Verifying that a compiler preserves concurrent value-dependent - PowerPoint PPT Presentation

Motivation Confidentiality for modern software (CSF’16) __________________ 1. Multiple moving parts 
 Doesn't leak secrets (well-synchronised) (storage channels) Concurrent value-dependent information-flow security 3. Compositionally! 
 Confidentiality 2. Mixed-sensitivity reuse 
 (per-thread effort) (of devices, space, etc.) Beaumont et al. 
 (ACSAC’16) Example (DSTG + Data61 collaboration) 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Confidentiality for modern software (CSF’16) 1. Multiple moving parts 
 Doesn't leak secrets (well-synchronised) PROTECTED Unclassified (storage channels) Concurrent value-dependent information-flow security Confidentiality 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Confidentiality for modern software (CSF’16) 1. Multiple moving parts 
 Doesn't leak secrets (well-synchronised) PROTECTED Unclassified (storage channels) Concurrent value-dependent information-flow security Confidentiality 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) … 😒 , 💹 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Cross Domain 
 Desktop Compositor 
 Confidentiality for modern software (CSF’16) (CDDC) 1. Multiple moving parts 
 Doesn't leak secrets (well-synchronised) (storage channels) Concurrent value-dependent information-flow security Confidentiality 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Cross Domain 
 Desktop Compositor 
 Confidentiality for modern software (CSF’16) (CDDC) 1. Multiple moving parts 
 Doesn't leak secrets (well-synchronised) (storage channels) Concurrent value-dependent information-flow security Confidentiality 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Cross Domain 
 Desktop Compositor 
 Confidentiality for modern software (CSF’16) (CDDC) 1. Multiple moving parts 
 Doesn't leak secrets (well-synchronised) (storage channels) Concurrent value-dependent information-flow security Confidentiality 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Cross Domain 
 Desktop Compositor 
 Confidentiality for modern software (CSF’16) (CDDC) 1. Multiple moving parts 
 Doesn't leak secrets (well-synchronised) (storage channels) Concurrent value-dependent information-flow security Confidentiality 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Cross Domain 
 Desktop Compositor 
 Confidentiality for modern software (CSF’16) (CDDC) 1. Multiple moving parts 
 Doesn't leak secrets (well-synchronised) (storage channels) Concurrent value-dependent information-flow security Confidentiality 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Cross Domain 
 Desktop Compositor 
 Confidentiality for modern software (CSF’16) (CDDC) 1. Multiple moving parts 
 Doesn't leak secrets (well-synchronised) (storage channels) Concurrent value-dependent information-flow security Confidentiality 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Cross Domain 
 Desktop Compositor 
 Confidentiality for modern software (CSF’16) (CDDC) 1. Multiple moving parts 
 1. Multiple moving parts 
 Doesn't leak secrets Doesn't leak secrets (well-synchronised) (well-synchronised) (storage channels) (storage channels) Concurrent value-dependent information-flow security Concurrent value-dependent information-flow security Confidentiality Confidentiality 2. Mixed-sensitivity reuse 
 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) (of devices, space, etc.) SECRET , PROTECTED , or Unclassified? 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Cross Domain 
 Desktop Compositor 
 Confidentiality for modern software (CSF’16) (CDDC) 1. Multiple moving parts 
 1. Multiple moving parts 
 Doesn't leak secrets Doesn't leak secrets (well-synchronised) (well-synchronised) (storage channels) (storage channels) Concurrent value-dependent information-flow security Concurrent value-dependent information-flow security _____________ Confidentiality Confidentiality 2. Mixed-sensitivity reuse 
 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) (of devices, space, etc.) SECRET , PROTECTED , or Unclassified? 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Cross Domain 
 Desktop Compositor 
 Confidentiality for modern software (CSF’16) (CDDC) 1. Multiple moving parts 
 1. Multiple moving parts 
 Doesn't leak secrets Doesn't leak secrets (well-synchronised) (well-synchronised) (storage channels) (storage channels) Concurrent value-dependent information-flow security Concurrent value-dependent information-flow security _________ Confidentiality Confidentiality 2. Mixed-sensitivity reuse 
 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) (of devices, space, etc.) 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Cross Domain 
 Desktop Compositor 
 Confidentiality for modern software (CSF’16) (CDDC) 1. Multiple moving parts 
 1. Multiple moving parts 
 Doesn't leak secrets Doesn't leak secrets (well-synchronised) (well-synchronised) (storage channels) (storage channels) Concurrent value-dependent information-flow security Concurrent value-dependent information-flow security _________ Confidentiality Confidentiality 2. Mixed-sensitivity reuse 
 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) (of devices, space, etc.) seL4-based software architecture 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Confidentiality for modern software (CSF’16) 1. Multiple moving parts 
 1. Multiple moving parts 
 Doesn't leak secrets Doesn't leak secrets (well-synchronised) (well-synchronised) (storage channels) (storage channels) Concurrent value-dependent information-flow security Concurrent value-dependent information-flow security _________ Confidentiality Confidentiality 2. Mixed-sensitivity reuse 
 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) (of devices, space, etc.) seL4-based software architecture (Case study: simplified model) 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Confidentiality for modern software (CSF’16) 1. Multiple moving parts 
 1. Multiple moving parts 
 Doesn't leak secrets Doesn't leak secrets (well-synchronised) (well-synchronised) (storage channels) (storage channels) Concurrent value-dependent information-flow security Concurrent value-dependent information-flow security _________ 3. Compositionally! 
 Confidentiality Confidentiality 2. Mixed-sensitivity reuse 
 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) (per-thread effort) (of devices, space, etc.) seL4-based software architecture (Case study: simplified model) 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Confidentiality for modern software (CSF’16) 1. Multiple moving parts 
 1. Multiple moving parts 
 Doesn't leak secrets Doesn't leak secrets (well-synchronised) (well-synchronised) (storage channels) (storage channels) Concurrent value-dependent information-flow security Concurrent value-dependent information-flow security _________ 3. Compositionally! 
 Confidentiality Confidentiality 2. Mixed-sensitivity reuse 
 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) (per-thread effort) (of devices, space, etc.) seL4-based software architecture (Case study: simplified model) 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Confidentiality for modern software (CSF’16) 1. Multiple moving parts 
 1. Multiple moving parts 
 Doesn't leak secrets Doesn't leak secrets (well-synchronised) (well-synchronised) (storage channels) (storage channels) Concurrent value-dependent information-flow security Concurrent value-dependent information-flow security 3. Compositionally! 
 Confidentiality Confidentiality 2. Mixed-sensitivity reuse 
 2. Mixed-sensitivity reuse 
 (of devices, space, etc.) (per-thread effort) (of devices, space, etc.) Can a compiler preserve it? 5 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Why wouldn’t a compiler preserve it? (CSF’16) Concurrent value-dependent information-flow security 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 control variable contents 
 ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 control variable contents 
 ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 makes it harder! 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 control variable contents 
 ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 makes it harder! Interference-resilience (tricky) 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 makes it harder! Interference-resilience (tricky) 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 makes it harder! Interference-resilience (tricky) + 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 makes it harder! Interference-resilience (tricky) + 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 makes it harder! Interference-resilience (tricky) + Each thread must prevent (scheduler-relative) timing leaks! Volpano & Smith, CSFW’98 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Program A Program B makes it harder! // Initially, v = 0 Interference-resilience (tricky) if (h) then + skip l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! fi Volpano & Smith, CSFW’98 v := 1 Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Program A Program B makes it harder! // Initially, v = 0 Interference-resilience (tricky) if (h) then _ + skip l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! fi Volpano & Smith, CSFW’98 v := 1 h isn’t assigned to anything h isn’t even here! _ _ Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B makes it harder! // Initially, v = 0 Interference-resilience (tricky) if (h) then _ + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! fi Volpano & Smith, CSFW’98 v := 1 Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B makes it harder! // Initially, v = 0 Interference-resilience (tricky) if (h) then _ + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 h = 0 makes it harder! A, A, A, B, … // Initially, v = 0 Interference-resilience (tricky) if (h) then _ + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! v = 0 fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 h = 0 makes it harder! / A, A, A, B, … // Initially, v = 0 Interference-resilience (tricky) if (h) then _ + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! v = 0 fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 h = 0 makes it harder! / / A, A, A, B, … // Initially, v = 0 Interference-resilience (tricky) if (h) then _ + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! v = 0 fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 h = 0 makes it harder! / / / A, A, A, B, … // Initially, v = 0 Interference-resilience (tricky) if (h) then _ + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! v = 0 fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 h = 0 makes it harder! / / / / A, A, A, B, … // Initially, v = 0 l = 0 Interference-resilience (tricky) if (h) then _ + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! v = 0 fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 h = 0 makes it harder! / / / / A, A, A, B, … // Initially, v = 0 l = 0 Interference-resilience (tricky) if (h) then _ + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! v = 1 fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 h = 0 makes it harder! A, A, A, B, … h = 1 // Initially, v = 0 l = 0 Interference-resilience (tricky) if (h) then _ + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! v = 0 fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 h = 0 makes it harder! / A, A, A, B, … h = 1 // Initially, v = 0 l = 0 Interference-resilience (tricky) if (h) then _ + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! v = 0 fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 h = 0 makes it harder! / / A, A, A, B, … h = 1 // Initially, v = 0 l = 0 Interference-resilience (tricky) if (h) then _ + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! v = 0 fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 h = 0 makes it harder! / / / A, A, A, B, … h = 1 // Initially, v = 0 l = 0 Interference-resilience (tricky) if (h) then _ + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! v = 1 fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 h = 0 makes it harder! / / / / A, A, A, B, … h = 1 // Initially, v = 0 l = 0 Interference-resilience (tricky) if (h) then _ l = 1 + skip || l := v Each thread must prevent else (scheduler-relative) skip ; skip timing leaks! v = 1 fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 h = 0 makes it harder! / / / / A, A, A, B, … h = 1 // Initially, v = 0 l = 0 Interference-resilience (tricky) if (h) then _ l = 1 + skip || l := v ____ Each thread must prevent else (scheduler-relative) Storage leak 
 skip ; skip timing leaks! of h! v = 1 fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 makes it harder! A, A, A, B, … // Initially, v = 0 Interference-resilience (tricky) if (h) then _ ; skip Timing 
 + skip || fix l := v ____ ____ Each thread must prevent else (scheduler-relative) Storage leak Storage leak 
 skip ; skip timing leaks! of h! fi Timing leak Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security But: Compiler may eliminate it! Some extra stuff to preserve 
 (not that hard) This particularly 
 Thread A Thread B Schedule 
 makes it harder! A, A, A, B, … // Initially, v = 0 Interference-resilience (tricky) if (h) then _ ; skip Timing 
 Timing 
 + skip skip || fix fix l := v ____ Each thread must prevent else (scheduler-relative) Storage leak 
 skip ; skip timing leaks! of h! fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Motivation Why wouldn’t a compiler preserve it? (CSF’16) Murray et al. CSF’16 Mantel et al. CSF’11 No storage leaks relies/guarantees 
 control variable contents 
 ( synchronisation) ( sensitivity-switching) Concurrent value-dependent information-flow security But: Compiler may eliminate it! Some extra stuff to preserve 
 (not that hard) (or, introduce new “ if (h)”!) This particularly 
 Thread A Thread B Schedule 
 makes it harder! A, A, A, B, … // Initially, v = 0 Interference-resilience (tricky) if (h) then _ ; skip Timing 
 Timing 
 + skip skip || fix fix l := v ____ Each thread must prevent else (scheduler-relative) Storage leak 
 skip ; skip timing leaks! of h! fi Timing leak 
 Volpano & Smith, CSFW’98 v := 1 ____ of h Minimal example: 6 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Background Why is it hard to prove? (CSF’16) Concurrent value-dependent information-flow security -preserving refinement 2 A 2 A 0 B B Abstract 1 A 1 A 0 R R Direction 
 of 
 compilation R R 2 C 2 C 0 Concrete I I 1 C 1 C 0 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Background Why is it hard to prove? (CSF’16) Confidentiality-preserving refinement 2 A 2 A 0 B B Abstract 1 A 1 A 0 R R Direction 
 of 
 compilation R R 2 C 2 C 0 Concrete I I 1 C 1 C 0 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Background Why is it hard to prove? (CSF’16) Confidentiality-preserving refinement 2 A 2 A 0 B B Abstract 1 A 1 A 0 R R Direction 
 of 
 compilation R R 2 C 2 C 0 Concrete I I 1 C 1 C 0 AFP entry: Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Background Why is it hard to prove? (CSF’16) Confidentiality-preserving refinement 2 A 2 A 0 B B Abstract 1 A 1 A 0 R R Direction 
 of 
 Program compilation configurations R R 2 C 2 C 0 Concrete I I 1 C 1 C 0 AFP entry: Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Background Why is it hard to prove? (CSF’16) Confidentiality-preserving refinement 2 A 2 A 0 B B Abstract Relations 
 1 A 1 A 0 (between) R R Direction 
 of 
 Program compilation configurations R R 2 C 2 C 0 Concrete I I 1 C 1 C 0 AFP entry: Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Background Why is it hard to prove? (CSF’16) Confidentiality-preserving refinement 2 A 2 A 0 B B Abstract Execution 
 Relations 
 steps 1 A 1 A 0 (between) R R Direction 
 of 
 Program compilation configurations R R 2 C 2 C 0 Concrete I I 1 C 1 C 0 AFP entry: Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Background Why is it hard to prove? (CSF’16) Confidentiality-preserving refinement “Usual” refinement: 2 A 2 A 0 B B Abstract 1 A 1 A 0 R R Direction 
 of 
 compilation R R 2 C 2 C 0 Concrete I I 1 C 1 C 0 AFP entry: Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Background Why is it hard to prove? (CSF’16) Confidentiality-preserving refinement “Usual” refinement: A simulates C ⇒ C refines A 2 A 2 A 0 B B Abstract 1 A 1 A 0 R R Direction 
 of 
 compilation R R 2 C 2 C 0 Concrete I I 1 C 1 C 0 AFP entry: Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Background Why is it hard to prove? (CSF’16) Confidentiality-preserving refinement “Usual” refinement: A simulates C ⇒ C refines A 2 A 2 A 0 B B Abstract 1 A 1 A 0 R R Direction 
 of 
 compilation R R 2 C 2 C 0 Concrete I I 1 C 1 C 0 AFP entry: For-all Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray


 Background Why is it hard to prove? (CSF’16) Confidentiality-preserving refinement “Usual” refinement: A simulates C ⇒ C refines A 2 A 2 A 0 B B Abstract 1 A 1 A 0 R R Direction 
 Exists of 
 compilation R R 2 C 2 C 0 Concrete I I 1 C 1 C 0 AFP entry: For-all Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Background Why is it hard to prove? (CSF’16) From compiler 
 Confidentiality-preserving refinement front-end 2 A 2 A 0 Security proof 
 B B Abstract (Bisimulation B ) 1 A 1 A 0 R R Direction 
 of 
 compilation R R 2 C 2 C 0 Concrete I I 1 C 1 C 0 AFP entry: Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

⇒ Background Why is it hard to prove? (CSF’16) From compiler 
 Confidentiality-preserving refinement front-end 2 A 2 A 0 Security proof 
 B B Abstract (Bisimulation B ) 1 A 1 A 0 + Compiler ? R R Direction 
 correctness proof of 
 (Refinement R ) compilation R R For free ? 2 C 2 C 0 Security proof 
 Concrete “ B C ” “ B C ” (Bisimulation I I B C of B R I ) “ B C ” 1 C 1 C 0 AFP entry: Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

⇒ Background Why is it hard to prove? (CSF’16) * From compiler 
 Confidentiality-preserving refinement front-end 2 A 2 A 0 Security proof 
 B B Abstract (Bisimulation B ) 1 A 1 A 0 + Compiler R R Direction 
 correctness proof of 
 (Refinement R ) compilation R R “For free”* 2 C 2 C 0 Security proof 
 Concrete (Bisimulation I I B C of B R I ) 1 C 1 C 0 AFP entry: Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

⇒ Background Why is it hard to prove? (CSF’16) * From compiler 
 Confidentiality-preserving refinement front-end (Two-sided!) 2 A 2 A 0 Security proof 
 B B Abstract (Bisimulation B ) 1 A 1 A 0 + Compiler R R Direction 
 correctness proof of 
 (Refinement R ) compilation R R “For free”* 2 C 2 C 0 Security proof 
 Concrete (Bisimulation I I B C of B R I ) 1 C 1 C 0 AFP entry: Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

⇒ Background Why is it hard to prove? (CSF’16) * From compiler 
 Confidentiality-preserving refinement front-end (Two-sided!) 2 A 2 A 0 Security proof 
 B B Abstract (Bisimulation B ) 1 A 1 A 0 + Compiler R R Direction 
 Exists correctness proof of 
 (Refinement R ) compilation 1 R R “For free”* 2 C 2 C 0 Security proof 
 Concrete (Bisimulation I I B C of B R I ) 1 C 1 C 0 AFP entry: For-all Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

⇒ Background Why is it hard to prove? (CSF’16) * From compiler 
 Confidentiality-preserving refinement front-end (Two-sided!) 2 A 2 A 0 Security proof 
 For-all B B Abstract (Bisimulation B ) 1 A 1 A 0 + Compiler R R Direction 
 Exists correctness proof of 
 (Refinement R ) compilation 1 R R “For free”* 2 C 2 C 0 Security proof 
 Concrete (Bisimulation I I B C of B R I ) 1 C 1 C 0 AFP entry: For-all Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

⇒ Background Why is it hard to prove? (CSF’16) * From compiler 
 Confidentiality-preserving refinement front-end (Two-sided!) 2 A 2 A 0 Security proof 
 For-all B B Abstract (Bisimulation B ) 1 A 1 A 0 + 2 Compiler R R Direction 
 Exists correctness proof of 
 (Refinement R ) compilation 1 Exists R R “For free”* 2 C 2 C 0 Security proof 
 Concrete (Bisimulation I I B C of B R I ) 1 C 1 C 0 AFP entry: For-all Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

⇒ Background Why is it hard to prove? (CSF’16) * From compiler 
 Confidentiality-preserving refinement front-end (Two-sided!) 2 A 2 A 0 Security proof 
 For-all B B Abstract (Bisimulation B ) 1 A 1 A 0 + 2 Compiler R R Direction 
 Exists correctness proof of 
 (Refinement R ) compilation 1 Exists R R “For free”* 2 C 2 C 0 Security proof 
 Concrete (Bisimulation I I B C of B R I ) 1 C 1 C 0 AFP entry: For-all Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

⇒ Background ( Compare: Barthe et al. CSF’18) Why is it hard to prove? (CSF’16) * From compiler 
 Confidentiality-preserving refinement front-end (Two-sided!) 2 A 2 A 0 Security proof 
 For-all B B Abstract (Bisimulation B ) 1 A 1 A 0 + 2 Compiler R R Direction 
 Exists correctness proof of 
 (Refinement R ) compilation 1 Exists R R “For free”* 2 C 2 C 0 Security proof 
 Concrete (Bisimulation I I B C of B R I ) 1 C 1 C 0 AFP entry: For-all Dependent_SIFUM_Refinement 7 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Our contributions Goal Prove a compiler preserves proofs of concurrent 
 value-dependent information-flow security Plan: Use confidentiality-preserving refinement 8 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Our contributions Goal Prove a compiler preserves proofs of concurrent 
 value-dependent information-flow security Results 1. Decomposition principle for confidentiality-preserving refinement 2 A = abs - steps 2 A 2 C B = 1 A abs - steps 1 A 1 C R R (Technique) = stops 2 C 2 C I = stops 1 C 1 C 8 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Our contributions Goal Prove a compiler preserves proofs of concurrent 
 value-dependent information-flow security Results 1. Decomposition principle 2. Verified compiler for confidentiality-preserving While-language to RISC-style refinement assembly 2 A = abs - steps 2 A 2 C B = 1 A abs - steps 1 A 1 C R R (Technique) (Proof-of-concept 
 = stops 2 C 2 C I = for technique) stops 1 C 1 C Impact 1st such proofs carried to assembly-level model by compiler 8 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Our contributions Goal Prove a compiler preserves proofs of concurrent 
 value-dependent information-flow security Results 1. Decomposition principle 2. Verified compiler for confidentiality-preserving While-language to RISC-style refinement assembly 2 A = abs - steps 2 A 2 C B = 1 A abs - steps 1 A 1 C R R (Technique) (Proof-of-concept 
 = stops 2 C 2 C I = for technique) stops 1 C 1 C Impact 1st such proofs carried to assembly-level model by compiler 8 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

Our contributions Goal Prove a compiler preserves proofs of concurrent 
 value-dependent information-flow security Results 1. Decomposition principle 2. Verified compiler for confidentiality-preserving While-language to RISC-style refinement assembly Proof effort 2 A = abs - steps 2 A 2 C B = almost halved ! 1 A abs - steps 1 A 1 C R R (Technique) (Proof-of-concept 
 = stops 2 C 2 C I = for technique) stops 1 C 1 C Impact 1st such proofs carried to assembly-level model by compiler 8 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

The “cube”, decomposed Simpler confidentiality-preserving refinement 2 A 2 A 0 B B 1 A 1 A 0 R R R R 2 C 2 C 0 I I 1 C 1 C 0 9 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

The “cube”, decomposed Simpler confidentiality-preserving refinement 2 A abs - steps 2 A 2 C 2 A B B = A A 0 abs - steps A C 1 A abs - steps 1 A 1 C 1 A R R R R R R 2 C 2 C 0 stops 2 C 2 C I I I = C C 0 1 C 0 1 C stops 1 C 1 C 1 2 A 2 A 0 B B ( ⟹ ) implies 1 A 1 A 0 R R R R 2 C 2 C 0 I I 1 C 0 1 C 9 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

The “cube”, decomposed Simpler confidentiality-preserving refinement 2 A abs - steps 2 A 2 C 2 A B B = A A 0 abs - steps A C 1 A abs - steps 1 A 1 C 1 A R R R R R R 2 C 2 C 0 stops 2 C 2 C I I I = C C 0 1 C 0 1 C stops 1 C 1 C 1 1. “Usual” proof of refinement 9 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

The “cube”, decomposed Simpler confidentiality-preserving refinement 2 A abs - steps 2 A 2 C 2 A B B = A A 0 abs - steps A C 1 A abs - steps 1 A 1 C 1 A R R R R R R 2 C 2 C 0 stops 2 C 2 C I I I = C C 0 1 C 0 1 C stops 1 C 1 C 1 1. “Usual” proof of refinement Standard compiler 
 correctness! (+ “extra stuff” for conc, val-dep) 9 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

The “cube”, decomposed Simpler confidentiality-preserving refinement “Pacing function” abs-steps 
 for (refinement) relation R 2 A abs - steps 2 A 2 C 2 A B B = A A 0 _____ abs - steps A C 1 A abs - steps 1 A 1 C 1 A R R R R R R 2 C 2 C 0 stops 2 C 2 C I I I = C C 0 1 C 0 1 C stops 1 C 1 C 1 1. “Usual” proof of refinement Standard compiler 
 correctness! (+ “extra stuff” for conc, val-dep) 9 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

The “cube”, decomposed Simpler confidentiality-preserving refinement “Pacing function” abs-steps 
 for (refinement) relation R _____ 2 A abs - steps 2 A 2 C 2 A B B = A A 0 _____ _____ abs - steps A C 1 A abs - steps 1 A 1 C 1 A R R R R R R 2 C 2 C 0 stops 2 C 2 C I I I = C C 0 1 C 0 1 C stops 1 C 1 C 1 1. “Usual” proof 2. Consistent pacing 
 of refinement Standard compiler 
 correctness! (+ “extra stuff” for conc, val-dep) 9 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

The “cube”, decomposed Simpler confidentiality-preserving refinement “Pacing function” abs-steps 
 Security witness 
 for (refinement) relation R (bisimulation) relation B _____ 2 A abs - steps 2 A 2 C 2 A B B = A A 0 _____ _____ abs - steps A C 1 A abs - steps 1 A 1 C 1 A R R R R R R 2 C 2 C 0 stops 2 C 2 C I I I = C C 0 1 C 0 1 C stops 1 C 1 C 1 1. “Usual” proof 2. Consistent pacing 
 of refinement Standard compiler 
 correctness! (+ “extra stuff” for conc, val-dep) 9 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

The “cube”, decomposed Simpler confidentiality-preserving refinement “Pacing function” abs-steps 
 Security witness 
 for (refinement) relation R (bisimulation) relation B _____ 2 A abs - steps 2 A 2 C 2 A B B = A A 0 _____ _____ abs - steps A C 1 A abs - steps 1 A 1 C 1 A R R R R R R 2 C 2 C 0 stops 2 C 2 C I I I = C C 0 1 C 0 1 C stops 1 C 1 C 1 1. “Usual” proof 2. Consistent pacing 
 of refinement Standard compiler 
 correctness! (+ “extra stuff” for conc, val-dep) 9 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

The “cube”, decomposed Simpler confidentiality-preserving refinement “Pacing function” abs-steps 
 Security witness 
 for (refinement) relation R (bisimulation) relation B _____ 2 A abs - steps 2 A 2 C 2 A B B = A A 0 _____ _____ abs - steps A C 1 A abs - steps 1 A 1 C 1 A R R R R R R 2 C 2 C 0 stops 2 C 2 C I I I = C C 0 1 C 0 1 C stops 1 C 1 C 1 1. “Usual” proof 2. Consistent pacing 
 of refinement Standard compiler 
 correctness! (+ “extra stuff” for conc, val-dep) 9 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray

The “cube”, decomposed Simpler confidentiality-preserving refinement “Pacing function” abs-steps 
 Security witness 
 for (refinement) relation R (bisimulation) relation B _____ 2 A abs - steps 2 A 2 C 2 A B B = A A 0 _____ _____ abs - steps A C 1 A abs - steps 1 A 1 C 1 A R R R R R R 2 C 2 C 0 stops 2 C 2 C I I I = C C 0 1 C 0 1 C stops 1 C 1 C 1 1. “Usual” proof 2. Consistent pacing 
 of refinement Standard compiler 
 correctness! (+ “extra stuff” for conc, val-dep) 9 Verifying that a compiler preserves concurrent value-dependent infoflow security | Robert Sison and Toby Murray