Combining Graph-Based Information-Flow Analysis with KeY for Proving - - PowerPoint PPT Presentation

▶

Jul 19, 2023 98 likes •409 views

Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference KeY Symposium | 27.07.2016 INSTITUTE FOR APPLICATION-ORIENTED FORMAL VERIFICATION , FACULTY OF INFORMATICS KIT University of the State of Baden-Wuerttemberg

SLIDE 1

KIT – University of the State of Baden-Wuerttemberg and National Research Center of the Helmholtz Association INSTITUTE FOR APPLICATION-ORIENTED FORMAL VERIFICATION , FACULTY OF INFORMATICS

www.kit.edu

Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

KeY Symposium | 27.07.2016

SLIDE 2

Institute for Application-oriented Formal Verification, Faculty of Informatics 2 16-07-27

Agenda

Marko Kleine Büning – Deduktive Informationsfluss-Analyse anhand eines E- Voting Systems

Motivation Objective Preliminary Combined Approach Demonstration Conclusion and future work

SLIDE 3

Institute for Application-oriented Formal Verification, Faculty of Informatics 3 16-07-27

Motivation

Current hybrid approach needs high degree of user interaction Program code has to be manually modified Proving of functional properties But KeY is capable of creating information flow proofs

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

There should be a way to use KeY’s information flow capabilities in a hybrid approach.

SLIDE 4

Institute for Application-oriented Formal Verification, Faculty of Informatics 4 16-07-27

Objective

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Status Quo Objective

Two types of tools for

information flow control

Joana runs automatic but

creates false positives

KeY proofs are precise but

interactive and time-costly

Combined approach for

information flow proofs

The approach should be

automatic and precise

KeY is called for as few as

possible methods

? !

Development and implementation of an approach, that can prove non- interference for complex systems Objective: Creation of an approach that creates automatic and precise information flow proofs.

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 5

Institute for Application-oriented Formal Verification, Faculty of Informatics 5 16-07-27

Preliminary – Information Flow

Observation of an information flow No flow from secret input to public

utput

Guarantees End-to-End Security

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Source: KlUl15 Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 6

Institute for Application-oriented Formal Verification, Faculty of Informatics 6 16-07-27

Preliminary – Non-Interference

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

A variation of the secret input must not lead to a variation of the public
utput.

Non-Interference

Secure, the results of 𝑚 only depends on 𝑚

Source: SchSch12

Example:

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 7

Institute for Application-oriented Formal Verification, Faculty of Informatics 7 16-07-27

Preliminary – Non-Interference

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

A variation of the secret input must not lead to a variation of the public
utput.

Non-Interference

Source: SchSch12

Example:

Not secure, because the result of 𝑚 depends on ℎ

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 8

Institute for Application-oriented Formal Verification, Faculty of Informatics 8 16-07-27

Preliminary – Joana

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Source: Joa16 Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 9

Institute for Application-oriented Formal Verification, Faculty of Informatics 9 16-07-27

Preliminary – Joana

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Program Dependency Graph:

Source: Griff12 Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 10

Institute for Application-oriented Formal Verification, Faculty of Informatics 10 16-07-27

Preliminary – Joana

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Extension of PDG‘s are System Dependency Graphs (SDGs)

Source: Griff12 Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 11

Institute for Application-oriented Formal Verification, Faculty of Informatics 11 16-07-27

Preliminary – Joana

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Summary Edges

Additional edge between actual-in and actual-out nodes
Represent transitive flow from a parameter to a return value

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 12

Institute for Application-oriented Formal Verification, Faculty of Informatics 12 16-07-27

Preliminary – Joana

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 13

Institute for Application-oriented Formal Verification, Faculty of Informatics 13 16-07-27

Preliminary – Joana

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 14

Institute for Application-oriented Formal Verification, Faculty of Informatics 14 16-07-27

Preliminary – Joana

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 15

Institute for Application-oriented Formal Verification, Faculty of Informatics 15 16-07-27

Combined Approach

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Joana SDG

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 16

Institute for Application-oriented Formal Verification, Faculty of Informatics 16 16-07-27

Combined Approach

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Joana SDG All path from low to high Validate summary edges low high low high

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 17

Institute for Application-oriented Formal Verification, Faculty of Informatics 17 16-07-27

Combined Approach

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Joana SDG All path from low to high Validate summary edges low high low high

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

Information Flow leak

SLIDE 18

Institute for Application-oriented Formal Verification, Faculty of Informatics 18 16-07-27

Combined Approach

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Joana SDG All path from low to high Validate summary edges low high low high

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

Non-Interference guarantee

SLIDE 19

Institute for Application-oriented Formal Verification, Faculty of Informatics 19 16-07-27

Combined Approach - Distinction of cases

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

The path is interrupted if we can prove non- interference for one of the methods

Act-In Param 1 Act-Out Return 1 Act-Out Return 2 Act-In Param 2

secure mulZero Main Return

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 20

Institute for Application-oriented Formal Verification, Faculty of Informatics 20 16-07-27

Combined Approach - Distinction of cases

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

It can be that the two methods together have to be proven

Act-In Param 1 Act-Out Return 1 Act-Out Return 2 Act-In Param 2

minus plus Main Return

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 21

Institute for Application-oriented Formal Verification, Faculty of Informatics 21 16-07-27

Combined Approach - Distinction of cases

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Two methods are called independently and are both relevant to the result Non-Interference has to be proven for both methods

Act-In Param 1 Act-Out Return 1 Act-Out Return 2 Act-In Param 2

Main Return

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 22

Institute for Application-oriented Formal Verification, Faculty of Informatics 22 16-07-27

Combined Approach - Distinction of cases

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

We always try to delete summary edges bottom up

Act-In Param 1 Act-Out Return 1

Main Return

Act-In Param 1 Act-Out Return 1

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 23

Institute for Application-oriented Formal Verification, Faculty of Informatics 23 16-07-27

Combined Approach

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Theorem 1

If we can interrupt every path from source to sink in the SDG with the help of KeY, then non-interference holds for the complete program. Joana can guarantee non-interference Reason for false positives: Approximation: addition of unnecessary edges Our approach deletes some of these additional edges KeY’s non-interference property guarantees that we can delete these edges After our approach run successfully Joana guarantees that non-interference holds

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 24

Institute for Application-oriented Formal Verification, Faculty of Informatics 24 16-07-27

Demonstration

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 25

Institute for Application-oriented Formal Verification, Faculty of Informatics 25 16-07-27

Demonstration

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

1. The approach generates the corresponding .jar file 2. Joana is executed with the .jar file as input 3. The generated SDG is annotated 4. Information Flow Analysis is performed 5. Heuristic choses a summary edge to verify with KeY

p2: LOW p1: HIGH exit: LOW

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 26

Institute for Application-oriented Formal Verification, Faculty of Informatics 26 16-07-27

Demonstration

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

6. The approach generates .java and .key file

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 27

Institute for Application-oriented Formal Verification, Faculty of Informatics 27 16-07-27

Demonstration

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

7. KeY proves non-interference and returns proven 8. The same procedure is executed for the method neverIfTrue(int low, int high) 9. The approach returns that there is no information flow in the program

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 28

Institute for Application-oriented Formal Verification, Faculty of Informatics 28 16-07-27

Conclusion

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

The Combined Approach runs automatic and guarantees non- interference The number of calls of KeY depends strongly on the heuristic that choses the order of summary edges In the worst case the main method has to be proven with KeY

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 29

Institute for Application-oriented Formal Verification, Faculty of Informatics 29 16-07-27

Future Work

Marko Kleine Büning - Combining Graph-Based Information-Flow Analysis with KeY for Proving Non-Interference

Decreasing the sufficient set of methods Optimization of the approach to minimize time- and user-effort: Creation of information flow based loop-invariants Extraction of context information from Joana to KeY Evaluation of the approach

Objective Demonstration Preliminary Conclusion Motivation Combined Approach

SLIDE 30

Institute for Application-oriented Formal Verification, Faculty of Informatics 30 16-07-27

Quellen

[KlUl15] V. Klebanov, M. Ulbrich. Applications of Formal Verification - Verification of Information Flow Properties, KIT – Institut für Theoretische Informatik, Vorlesungsfolien, Sommersemester 2015. [SaMy03] A. Sabelfeld, A. C. Myers. Language-Based Information-Flow Security, IEEE Journal on selected aread in communications, vol. 21, no. 1, Januar 2003 [Sch15] P. H. Schmitt. Formale Systeme, KIT – Institut für Theoretische Informatik, Vorlesungsskript Winter 2013/2014, Version: 30. April 2015. [SchSch12] M. Demleitner. Verification of Information Flow Properties of Java Programs without Approximations, Karlsruher Institute of Technology (KIT), Springer Verlag, 2012. [Giff12] D. Giffhorn, Slicing of Concurrent Programs and its Application to Information Flow Control Karlsruher Institute of Technology (KIT), 2012. [Joa16] http://pp.ipd.kit.edu/projects/joana/, accessed: 25.07.2016

14 Marko Kleine Büning – Deduktive Informationsfluss-Analyse anhand eines E- Voting Systems