An introduction of Slalom project: motivation, plans and some result

Ngo, Minh Tri

English

University of Twente Research Information

Verification of Confidentiality ofMulti-threaded ProgramsNgo Minh TriUniversity of TwenteFormal Methods and Tools Grouptringominh@gmail.com1 Introduction1.1 General description of the projectThe goal of SlaLoM (Security by Logic for Multi-threaded Applications) project1 is thedevelopment of a verification framework for the protection of data. Typical securityproperties relevant to the protection of data are confidentiality, integrity and avail-ability. Confidentiality means that no private information can be derived from publicdata. Program’s integrity is defined as the independence of the value of trusted dataon untrusted sources. Availability means that an output of a program will be producedeventually.The key idea on which this project is based is the notion of self-composition. Self-composition means that we compose an application (program) with itself, i.e. we exe-cute a program and its copy in parallel, in such a way that the original two programsstill can be distinguished. We rephrase the security requirements as temporal logicproperties over a single execution of this self-composed program. This allows the useof standard program verification techniques, which have the advantage that the verifi-cation is both automatic and precise.1.2 Confidentiality of multi-threaded programsIn the first part of this project, we investigate confidentiality. Different definitionsexist to capture confidentiality such as observational determinism (a generalization ofclassical noninterference) and probabilistic noninterference.Classical noninterference [2] expresses that a program is considered secure whenevervarying the initial values of confidential (high) variables cannot change its publiclyobservable output behavior2. For example, suppose h ∈ H and l ∈ L are high and lowvariables, respectively. The program: ‘if h = 1 then l := 1 else l := 0’ is not securebecause the value of the low variable depends on the value of the high variable. This isan example of an indirect information flow from the initial value of h to the final valueof l.The definition of noninterference only considers the input and output of a pro-gram. However, for concurrent and reactive systems, intermediate configurations canbe observed, therefore it is necessary to also look at the intermediate states of theprogram, and to require that the private data are never revealed. Observational deter-minism is a generalized notion of noninterference that is defined over execution traces.Observational determinism defines that a multi-threaded program is secure when itspublicly observable traces are independent of its confidential data and independent ofthe scheduler policy.The definition of observational determinism only considers non-probabilistic sched-ulers. A non-probabilistic scheduler chooses which thread to execute next with the same1 SlaLoM is funded by NWO and started in March 2010.2 For simplicity, we consider a simple two-point security lattice, where the data is divided into private (highlevel) H and public (low level) L data1probability. When a scheduler’s behavior is probabilistic, some threads will be executedmore often than the other ones. This opens up the possibility of a probabilistic attackas in the following example.h := h mod 2;(l := h | 12(l := 0 | 12l := 1));Here, C1 |p C2 means that the probability of the next transition corresponding to atransition of C1 is p. The value of p is determined by the scheduler. Again, h is a privatevariable, while l is a public (observable) variable. After executing h := h mod 2, thevalue of h will be either 0 or 1. For example, the initial value of h is 3, then afterexecuting the command h := h mod 2, h = 1. If the attacker executes this programoften enough, such as 100 times, he will get 100 values of l in which approximate 75values are 1. Therefore, the final value of l in this program will reveal information abouth with a probability of 34.In order to cope with this kind of attack, different theories of probabilistic non-interference are discussed [7, 5]. In particular, Sabelfeld and Sands [5] developed aprobabilistic noninterference criterion based on a partial probabilistic low bisimulationwhich is an adaptation of Larsen and Skou’s notion of probabilistic bisimulation [4].The rest of this report is organized as follows. Section 2 introduces the formaldefinition of observational determinism and investigates its properties while section3 discusses probabilistic noninterference and proposes a way to characterize partialprobabilistic low bisimulation. Section 4 presents our plans for future work.2 Observational Determinism2.1 DefinitionFirst, we let Config denote the set of configurations. A configuration c = 〈C, s〉 consistsof a program C ∈ Com and a store s ∈ St where Com is the set of programs andSt is the set of stores. A store is a finite mapping from variables to values. We definelow-equivalence s1 =L s2 iff the low components of s1 and s2 are the same. Givenconfiguration 〈C, s〉, an infinite list of configurations T = c0, c1, c2, ... is a programtrace of 〈C, s〉, denoted 〈C, s〉 ⇓ T , iff c0 = 〈C, s〉 and ∀i ∈ N.ci → ci+1. We use T |s todenote the projection of a program trace to the store. T |L denotes the low store tracewhich is the projection of T |s to all variable locations in the set of low variables L.According to Terauchi [6], a program is observationally deterministic iff given anytwo initial low equivalent stores s1 and s2, any two low traces are equivalent uptostuttering and prefixing. Two traces T 1 and T 2 are stuttering equivalent if we canpartition T 1 and T 2 into blocks of states, such that the states in the kth block of T 1 arelabelled the same as the states in the kth block of T 2. Two states are labelled the sameiff the values of low variables in two stores are the same. Corresponding blocks mayhave different lengths. T 1 and T 2 are equivalent upto stuttering and prefixing if thereis a prefix of one trace that is stuttering equivalent to the other trace. Given two tracesT 1 and T 2, we write T 1 ≈ T 2 if T 1 and T 2 are stuttering and prefixing equivalent.Definition 1. Observational Determinism:A program C is observationally deterministic w.r.t. L iff for all stores s1, s2 suchthat s1 =L s2, and for all traces T1 and T 2,〈C, s1〉 ⇓ T 1 ∧ 〈C, s2〉 ⇓ T 2 ⇒ T 1|L ≈ T 2|L.22.2 CharacterizationNow, we investigate the properties of observational determinism and characterize themby temporal logic formulas. The low store trace is denoted by a sequence of low storeswhich are the set of the values of the low variables. Suppose that we let symbolsa,b, c, ... represent low stores in low store traces. Low stores with the same values oflow variables are indistinguishable; therefore, they will be represented by the samesymbol, e.g. in low store trace cc, the program just manipulates high variables and thevalues of the low variables remain unchanged. Given T 1|L = aabbbbbbbcddefffgh · · ·and T 2|L = aaaabcdef , which start from two low equivalent stores, they are equivalentupto stuttering and prefixing.From these two low store traces, we can observe the following property which shouldbe expressed by the temporal logic formula:a. If there is a value change in low variables and this change occurs first in trace Tm(m = 1, 2), i.e. at the index i1, then in trace T3−m, at the states T 3−mi with theindex i ≥ i1, the total number of value changes counted from the first state is strictlysmaller than the total number of value changes at the states Tmi . This propositionholds until the same value change occurs in trace T 3−m.We also need an extra property called mutual fairness condition:b. Mutual fairness condition: It cannot be the case that from some point on trace T 1(T 2), the program has a possible next state in which it changes the values of thelow variables, while the program in trace T 2 (T 1) never changes the values of lowvariables.We need this extra property because of a need to reject a program like this:if (h) then l := 7 else while (true);Suppose we execute this program with the initial store s1 where the private variableh = true. We obtain a trace T 1 where the initial low store will change followingthe execution of the command l := 7, i.e. T 1|L = ab. However, when we execute thisprogram with another initial low equivalent store s2 where h = false, we obtain anothertrace, T 2, where the initial low store remains unchanged because of the infinite emptywhile loop, T 2|L = aaaa · · ·. This program is not secure because depending on whetherit finishes or goes in an infinite empty loop, the attacker knows about the sign of theinitial value of h. These two low store traces are stuttering and prefixing equivalentand thus it cannot be rejected by (a). However, it will be rejected by condition (b).Based on these two properties, we characterize observational determinism by tem-poral logic properties for which model checking algorithms exist. This allows the reuseof standard program verification techniques, thus resulting in a sound and potentiallycomplete verification technique.3 Probabilistic Noninterference3.1 DefinitionIn this section, we discuss about probabilistic noninterference. Sabelfeld and Sands de-veloped a probabilistic noninterference criterion based on a partial probabilistic bisim-ulation [5]. The aim of Sabelfeld and Sands’ paper is to describe a modification ofprobabilistic bisimulation of Larsen and Skou [4] to reflect the “equivalence” of pro-gram behavior that is visible to the attackers.Define semantics transitions from a configuration c to a set of configurations S by:c→p S ⇔ p =∑{q|c→q d, d ∈ S}.3where c→p S denotes that the sum of probabilities of all transitions from configurationc to configurations in S is precisely p.A partial equivalence relation (per) on a set A is a binary relation on A which isboth symmetric and transitive.Definition 2. Partial probabilistic low bisimulation :A per R is a partial probabilistic low bisimulation on commands iff whenever CRDthen∀s1 =L s2. 〈C, s1〉 → 〈C′, s′1〉 ⇒∃D′, s′2. 〈D, s2〉 → 〈D′, s′2, 〉∧C′RD′ ∧ s′1 =L s′2,∧∑{|p| 〈C, s1〉 →p 〈S, s〉 ,S ∈ [C′]R , s =L s′1} =∑{|p| 〈D, s2〉 →p 〈S, s〉 ,S ∈ [D′]R , s =L s′2} .where [E]R represents the R-equivalence class which contains E.We write CRD (C and D are probabilistically low-bisimilar) iff there exists a partialprobabilistic low bisimulation that relates program C to program D.Definition 3. The security specification ([5]): C is secure iff C RC.The intuition behind this definition is that a program is secure iff for any two low equiv-alent stores, two configurations containing the program and each of the stores, executein such a way that their resulting behavior is indistinguishable from the attacker’sobservation of low stores and the probability with which they occur.3.2 Characterization of partial probabilistic low bisimulationLarsen and Skou state that two states are probabilistically bisimilar only if they satisfyexactly the same Probabilistic Modal Logic (PML) formulas [4]. Therefore, we thinkthat we can use the set of PML formulas to characterize the partial probabilistic lowbisimulation. One technical problem is that Sabelfeld and Sands’ definition of partialprobabilistic low bisimulation is defined over unlabelled probabilistic transition systems(unlabelled PTS), while the definition of probabilistic bisimulation of Larsen and Skou[4] is defined over labelled probabilistic transition systems (labelled PTS) in which eachtransition is labelled by an action. Another problem is that whether low bisimulationcan be characterized by PML formulas with/without some adjustments.Therefore, first we need to show that there is a relation between unlabelled PTSand labelled PTS. We argue that in case we just consider whether the values of the lowvariables are changed or not, then the set of actions in labelled PTS can be restrictedto only two actions: an observable action indicates a change in low values and a hid-den action indicates no change in low variables. Next, we define a store memorizingtransition relation as follows:Definition 4. Store memorizing transition relation: Let →⊆ St×St be a storetransition relation. The store memorizing transition relationm→⊆ (St×St)× (St×St)is defined as(s1, t1)m→ (s2, t2) ⇔ s1 → s2 ∧ t2 = s1.where t is the additive store which is used to memorize the previous store. Thus, (s1, t1)makes a transition to (s2, t2) if s1 makes a transition to s2 in the original system, andt2 remembers the old store s1.Based on the store memorizing transition relation, we define unlabelled/labelledstore memorizing probabilistic transition systems (unlabelled/labelled SMPTS) which4are variants of unlabelled/labelled PTS. Two actions in labelled SMPTS can be charac-terized by atomic propositions in unlabelled SMPTS because at each configuration, wealso have the previous values of the low variables. Thus, the model of a program in un-labelled SMPTS is equivalent to its model in labelled SMPTS. After that, we rephrasethe partial probabilistic bisimulation on commands over an unlabelled SMPTS into anequivalent one over a labelled SMPTS. We argue that PML formulas with the set ofrestricted actions can be used to characterize partial probabilistic low bisimulation.4 Future plansWe plan to use a model checker to verify whether a multi-threaded application, i.e. aJava program, satisfies the security specifications or not. We believe that PRISM is asuitable tool. The reason is that PML is a subset of PRISM’s property specificationlanguage which incorporates Continuous Stochastic Logic (CSL) [1], and Probabilisticreal time Computation Tree Logic (PCTL) [3] temporal logics We also plan to considerhow to scale with the large applications and other security properties such as integrity,availability and anonymity.References1. J. Desharnais and P. Panangaden. Continuous stochastic logic characterizes bisimulation of continuous-time markov processes. In JLAP special issue on Probabilistic Techniques for the Design and Analysis ofSystems, volume 56 (1-2), pages 99–115, 2003.2. J. Goguen and J. Meseguer. Security policies and security model. In Proceedings of the IEEE Symposiumon Security and Privacy. IEEE Computer Society Press.3. H. Hansson and B. Jonsson. A logic for reasoning about time and realizability. In Formal Aspects ofComputing, volume 6(5), pages 512–535, 1994.4. K.G. Larsen and A. Skou. Bisimulation through probabilistic testing. In Information and Computation,volume 94(1), pages 1–28, 1992.5. A. Sabelfeld and D. Sands. Probabilistic noninterference for multi-threaded programs. In Proceedings ofIEEE Computer Security Foundations Workshop, pages 200–214, July 2000.6. T. Terauchi. A type system for observational determinism. In Computer Science Foundation (CSF 2008),2008.7. D. Volpano and G. Smith. Probabilistic noninterference in a concurrent language. In Journal of ComputerSecurity, volume 7(2-3), pages 231–253, November 1999.5

Verification of Confidentiality of Multi-threaded Programs

NARCIS 

A logic for reasoning about time and realizability.

A type system for observational determinism.

Bisimulation through probabilistic testing.

Continuous stochastic logic characterizes bisimulation of continuoustime markov processes.

Probabilistic noninterference for multi-threaded programs.

Probabilistic noninterference in a concurrent language.

Security policies and security model.

https://ris.utwente.nl/ws/files/5459225/Abstract1.pdf

Verification of Confidentiality of Multi-threaded Programs

Abstract

Similar works

Full text

Available Versions

University of Twente Research Information

NARCIS