MGHyper: Checking Satisfiability of HyperLTL Formulas Beyond the ∃∗∀∗\exists^*\forall^* Fragment

Hyperproperties are properties that refer to multiple computation traces. This includes many information-flow security policies, such as observational determinism, (generalized) noninterference, and noninference, and other system properties like symmetry or Hamming distances between in error-resistant codes. We introduce MGHyper, a tool for automatic satisfiability checking and model generation for hyperproperties expressed in HyperLTL. Unlike previous satisfiability checkers, MGHyper is not limited to the decidable $\exists^* \forall^*$ fragment of HyperLTL, but provides a semi-decisionprocedure for the full logic. An important application of MGHyper is to automatically check equivalences between different hyperproperties (and different formalizations of the same hyperproperty) and to build counterexamples that disprove a certain claimed implication. We describe the semi-decisionprocedure implemented in MGHyper and report on experimental results obtained both with typical hyperproperties from the literature and with randomly generated HyperLTL formulas

Security Property Violation in CPS Through Timing

Security in a cyber-physical system (CPS) is not well understood. Interactions between components in the cyber and physical domains lead to unintended information flow. This paper makes use of formal information flow models to describe leakage in a model CPS, the Cooperating FACTS Power System. Results show that while a casual observer cannot ascertain confidential internal information, when application semantics, including timing, are considered, this confidentiality is lost. Model checking is used to verify the result. The significance of the paper is in showing an example of the complex interactions that occur between the Cyber and Physical domains and their impact on security

Actor-network procedures: Modeling multi-factor authentication, device pairing, social interactions

As computation spreads from computers to networks of computers, and migrates into cyberspace, it ceases to be globally programmable, but it remains programmable indirectly: network computations cannot be controlled, but they can be steered by local constraints on network nodes. The tasks of "programming" global behaviors through local constraints belong to the area of security. The "program particles" that assure that a system of local interactions leads towards some desired global goals are called security protocols. As computation spreads beyond cyberspace, into physical and social spaces, new security tasks and problems arise. As networks are extended by physical sensors and controllers, including the humans, and interlaced with social networks, the engineering concepts and techniques of computer security blend with the social processes of security. These new connectors for computational and social software require a new "discipline of programming" of global behaviors through local constraints. Since the new discipline seems to be emerging from a combination of established models of security protocols with older methods of procedural programming, we use the name procedures for these new connectors, that generalize protocols. In the present paper we propose actor-networks as a formal model of computation in heterogenous networks of computers, humans and their devices; and we introduce Procedure Derivation Logic (PDL) as a framework for reasoning about security in actor-networks. On the way, we survey the guiding ideas of Protocol Derivation Logic (also PDL) that evolved through our work in security in last 10 years. Both formalisms are geared towards graphic reasoning and tool support. We illustrate their workings by analysing a popular form of two-factor authentication, and a multi-channel device pairing procedure, devised for this occasion.Comment: 32 pages, 12 figures, 3 tables; journal submission; extended references, added discussio

Security analysis of a cyber-physical system

Cyber-Physical Systems (CPSs) are an integration of computing and physical processes. Information flow is an inherent property of CPSs and is of particular interest at their cyber-physical boundaries. This thesis focuses on discovering information flow properties and proposes a process to model the information flow in CPSs. A Cooperating FACTS Power System serves as a tangible example to illustrate modeling information flow using the proposed process. The proposed process can be used to model the information flow security, help analyze current information flow security requirements, and aid in the design of further security policies in CPS --Abstract, page iii

Security analysis of a cyber physical system : a car example

Deeply embedded Cyber Physical Systems (CPS) are infrastructures that have significant cyber and physical components that interact with each other in complex ways. These interactions can violate a system\u27s security policy, leading to the leakage of rights and unintended information flow. This thesis will explore information flow as it uses a public channel. In order to exemplify the use of the public channel, a vehicle being composed of the computer system and its operators will show how information is disclosed to an observer. The example is made up of a vehicle traveling across some terrain with an observer watching the car. The information that is trying to be hidden is the controller of the vehicle. The observer then uses the contextual information, based on the topography and previous knowledge about an automobile, to attempt to learn some of the events taking place in the car\u27s computer system and the actions of the driver. The combination of the observer and the passage of information from the car to the observer forms a public channel. This model is analyzed for both nondeducibility, noninference, and properties about its information flow. The investigation reveals that the same information that was disclosed with one topography is hidden with a different topography. In security, the knowledge that information flow exists is a violation. This is known as leakage. To remedy the weaknesses observed during the analysis, a method to obfuscate the information flow is introduced. The fact that important information can be camouflaged, even while it flows over a public channel, is an important observation of this thesis. This process of obfuscation can be applied to other cyber physical systems to secure the public channel --Abstract, page iii

CoSMeDis: a distributed social media platform with formally verified confidentiality guarantees

We present the design, implementation and information flow verification of CoSMeDis, a distributed social media platform. The system consists of an arbitrary number of communicating nodes, deployable at different locations over the Internet. Its registered users can post content and establish intra-node and inter-node friendships, used to regulate access control over the posts. The system’s kernel has been verified in the proof assistant Isabelle/HOL and automatically extracted as Scala code. We formalized a framework for composing a class of information flow security guarantees in a distributed system, applicable to input/output automata. We instantiated this framework to confidentiality properties for CoSMeDis’s sources of information: posts, friendship requests, and friendship status

CoSMeDis : a distributed social media platform with formally verified confidentiality guarantees

We present the design, implementation and information flow verification of CoSMeDis, a distributed social media platform. The system consists of an arbitrary number of communicating nodes, deployable at different locations over the Internet. Its registered users can post content and establish intra-node and inter-node friendships, used to regulate access control over the posts. The system's kernel has been verified in the proof assistant Isabelle/HOL and automatically extracted as Scala code. We formalized a framework for composing a class of information flow security guarantees in a distributed system, applicable to input/output automata. We instantiated this framework to confidentiality properties for CoSMeDis's sources of information: posts, friendship requests, and friendship status

The Keys to Decidable HyperLTL Satisfiability: Small Models or Very Simple Formulas

HyperLTL, the extension of Linear Temporal Logic by trace quantifiers, is a uniform framework for expressing information flow policies by relating multiple traces of a security-critical system. HyperLTL has been successfully applied to express fundamental security policies like noninterference and observational determinism, but has also found applications beyond security, e.g., distributed protocols and coding theory. However, HyperLTL satisfiability is undecidable as soon as there are existential quantifiers in the scope of a universal one. To overcome this severe limitation to applicability, we investigate here restricted variants of the satisfiability problem to pinpoint the decidability border. First, we restrict the space of admissible models and show decidability when restricting the search space to models of bounded size or to finitely representable ones. Second, we consider formulas with restricted nesting of temporal operators and show that nesting depth one yields decidability for a slightly larger class of quantifier prefixes. We provide tight complexity bounds in almost all cases