A Derivation Framework for Dependent Security Label Inference - - PowerPoint PPT Presentation

A Derivation Framework for Dependent Security Label Inference

Peixuan Li and Danfeng Zhang

Pennsylvania State University

University Park, PA, 16801 {pzl129, zhang}@cse.psu.edu

Background

• Information Flow Analysis
• Study: how information propagate through the system
• Goal: prevent leakage of sensitive information

2

x y z p m

temp

Background

• Information Flow Analysis

Ø Annotate the program with security labels Ø Track and validate flows in program § Explicit Flow § Implicit Flow

3

Program (secure) Security Specifications

𝑦, 𝑧, 𝑨 : ???

Program Annotation

• Annotation Burden

§ Time-consuming and error-prone § Requiring good knowledge of implementation details § Hard to distinguish incorrect label from false-positive

4

Security Label Inference

• Goal: to infer the security labels
• Lattice Labels [Denning 1976]
• Rehof-Mogensen Algorithm [Rehof et al. 1999]
• Implemented in Jif [Myers et al. 2006]

5

S P

classified, untrusted public, trusted classified, trusted public, untrusted

v Expressiveness

• Security levels are unknown in static time [Chen et al. 2018; Li and Zhang 2017]
• Security levels are not fixed during execution [Murray et al 2016; Lourenço and Caires 2015; Zhang et al. 2015; ]

v Precision

• Limited to path-insensitive analyses [Li and Zhang 2017; Zhang et al. 2015]

Dependent Security Labels

• Dependent Label: labels that may depend on concrete program states
• Ternary Labels [Li and Zhang 2017]:
• Predicate Labels [Murray et al. 2016, Polikarpova et al.2018]:
• Permission Labels [Chen et al. 2018]:
• Dynamic Labels [Myers et al. 2006]:

6

• Inference Engines
• Liquid Type [Rondon et al. 2008]
• SMT Solver
• Permission Label Inference[Chen et al. 2018]

𝑚 ∶ 𝑀𝑏𝑐𝑓𝑚; 𝑦 ∶ 𝑚 ; Ø Limited to two-point Lattice Ø Exponential

Inference Engines

Overview

• Goal: to efficiently infer the dependent security labels

7

Dependent Security Labels

• Ternary label
• Predicate as Labels
• Permission Predicates
• Dynamic Labels

Core Constraint Language Derivation Framework One-Shot Early-Accept Early-Reject Hybrid

Evaluation

Program (secure)

Core Constraint Language

• Syntax

8

𝑦, 𝑧, 𝑨 : ???

Security Specifications

Any decidable predicates

Encoding details are in the paper…

Inference Engines

Overview

• Goal: to efficiently infer the dependent security labels

9

Dependent Security Labels

• Ternary label
• Predicate as Labels
• Permission Predicates
• Dynamic Labels

Core Constraint Language Derivation Framework One-Shot Early-Accept Early-Reject Hybrid

Evaluation

Derivation Framework

• Insights: deriving constraints into a more manageable format.

10

Constraints (satisfiable)

Ideal constraint format: 𝛽.: S; 𝛽1: P;

𝑒 > 0 : 𝑒 ≤ 0 :

𝛽.: P; 𝛽1: P; 𝛽.: 𝑒 > 0 ? S ∶ P 𝛽1: P

• 1. Partition

v No overlapping predicates ⟹ Construct a global solution by merging local solutions

• 2. Derive

Derivation Framework

• Partitioning
• Non-overlapping predicates
• Derivations

Ø Sound Derivation: § solutions on sound-derivation always work for original constraints. Ø Complete Derivation: § solutions on original constraints always work for complete-derivations. Ø Equivalent Derivation

11

ü Solution Preserved ü Counter-example Preserved

Sound Derivation

• Solution from Sound-Derivations always work for original constraints.

12

Constraints (satisfiable)

Derivation 1: (sound):

Projected 𝐷:;<=> = ⋀(𝐷;BCDC=EF ), if ∃ 𝑄

;BCDC=EF ∧ 𝑄 :;<=>

v A sound derivation can be generated by:

Projected

Complete Derivation

• Counter-examples on Complete-Derivation always exist for original constraints

13

Derivation 1: (complete):

Constraints (unsatisfiable) 𝐷K;LMFNON = ⋀(𝐷;BCDC=EF ), if ∀ 𝑄

K;LMFNON ⟹ 𝑄 ;BCDC=EF

v A complete derivation can be generated by: Inferred Inferred

Equivalent Derivation

• Equivalent Derivation

14

Constraints (satisfiable)

Sound / Complete Derivation:

Refined

⟺

𝐷:;<=> = ⋀(𝐷;BCDC=EF ), if ∃ 𝑄

;BCDC=EF ∧ 𝑄 :;<=>

Projected 𝐷K;LMFNON = ⋀(𝐷;BCDC=EF ), if ∀ 𝑄

K;LMFNON ⟹ 𝑄 ;BCDC=EF

Inferred

P1 P2 P

Refined

Inference Engines

Overview

• Goal: to efficiently infer the dependent security labels

15

Dependent Security Labels

• Ternary label
• Predicate as Labels
• Permission Predicates
• Dynamic Labels

Core Constraint Language Derivation Framework One-Shot Early-Accept Early-Reject Hybrid

Evaluation

Inference Algorithms

• One-Shot:
• Equivalent Derivation
• Derived constraint number grows exponentially with the number of predicates

16

𝑄

R

¬𝑄

R

𝑄

T

¬𝑄

T

𝑄

U

¬𝑄

U

𝑄

R V → 𝐷R V

𝑄

U V → 𝐷U V

𝑄

T V → 𝐷T V

𝑄

X V → 𝐷X V

𝑄

Y V → 𝐷Y V

𝑄

Z V → 𝐷Z V

𝑄

[ V → 𝐷[ V

𝑄

\ V → 𝐷\ V

Arbitrary Constraints 𝑄

R → 𝐷R

𝑄

T → 𝐷T

𝑄

U → 𝐷U

Refined

Inference Algorithms

• Early-Accept: Sound Derivation
• Early-Reject: Complete Derivation

17

𝑄

R

¬𝑄

R

𝑄

U

¬𝑄

U

𝑄

U V] → 𝐷U V]

𝑄

R V^ → 𝐷R V^

𝑄

U V^ → 𝐷U V^

Sat Sat Sat Arbitrary Constraints 𝑄

R → 𝐷R

𝑄

T → 𝐷T

𝑄

U → 𝐷U

…

Inference Algorithms

• Hybrid

18

𝑄

R

¬𝑄

R

𝑄

U

¬𝑄

U

𝑄

U V] → 𝐷:U V]

𝑄

R V^ → 𝐷:R V^

𝑄

U V^ → 𝐷:U V^

𝑄

U V^ → 𝐷KU V^

Arbitrary Constraints 𝑄

R → 𝐷R

𝑄

T → 𝐷T

𝑄

U → 𝐷U

… Sat Sat UnSat UnSat

Evaluations

• Benchmark

Ø Verified MIPS Processor § 1719 lines of Verilog Code, 2455 variables totally Ø Mutate the annotations § 1509 variables unlabeled by randomly removing annotated labels § 14 errors are injected by modifying annotations Ø SecVerilog [Zhang et al. 2015] compiler to generate constraints Ø 100 test files: § 82 involves dependent labels

19

Evaluations

20

10-5 10-4 10-3 10-2 10-1 100 101 102 1 10 100

30 19 3

Time Out Execution Time (in seconds)

OneShot EarlyAccept Hybrid

v Overall Performance: Hybrid > Early-Accept > One-Shot v Scalability: Hybrid > Early-Accept > One-Shot v Time-out: Hybrid < Early-Accept < One-Shot

Number of predicates

Inference Engines

Conclusions

• Goal: to efficiently infer the dependent security labels

21

Dependent Security Labels

• Ternary label
• Predicate as Labels
• Permission Predicates
• Dynamic Labels

Core Constraint Language Derivation Framework One-Shot Early-Accept Early-Reject Hybrid

Evaluation

THANKS!

Any questions?