Hybrid Information Flow Analysis for Programs with Arrays

Information flow analysis checks whether certain pieces of (confidential) data may affect the results of computations in unwanted ways and thus leak information. Dynamic information flow analysis adds instrumentation code to the target software to track flows at run time and raise alarms if a flow policy is violated; hybrid analyses combine this with preliminary static analysis. Using a subset of C as the target language, we extend previous work on hybrid information flow analysis that handled pointers to scalars. Our extended formulation handles arrays, pointers to array elements, and pointer arithmetic. Information flow through arrays of pointers is tracked precisely while arrays of non-pointer types are summarized efficiently. A prototype of our approach is implemented using the Frama-C program analysis and transformation framework. Work on a full machine-checked proof of the correctness of our approach using Isabelle/HOL is well underway; we present the existing parts and sketch the rest of the correctness argument.Comment: In Proceedings VPT 2016, arXiv:1607.0183

Spot the Difference: Secure Multi-Execution and Multiple Facets

International audienceWe propose a rigorous comparison of two widely known dynamic information flow mechanisms: Secure Multi-Execution (SME) and Multiple Facets (MF). Informally, it is believed that MF simulates SME while providing better performance. Formally, it is well known that SME has stronger soundness guarantees than MF. Surprisingly, we discover that even if we approach them to enforce the same soundness guarantees, they are still different. While modeling them in the same language, we are able to precisely identify the features of the semantics that lead to their differences. In the process of comparing them, we also discovered four new mechanisms that share features of MF and SME. We prove that one of them simulates SME, which was falsely believed to be true for MF

Value-Sensitive Hybrid Information Flow Control for a JavaScript-Like Language

Abstract—Secure integration of third-party code is one of the prime challenges for securing today’s web. Recent empirical studies give evidence of pervasive reliance on and excessive trust in third-party JavaScript, with no adequate security mechanism to limit the trust or the extent of its abuse. Information flow control is a promising approach for controlling the behavior of third-party code and enforcing confidentiality and integrity policies. While much progress has been made on static and dynamic approaches to information flow control, only recently their combinations have received attention. Purely static analysis falls short of addressing dynamic language features such as dynamic objects and dynamic code evaluation, while purely dynamic analysis suffers from inability to predict side effects in non-performed executions. This paper develops a value-sensitive hybrid mechanism for tracking information flow in a JavaScript-like language. The mechanism consists of a dynamic monitor empowered to invoke a static component on the fly. This enables us to achieve a sound yet permissive enforcement. We establish formal soundness results with respect to the security policy of noninterference. In addition, we demonstrate permissiveness by proving that we subsume the precision of purely static analysis and by presenting a collection of common programming patterns that indicate that our mechanism has potential to provide more permissiveness than dynamic mechanisms in practice. I

A Survey of Challenges for Runtime Verification from Advanced Application Domains (Beyond Software)

Runtime verification is an area of formal methods that studies the dynamic analysis of execution traces against formal specifications. Typically, the two main activities in runtime verification efforts are the process of creating monitors from specifications, and the algorithms for the evaluation of traces against the generated monitors. Other activities involve the instrumentation of the system to generate the trace and the communication between the system under analysis and the monitor. Most of the applications in runtime verification have been focused on the dynamic analysis of software, even though there are many more potential applications to other computational devices and target systems. In this paper we present a collection of challenges for runtime verification extracted from concrete application domains, focusing on the difficulties that must be overcome to tackle these specific challenges. The computational models that characterize these domains require to devise new techniques beyond the current state of the art in runtime verification

Practical dynamic information flow control

Over the years, computer systems and applications have grown significantly complex while handling a plethora of private and sensitive user information. The complexity of these applications is often assisted by a set of (un)intentional bugs with both malicious and non-malicious intent leading to information leaks. Information flow control has been studied extensively as an approach to mitigate such information leaks. The technique works by enforcing the security property of non-interference using a specified set of security policies. A vast majority of existing work in this area is based on static analyses. However, some of the applications, especially on the Web, are developed using dynamic languages like JavaScript that make the static analyses techniques stale and ineffective. As a result, there has been a growing interest in recent years to develop dynamic information flow analysis techniques. In spite of the advances in the field, dynamic information flow analysis has not been at the helm of information flow security in dynamic settings like the Web; the prime reason being that the analysis techniques and the security property related to them (non-interference) either over-approximate or are too restrictive in most cases. Concretely, the analysis techniques gen- erate a lot of false positives, do not allow legitimate release of sensitive information, support only static and rigid security policies or are not general enough to be applied to real-world applications. This thesis focuses on improving the usability of dynamic information flow techniques by presenting mechanisms that can enhance the precision and permissiveness of the analyses. It begins by presenting a sound improvement and enhancement of the permissive-upgrade strategy, a strategy widely used to enforce dynamic information flow control, which improves the strategy’s permissiveness and makes it generic in applicability. The thesis, then, presents a sound and precise control scope analysis for handling complex features like unstructured control flow and exceptions in higher-order languages. Although non-interference is a desired property for enforcing information flow control, there are program instances that require legitimate release of some parts of the secret data to provide the required functionality. Towards this end, this thesis develops a sound approach to bound information leaks dynamically while allowing information release in accordance to a pre-specified budget. The thesis concludes by applying these techniques to an information flow control-enabled Web browser and explores a policy specification mechanism that allows flexible and useful information flow policies to be specified for Web applications.Seit Jahren werden Computersysteme und -Anwendungen immer komplexer und verarbeiten eine Unmenge private und sensible Daten. Die Komplexität der Anwendungen trägt neben der Existenz von (un)gewollt eingefügten Software Fehlern zur Weitergabe dieser sensiblen Informationen bei. Information Flow Control (IFC, zu Deutsch Informations-Fluss-Analyse) Mechanismen sind Gegenstand intensiver Forschung um diesem Problem entgegen zu wirken. Grundsätzlich basieren diese Ansätze auf der Anwendung von vordefinierten Sicherheitsregeln, die die Unbeeinflussbarkeit (engl. non-interference) garantieren. Der überwiegende Teil dieser Techniken nutzt statische Analyse zur Erzeugung der Regeln. Dem gegenüber steht die Tatsache, dass Anwendun- gen, insbesondere im Bereich Web-Anwendungen, in dynamischen Sprachen wie JavaScript entwickelt werden, wodurch rein statische Analysen unzureichend sind. Dynamische Methoden auf der anderen Seite approximieren das Verhalten einer Anwendung und können daher die grundlegende non-interference nicht garantieren. Sie tendieren dazu besonders restriktive Regeln zu erzeugen, wodurch auch der rechtmäßige Zugriff auf Information verweigert wird. Beide Ansätze sind daher nicht zur Anwendung auf Systeme in der realen Welt geeignet. Das Ziel dieser Arbeit besteht darin die Benutzbarkeit von dynamischen IFC Mechanismen zu verbessern indem Techniken entwickelt werden, die die Genauigkeit und Toleranz steigern. Die Arbeit präsentiert eine korrekte (engl. ’sound’) Erweiterung der permissive-upgrade Strategie (eine Standardstrategie für dynamische IFC), die die Toleranz der Strategie verbessert und sie weithin anwendbar macht. Darüber hinaus präsentiere ich eine neue dynamische IFC Analyse, die auch komplexe Funktionen, wie unstruktierte Kontrollflüsse und Exceptions in Hochsprachen, abbildet. Obwohl Unbeeinflussbarkeit eine wünschenswerte Eigenschaft ist, gibt es Anwendungen, die rechtmäßigen Zugang zu sensiblen Daten benötigen um ihre Funktion zu erfüllen. Um dies zu ermöglichen präsentiert diese Arbeit einen Ansatz, der die ungewollte Weitergabe von Information quantifiziert und anhand eines vordefinierten Grenzwertes freigibt. Diese Techniken wurden in einen Web-Browser integriert, welcher es erlaubt die Definition von flexiblen und nützlichen Informations-flussregeln für Web Anwendungen umzusetzen.RS3 - DF