A Verified Information-Flow Architecture Arthur Azevedo de Amorim, - PowerPoint PPT Presentation

Abstract Machine IFC side-conditions symbolically represented by Refined by Symbolic-Rule Machine IFC Rules Correctly Refined by compiled to Concrete Machine Fault Handler 25

Abstract Machine IFC side-conditions symbolically represented by Refined by Symbolic-Rule Machine IFC Rules Combine hit and miss simulation lemmas Correctly Refined by compiled to Concrete Machine Fault Handler 25

Symbolic Rule T able Instruction Result Label Add LAB 1 ⊔ LAB 2 Output LAB 1 . . . . . . if the current instruction is 26

Symbolic Rule T able Instruction Result Label Add LAB 1 ⊔ LAB 2 Output LAB 1 . . . . . . label the result with 26

Symbolic Rule T able Instruction Result Label Add LAB 1 ⊔ LAB 2 Output LAB 1 . . . . . . for Add , result is as secret as operands 26

Symbolic Rule T able Instruction Result Label Add LAB 1 ⊔ LAB 2 Output LAB 1 . . . . . . for Output , use same label 26

Handler Implementation and Verification 27

Structured-Code Generators Structured programming instead of assembly programming ❼ Define structured-code generators as Coq functions ❼ Generators provide a structured language for the machine ( if , case , and , or , while , . . . ) ❼ Prove Hoare-logic rules for each generator 28

Compiling IFC Rules Write a rule table compiler in Coq ❼ Use generators as a backend ❼ Parameterized over correct implementation of lattice primitives ❼ Compose Hoare triples to show compiler correctness 29

Algorithm ❼ Fetch instruction and operand tags from faulting context ❼ Compute the result tag from this data using compiled rule table ❼ Install computed line into the cache Proven correct by composing compiler lemma with triples for the glue code 30

NI Abstract Machine IFC side- conditions Refined by symbolically represented by Symbolic-Rule Machine IFC Rules Refined by Correctly compiled to Concrete Machine Fault Handler NI 31

NI Abstract Machine IFC side- conditions Refined by symbolically represented by Preserved Symbolic-Rule Machine IFC Rules Refined by Correctly compiled to Concrete Machine Fault Handler NI 31

What Else? 32

More in the Paper Complete model includes more features ❼ Control flow and user-level procedures ❼ Block-structured memory with dynamic allocation ❼ System calls for implementing new IFC primitives ❼ Richer IFC labels (sets of principals represented as pointers to memory arrays) 33

❼ ❼ ❼ ❼ Addressed Challenges ❼ Track implicit flows 34

❼ ❼ ❼ Addressed Challenges ❼ Track implicit flows ❼ Allocation and noninterference 34

❼ ❼ Addressed Challenges ❼ Track implicit flows ❼ Allocation and noninterference ❼ Pointer values could leak secrets 34