CoCon: A Conference Management System with Verified Document - - PowerPoint PPT Presentation

▶
cocon a conference management system with verified
SMART_READER_LITE
LIVE PREVIEW

CoCon: A Conference Management System with Verified Document - - PowerPoint PPT Presentation

Mar 07, 2024 233 likes •819 views

CoCon: A Conference Management System with Verified Document Confidentiality Sudeep Kanav Peter Lammich Andrei Popescu Technische Universit at M unchen Overview What? Overview What? Implementation of CoCon, a conf. manag. sys.

slide-1
SLIDE 1

CoCon: A Conference Management System with Verified Document Confidentiality

Sudeep Kanav Peter Lammich Andrei Popescu Technische Universit¨ at M¨ unchen

slide-2
SLIDE 2

Overview

What?

slide-3
SLIDE 3

Overview

What?

  • Implementation of CoCon, a conf. manag. sys.
slide-4
SLIDE 4

Overview

What?

  • Implementation of CoCon, a conf. manag. sys.
  • Verification in Isabelle of its information flow
slide-5
SLIDE 5

Overview

What?

  • Implementation of CoCon, a conf. manag. sys.
  • Verification in Isabelle of its information flow

Why?

slide-6
SLIDE 6

Overview

What?

  • Implementation of CoCon, a conf. manag. sys.
  • Verification in Isabelle of its information flow

Why?

  • Anonymity and integrity concerns
slide-7
SLIDE 7

Why

It is our pleasure to inform you that your paper has been accepted to the IEEE Symposium of Security and Privacy (Oakland) 2012.

slide-8
SLIDE 8

Why

It is our pleasure to inform you that your paper has been accepted to the IEEE Symposium of Security and Privacy (Oakland) 2012. We are sorry to inform you that your paper was not one of those accepted for this year’s conference. We apologize for an earlier ”acceptance” notification. It was due to a system error.

slide-9
SLIDE 9

Why

It is our pleasure to inform you that your paper has been accepted to the IEEE Symposium of Security and Privacy (Oakland) 2012. We are sorry to inform you that your paper was not one of those accepted for this year’s conference. We apologize for an earlier ”acceptance” notification. It was due to a system error.

slide-10
SLIDE 10

Overview

What?

  • Implementation of CoCon, a conf. manag. sys.
  • Verification in Isabelle of its information flow

Why?

  • Anonymity and integrity concerns
slide-11
SLIDE 11

Overview

What?

  • Implementation of CoCon, a conf. manag. sys.
  • Verification in Isabelle of its information flow

Why?

  • Anonymity and integrity concerns
  • System with complex information flow
slide-12
SLIDE 12

Overview

What?

  • Implementation of CoCon, a conf. manag. sys.
  • Verification in Isabelle of its information flow

Why?

  • Anonymity and integrity concerns
  • System with complex information flow
  • Knowledge on how to approach similar systems
slide-13
SLIDE 13

CoCon’s Architecture

Web Application REST Web Service Scala Program Isabelle Specification code generation

slide-14
SLIDE 14

CoCon’s Architecture

Web Application REST Web Service Scala Program Isabelle Specification code generation

http://vmnipkow1.informatik.tu-muenchen.de Used it for Isabelle 2014 Workshop

slide-15
SLIDE 15

System Specification

Multi-user, multi-conference system

  • Users:

ID and password

  • State:

papers, authors, reviews, discussions, notifications, . . .

  • Actions:

register paper, upload new version, bid on papers (if committee), assign reviewer (if chair), . . .

  • Outputs:

download paper, read review, list committee members, . . .

slide-16
SLIDE 16

End Product of System Specification

step : state → act → out × state

slide-17
SLIDE 17

Verified Confidentiality Properties

What, when, by whom

slide-18
SLIDE 18

Verified Confidentiality Properties

What, when, by whom can be learned about

slide-19
SLIDE 19

Verified Confidentiality Properties

What, when, by whom can be learned about the documents in the system (papers, reviews, discussions, preferences)

slide-20
SLIDE 20

Source Declassification Trigger Declassification Bound Paper Content Paper Authorship Last Uploaded Version Paper Authorship or PC MembershipB Nothing Review Review Authorship Last Edited Version Before Discussion and All the Later Versions Review Authorship or Non-Conflict PC MembershipD Last Edited Version Before Notification Review Authorship or Non-Conflict PC MembershipD or PC MembershipN or Paper AuthorshipN Nothing Discussion Non-Conflict PC Membership Nothing Decision Non-Conflict PC Membership Last Edited Version Non-Conflict PC Membership or PC MembershipN or Paper AuthorshipN Nothing Reviewer Assignment to Paper Non-Conflict PC MembershipR Non-Conflict PC Membership

  • f Reviewers and

Number of Reviewers Non-Conflict PC MembershipR or Paper AuthorshipN Non-Conflict PC Membership

  • f Reviewers

Phase Stamps: B = Bidding, D = Discussion, N = Notification, R = Review

slide-21
SLIDE 21

Source Declassification Trigger Declassification Bound Paper Content Paper Authorship Last Uploaded Version Paper Authorship or PC MembershipB Nothing Review Review Authorship Last Edited Version Before Discussion and All the Later Versions Review Authorship or Non-Conflict PC MembershipD Last Edited Version Before Notification Review Authorship or Non-Conflict PC MembershipD or PC MembershipN or Paper AuthorshipN Nothing Discussion Non-Conflict PC Membership Nothing Decision Non-Conflict PC Membership Last Edited Version Non-Conflict PC Membership or PC MembershipN or Paper AuthorshipN Nothing Reviewer Assignment to Paper Non-Conflict PC MembershipR Non-Conflict PC Membership

  • f Reviewers and

Number of Reviewers Non-Conflict PC MembershipR or Paper AuthorshipN Non-Conflict PC Membership

  • f Reviewers

Phase Stamps: B = Bidding, D = Discussion, N = Notification, R = Review

slide-22
SLIDE 22

Source Declassification Trigger Declassification Bound Paper Content Paper Authorship Last Uploaded Version Paper Authorship or PC MembershipB Nothing Review Review Authorship Last Edited Version Before Discussion and All the Later Versions Review Authorship or Non-Conflict PC MembershipD Last Edited Version Before Notification Review Authorship or Non-Conflict PC MembershipD or PC MembershipN or Paper AuthorshipN Nothing Discussion Non-Conflict PC Membership Nothing Decision Non-Conflict PC Membership Last Edited Version Non-Conflict PC Membership or PC MembershipN or Paper AuthorshipN Nothing Reviewer Assignment to Paper Non-Conflict PC MembershipR Non-Conflict PC Membership

  • f Reviewers and

Number of Reviewers Non-Conflict PC MembershipR or Paper AuthorshipN Non-Conflict PC Membership

  • f Reviewers

Phase Stamps: B = Bidding, D = Discussion, N = Notification, R = Review

slide-23
SLIDE 23

Source Declassification Trigger Declassification Bound Paper Content Paper Authorship Last Uploaded Version Paper Authorship or PC MembershipB Nothing Review Review Authorship Last Edited Version Before Discussion and All the Later Versions Review Authorship or Non-Conflict PC MembershipD Last Edited Version Before Notification Review Authorship or Non-Conflict PC MembershipD or PC MembershipN or Paper AuthorshipN Nothing Discussion Non-Conflict PC Membership Nothing Decision Non-Conflict PC Membership Last Edited Version Non-Conflict PC Membership or PC MembershipN or Paper AuthorshipN Nothing Reviewer Assignment to Paper Non-Conflict PC MembershipR Non-Conflict PC Membership

  • f Reviewers and

Number of Reviewers Non-Conflict PC MembershipR or Paper AuthorshipN Non-Conflict PC Membership

  • f Reviewers

Phase Stamps: B = Bidding, D = Discussion, N = Notification, R = Review

slide-24
SLIDE 24

Source Declassification Trigger Declassification Bound Paper Content Paper Authorship Last Uploaded Version Paper Authorship or PC MembershipB Nothing Review Review Authorship Last Edited Version Before Discussion and All the Later Versions Review Authorship or Non-Conflict PC MembershipD Last Edited Version Before Notification Review Authorship or Non-Conflict PC MembershipD or PC MembershipN or Paper AuthorshipN Nothing Discussion Non-Conflict PC Membership Nothing Decision Non-Conflict PC Membership Last Edited Version Non-Conflict PC Membership or PC MembershipN or Paper AuthorshipN Nothing Reviewer Assignment to Paper Non-Conflict PC MembershipR Non-Conflict PC Membership

  • f Reviewers and

Number of Reviewers Non-Conflict PC MembershipR or Paper AuthorshipN Non-Conflict PC Membership

  • f Reviewers

Phase Stamps: B = Bidding, D = Discussion, N = Notification, R = Review

slide-25
SLIDE 25

Source Declassification Trigger Declassification Bound Paper Content Paper Authorship Last Uploaded Version Paper Authorship or PC MembershipB Nothing Review Review Authorship Last Edited Version Before Discussion and All the Later Versions Review Authorship or Non-Conflict PC MembershipD Last Edited Version Before Notification Review Authorship or Non-Conflict PC MembershipD or PC MembershipN or Paper AuthorshipN Nothing Discussion Non-Conflict PC Membership Nothing Decision Non-Conflict PC Membership Last Edited Version Non-Conflict PC Membership or PC MembershipN or Paper AuthorshipN Nothing Reviewer Assignment to Paper Non-Conflict PC MembershipR Non-Conflict PC Membership

  • f Reviewers and

Number of Reviewers Non-Conflict PC MembershipR or Paper AuthorshipN Non-Conflict PC Membership

  • f Reviewers

Phase Stamps: B = Bidding, D = Discussion, N = Notification, R = Review

slide-26
SLIDE 26

Bounded-Deducibility Security

ϕ : Event → Bool f : Event → Val V = ”filter with ϕ, then apply f, event-wise” List(Event) Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val)

slide-27
SLIDE 27

Bounded-Deducibility Security

ϕ : Event → Bool f : Event → Val V = ”filter with ϕ, then apply f, event-wise” List(Event) Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) V

slide-28
SLIDE 28

Bounded-Deducibility Security

γ : Event → Bool g : Event → Obs E = ”filter with γ, then apply g, event-wise” List(Event) Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) E V

slide-29
SLIDE 29

Bounded-Deducibility Security

T : Event → Bool B relation on List(Val) Unless T occurs, E can learn nothing about V beyond B List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) E V

slide-30
SLIDE 30

Bounded-Deducibility Security

T : Event → Bool B relation on List(Val) Unless T occurs, E can learn nothing about V beyond B List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

slide-31
SLIDE 31

Bounded-Deducibility Security

Bounded-Deducibility Security Unless T occurs, E can learn nothing about V beyond B List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

slide-32
SLIDE 32

Bounded-Deducibility Security

Bounded-Deducibility Security Unless T occurs, E can learn nothing about V beyond B List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

slide-33
SLIDE 33

Bounded-Deducibility Security

Bounded-Deducibility Security Unless T occurs, E can learn nothing about V beyond B List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

slide-34
SLIDE 34

Bounded-Deducibility Security

Bounded-Deducibility Security Unless T occurs, E can learn nothing about V beyond B List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • v

v v

slide-35
SLIDE 35

Bounded-Deducibility Security

Bounded-Deducibility Security Unless T occurs, E can learn nothing about V beyond B List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • v

v v v v

slide-36
SLIDE 36

Bounded-Deducibility Security

Bounded-Deducibility Security Unless T occurs, E can learn nothing about V beyond B List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • v

v v B v v

slide-37
SLIDE 37

Bounded-Deducibility Security

Bounded-Deducibility Security Unless T occurs, E can learn nothing about V beyond B List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • v

v v B v v

slide-38
SLIDE 38

Bounded-Deducibility Security

Bounded-Deducibility Security Unless T occurs, E can learn nothing about V beyond B List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • v

v v B v v

slide-39
SLIDE 39

Bounded-Deducibility Security

Proof by unwinding

  • E = ”filter with ϕ, then apply f, event-wise”

List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • v

v v B v v

slide-40
SLIDE 40

Bounded-Deducibility Security

Proof by unwinding

  • Action/ Reaction: Match

List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • ✁

❆ v v v B v v

slide-41
SLIDE 41

Bounded-Deducibility Security

Proof by unwinding

  • Action / Reaction: Match

List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • ✁

❆ v ✁ ❆ v v B v v

slide-42
SLIDE 42

Bounded-Deducibility Security

Proof by unwinding

  • Action / Reaction: Ignore

List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • ✁

❆ v ✁ ❆ v ✁ ❆ v B v v

slide-43
SLIDE 43

Bounded-Deducibility Security

Proof by unwinding

  • Action / Reaction: Ignorebl

List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • ✁

❆ v ✁ ❆ v ✁ ❆ v B v v

slide-44
SLIDE 44

Bounded-Deducibility Security

Proof by unwinding

  • Action / Reaction: Match

List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • ✁

❆ v ✁ ❆ v ✁ ❆ v B v ✁ ❆ v

slide-45
SLIDE 45

Bounded-Deducibility Security

Proof by unwinding

  • Action / Reaction: Match

List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • ✁

❆ v ✁ ❆ v ✁ ❆ v B v ✁ ❆ v

slide-46
SLIDE 46

Bounded-Deducibility Security

Proof by unwinding

  • Independent action . . .

List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • ✁

❆ v ✁ ❆ v ✁ ❆ v B v ✁ ❆ v

slide-47
SLIDE 47

Bounded-Deducibility Security

Proof by unwinding

  • Independent action . . .

List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • ✁

❆ v ✁ ❆ v ✁ ❆ v B ✁ ❆ v ✁ ❆ v

slide-48
SLIDE 48

Bounded-Deducibility Security

Proof by unwinding

  • Independent action . . .

List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • ✁

❆ v ✁ ❆ v ✁ ❆ v B ✁ ❆ v ✁ ❆ v

slide-49
SLIDE 49

Bounded-Deducibility Security

Proof by unwinding

  • B → ∆ ⊆ State × List(Val) × State × List(Val)

List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • ✁

❆ v ✁ ❆ v ✁ ❆ v B ✁ ❆ v ✁ ❆ v

slide-50
SLIDE 50

Bounded-Deducibility Security

Proof by unwinding

  • B → ∆ ⊆ State × List(Val) × State × List(Val)

List(Event) T Nothing Nothing Nothing List(Obs) Nothing Nothing Nothing List(Val) B E V

  • ✁

❆ v ✁ ❆ v ✁ ❆ v B ✁ ❆ v ✁ ❆ v

slide-51
SLIDE 51

Proof by Unwinding

slide-52
SLIDE 52

Proof by Unwinding

∆ ⊆ State × List(Val) × State × List(Val)

slide-53
SLIDE 53

Proof by Unwinding

∆ ⊆ State × List(Val) × State × List(Val) + Strategy for: when to act independently when to react if react: when to match and when to ignore

slide-54
SLIDE 54

Summary

  • Generic parameterized security notion
  • Associated unwinding proof method
  • Instantiated to reason about CoCon’s

confidentiality

slide-55
SLIDE 55

Future Work – More Holistic Verification

Web Application REST Web Service Scala Program Isabelle Specification code generation

slide-56
SLIDE 56

Related Work

Theoretical frameworks

  • Sutherland 1986: Nondeducibility
  • Mantel 2000: MAKS framework
  • Halpern and ONeill, 2008: Secrecy in

multiagent systems

  • Dimitrova et. al. 2012, Clarkson et. al 2014:

Temporal Logics for Information Flow Mechanical verification

  • Arapinis et. al. 2012: ConfiChair
  • de Amorim et. al. 2014: A Verified Information

Flow Architecture

slide-57
SLIDE 57

Thank You

Organizing a verification-friendly workshop? Please consider using CoCon. CoCon’s website: www4.in.tum.de/~popescua/rs3/GNE.html