Towards a Flow- and Path-Sensitive Information Flow Analysis Peixuan Li, Danfeng Zhang Pennsylvania State University University Park, PA, USA {pzl129,zhang}@cse.psu.edu
Background: Information Flow Analysis o Security enforcement to prevent leakage of sensitive data o Non-interference : no dependence of public outputs on secret inputs o Lattice model : Information has labels that form a lattice o Information Flow S : secret P : public o Explicit flow – assignment S o Implicit flow – branch Program (secure) Secret Input P s Public Output Public Input p p 08/22/2017 30th IEEE Computer Security Foundations Symposium 1
Problem of Interest o Conservative: sound but not complete o Sound: Checked → Secure False Alarm o Complete: Secure → Checked Secure Program Flow-Sensitive Checked Program Path-Sensitive o Source of Conservativeness o Flow-Sensitivity – to differentiate for the order of execution o Path-Sensitivity – to differentiate for the execution paths 08/22/2017 30th IEEE Computer Security Foundations Symposium 2
Source of Conservativeness o Flow-Sensitivity – to differentiate for the order of execution o Path-Sensitivity – to differentiate for execution path Program (secure) Insecure Program: Insecure Program: Path-Sensitivity Flow-Sensitivity 08/22/2017 30th IEEE Computer Security Foundations Symposium 3
Overview Flow- & Path- Sensitive Analysis Program Program Transformation Dependent Type Flow-sensitivity System Path-sensitivity Transformed Soundness Proof Comparison with a flow-sensitive system 08/22/2017 30th IEEE Computer Security Foundations Symposium 4
Overview – Sensitivity Knob o Sensitivity Tuner o Flow-sensitivity – Bracketed Assignments o Path-sensitivity – Dependent Type Labels MIN MAX o Less type annotation o Accept more secure programs o Simple analysis o Program readability 08/22/2017 30th IEEE Computer Security Foundations Symposium 5
Overview Flow- & Path- Sensitive Analysis Program Program Transformation Dependent Type Flow-sensitivity System Path-sensitivity Transformed Proof of soundness on non-interference Comparison with a flow-sensitive system 08/22/2017 30th IEEE Computer Security Foundations Symposium 6
Program Transformation o Goal – To gain flow-sensitivity Program (secure) Flow-Sensitive Type System: v Update & Record types at each program point v Complicates the design of the type system 08/22/2017 30th IEEE Computer Security Foundations Symposium 7
Program Transformation o Goal – To gain flow-sensitivity Program (secure) Secure: Type checked by flow- insensitive type systems v Renaming gains flow-sensitivity 08/22/2017 30th IEEE Computer Security Foundations Symposium 8
Program Transformation o Goal – To gain flow-sensitivity Bracketed Assignment Program (secure) Active Copy Active Set 08/22/2017 30th IEEE Computer Security Foundations Symposium 9
Program Transformation o Goal – To gain flow-sensitivity Bracketed Assignment Program (secure) Rename Merge 08/22/2017 30th IEEE Computer Security Foundations Symposium 10
Program Transformation o Difference from SSA o Tunable bracketed assignments – not all assignment need renaming o No phi-function – simplify the analysis and soundness proof o Details are discussed in the paper 08/22/2017 30th IEEE Computer Security Foundations Symposium 11
Program Transformation active set x 1 x 2 x o Transformation Correctness y y 1 y 2 o memory projection on active set … … Memory of original Memory of transformed program program 08/22/2017 30th IEEE Computer Security Foundations Symposium 12
Review Flow- & Path- Sensitive Analysis Program Program Transformation Dependent Type Flow-sensitivity System Path-sensitivity Transformed Soundness Proof Comparison with a flow-sensitive system 08/22/2017 30th IEEE Computer Security Foundations Symposium 13
Dependent Type System o Goal – To gain Path-Sensitivity o Dependent Security Label Program (secure) o Predicates Generator o Information flow constraints: s y Line 2: Line 3: 08/22/2017 30th IEEE Computer Security Foundations Symposium 14
Dependent Type System o Challenge Line 2: Line 4: Program (secure) Insecure Program: y: S y: P s s Implicit Declassification 08/22/2017 30th IEEE Computer Security Foundations Symposium 15
Dependent Type System o Solution to Implicit Declassification y: S y: P s s 0 o A. Reject if program contains any mutable dependency o B. Dynamically erase variable content for mutable dependency o Runtime overhead o Changing program behavior o C. Reject if program contains mutable dependency on live variable 08/22/2017 30th IEEE Computer Security Foundations Symposium 16
Dependent Type System o Soundness 08/22/2017 30th IEEE Computer Security Foundations Symposium 17
Proof of non-interference o Soundness of non-interference Final State Initial State Excution 1: Excution 2: Excution 1: Excution 2: Initial State Final State 08/22/2017 30th IEEE Computer Security Foundations Symposium 18
Review Flow- & Path- Sensitive Analysis Program Program Transformation Dependent Type Flow-sensitivity System Path-sensitivity Transformed Soundness Proof Comparison with a flow-sensitive system 08/22/2017 30th IEEE Computer Security Foundations Symposium 19
Comparison o Comparison with a classic flow-sensitive type system o HS System – S. Hunt and D. Sands, “On flow-sensitive security types,” in Principles of Programming Languages (POPL) , 2006 o Flow-Sensitivity o Path-Sensitivity MIN MAX MIN MAX MIN MAX MIN MAX HS System Our system HS System Our system v Strictly more precise than HS system 08/22/2017 30th IEEE Computer Security Foundations Symposium 20
Comparison o Strictly more precise than HS system Program (secure) o Subsumes the HS system o Accepts more secure program 08/22/2017 30th IEEE Computer Security Foundations Symposium 21
Conclusion Flow- & Path Sensitive Analysis Program Program Transformation Dependent Type System o Dependent Labels o Bracketed Assignment o Predicates Generator o Correctness o Implicit Declassification o Liveness Analysis Transformed Soundness Proof Comparison with classic flow-sensitive system 08/22/2017 30th IEEE Computer Security Foundations Symposium 22
Recommend
More recommend
