 } ) = { l 1 , l 2 } L ( B\{ h 1 , h 2 } ) = { l 1 } 7
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion SNNI finite automata example 2/2 h 1 l 1 0 1 2 h 2 l 1 3 4 Figure: C that is SNNI L ( C / { h 1 , h 2 } ) = { l 1 } L ( C\{ h 1 , h 2 } ) = { l 1 } 8
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion SNNI timed automata example [ x 1 ≤ 4] h , x 1 ≥ 1 A 0 A 2 l , x 1 ≥ 2 l A 1 A 3 Figure: Timed Automaton A 9
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion SNNI timed automata example h A 0 A 2 l l A 1 A 3 Figure: Finite Automaton A � = untimed ( A ) L ( A � / { h } ) = { l } L ( A � \{ h } ) = { l } 9
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion SNNI timed automata example [ x 1 ≤ 4] h , x 1 ≥ 1 A 0 A 2 l , x 1 ≥ 2 l A 1 A 3 Figure: Timed Automaton A ρ = ( A 0 , 0) 1 . 1 → ( A 0 , 1 . 1) h → ( A 2 , 0) 0 . 5 l − − − − − → ( A 2 , 1 . 6) − → ( A 3 , 1 . 6) ∈ Runs ( A ) 9
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion SNNI timed automata example [ x 1 ≤ 4] h , x 1 ≥ 1 A 0 A 2 l , x 1 ≥ 2 l A 1 A 3 Figure: Timed Automaton A ρ = ( A 0 , 0) 1 . 1 → ( A 2 , 0) 0 . 5 → ( A 0 , 1 . 1) h l − − − − − → ( A 2 , 1 . 6) − → ( A 3 , 1 . 6) ∈ Runs ( A ) (1 . 1 , h ) . (0 . 5 , l ) ∈ L ( A ) 9
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion SNNI timed automata example [ x 1 ≤ 4] h , x 1 ≥ 1 A 0 A 2 l , x 1 ≥ 2 l A 1 A 3 Figure: Timed Automaton A ρ = ( A 0 , 0) 1 . 1 → ( A 2 , 0) 0 . 5 → ( A 0 , 1 . 1) h l − − − − − → ( A 2 , 1 . 6) − → ( A 3 , 1 . 6) ∈ Runs ( A ) (1 . 1 , h ) . (0 . 5 , l ) ∈ L ( A ) ⇒ (1 . 6 , l ) ∈ L ( A / { h } ) 9
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion SNNI timed automata example [ x 1 ≤ 4] h , x 1 ≥ 1 A 0 A 2 l , x 1 ≥ 2 l A 1 A 3 Figure: Timed Automaton A ρ = ( A 0 , 0) 1 . 1 → ( A 2 , 0) 0 . 5 → ( A 0 , 1 . 1) h l − − − − − → ( A 2 , 1 . 6) − → ( A 3 , 1 . 6) ∈ Runs ( A ) (1 . 1 , h ) . (0 . 5 , l ) ∈ L ( A ) ⇒ (1 . 6 , l ) ∈ L ( A / { h } ) ⇒ A is not SNNI 9
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion Control problem 1/2 The SNNI Verification Problem (SNNI-VP) for a system S asks the following: is S SNNI ? The Control Problem (SNNI-CP) for a system S asks the following: Is there a controller C s.t. C ( S ) is SNNI ? The Controller Synthesis Problem (SNNI-CSP) asks to compute a witness controller C . 10
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion Control problem 2/2 Let Σ c ⊆ Σ = Σ h ∪ Σ l a set of controllable actions , let λ �∈ Σ the waiting action . Definition (Controller) A controller C for A is a partial mapping C : Runs ( A ) → 2 Σ c ∪{ λ } . After each run ρ ∈ Runs ( A ), the controller chose a set C ( ρ ) of actions that are not disabled. 11
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion Control problem 2/2 Let Σ c ⊆ Σ = Σ h ∪ Σ l a set of controllable actions , let λ �∈ Σ the waiting action . Definition (Controller) A controller C for A is a partial mapping C : Runs ( A ) → 2 Σ c ∪{ λ } . After each run ρ ∈ Runs ( A ), the controller chose a set C ( ρ ) of actions that are not disabled. If λ ∈ C ( ρ ), the system may wait, otherwise, a controllable action must be done by one of the users. 11
Introduction Preliminaries Definitions Non-interference Results Control Problem Conclusion Introduction 1 Definitions 2 Preliminaries Non-interference Control problem Results 3 SNNI verification problem SNNI control problem SNNI control synthesis problem Conclusion 4 12
Introduction SNNI-VP Definitions SNNI-CP Results SNNI-CSP Conclusion SNNI Verification Problem (SNNI-VP) Untimed Automata Timed Automata Deterministic A \ Σ h PTIME PSPACE-Complete Non-deterministic A \ Σ h PSPACE-Complete Undecidable [1] Table: Results for the SNNI-VP 13
Introduction SNNI-VP Definitions SNNI-CP Results SNNI-CSP Conclusion SNNI Control Problem (SNNI-CP) for finite automata 1/2 Theorem For finite automata, the SNNI-CP is PSPACE-Complete. 14
Introduction SNNI-VP Definitions SNNI-CP Results SNNI-CSP Conclusion SNNI Control Problem (SNNI-CP) for finite automata 2/2 For finite automata, we can easily check if SNNI is controllable by cutting all the controllable actions and checking if the obtained system is SNNI. h 1 l 1 0 4 5 l 1 l 2 3 2 1 h 2 Figure: Automaton D Σ c = { l 1 } 15
Introduction SNNI-VP Definitions SNNI-CP Results SNNI-CSP Conclusion SNNI Control Problem (SNNI-CP) for finite automata 2/2 For finite automata, we can easily check if SNNI is controllable by cutting all the controllable actions and checking if the obtained system is SNNI. h 1 0 4 Figure: Automaton D\ Σ c Σ c = { l 1 } 15
Introduction SNNI-VP Definitions SNNI-CP Results SNNI-CSP Conclusion SNNI Control Problem (SNNI-CP) for timed automata This does not work in the timed case : h , x 1 ≥ 5 0 2 a , x 1 > 1 b 1 3 Figure: Timed Automaton E Σ c = { a } 16
Introduction SNNI-VP Definitions SNNI-CP Results SNNI-CSP Conclusion SNNI Control Problem (SNNI-CP) for timed automata This does not work in the timed case : h , x 1 ≥ 5 h , x 1 ≥ 5 0 2 0 2 a , x 1 > 1 b b 1 3 3 (a) Timed Automaton E (b) Timed Automaton E\ Σ c Σ c = { a } 16
Introduction SNNI-VP Definitions SNNI-CP Results SNNI-CSP Conclusion SNNI Control Problem (SNNI-CP) for timed automata This does not work in the timed case : [ x 1 ≤ 4] h , x 1 ≥ 5 0 2 0 a , x 1 > 1 a , x 1 > 1 b 1 3 1 (c) Automaton E (d) Timed Automaton C ( E ) Σ c = { a } 16
Introduction SNNI-VP Definitions SNNI-CP Results SNNI-CSP Conclusion SNNI Controller Synthesis Problem (SNNI-CSP) Theorem If A is a finite automaton, we can compute the most permissive controller C s.t. C ( A ) is SNNI. Theorem If A is a timed automaton and A\ Σ h is deterministic, we can compute the most permissive controller C s.t. C ( A ) is SNNI. 17
Recommend
More recommend
