Compositional Verification of Security Properties for Embedded - - PowerPoint PPT Presentation

▶
compositional verification of security properties for
SMART_READER_LITE
LIVE PREVIEW

Compositional Verification of Security Properties for Embedded - - PowerPoint PPT Presentation

Sep 29, 2023 251 likes •905 views

Compositional Verification of Security Properties for Embedded Execution Platforms Christoph Baumann , Oliver Schwarz , Mads Dam KTH Royal Institute of Technology, Stockholm, Sweden RISE.SICS, Kista, Sweden cbaumann@kth.se

slide-1
SLIDE 1

Compositional Verification of Security Properties for Embedded Execution Platforms

Christoph Baumann∗, Oliver Schwarz⋆, Mads Dam∗

∗KTH Royal Institute of Technology, Stockholm, Sweden ⋆RISE.SICS, Kista, Sweden

cbaumann@kth.se PROOFS, Taipei, 2017-09-29

slide-2
SLIDE 2

Low and High Level System Security Bugs

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 2 / 16

slide-3
SLIDE 3

minimal COTS hypervisor for ARMv8: fixed #guests, fixed memory size cores and devices owned exclusively no device virtualization, except: GIC secure boot loader memory isolation through HW extensions & SMMUs communication only through pre-defined channels Inter-guest communication (IGC)

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 3 / 16

slide-4
SLIDE 4

minimal COTS hypervisor for ARMv8: fixed #guests, fixed memory size cores and devices owned exclusively no device virtualization, except: GIC secure boot loader memory isolation through HW extensions & SMMUs communication only through pre-defined channels Inter-guest communication (IGC)

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 3 / 16

slide-5
SLIDE 5

minimal COTS hypervisor for ARMv8: fixed #guests, fixed memory size cores and devices owned exclusively no device virtualization, except: GIC secure boot loader memory isolation through HW extensions & SMMUs communication only through pre-defined channels Inter-guest communication (IGC)

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 3 / 16

slide-6
SLIDE 6

Goal: Bisimulation with Ideal Model

R

⇔ ideal model: secure by construction bisimulation relation R: transfer information flow properties verification: focus on arbitrary guest steps here

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 4 / 16

slide-7
SLIDE 7

SoCs complex / formal verification expensive Decomposition: utilize HW-specific properties & features compositionality fixed communication channels Abstraction: lots of details irrelevant for security focus on communication hide internal state refine component models later

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 5 / 16

slide-8
SLIDE 8

SoCs complex / formal verification expensive Decomposition: utilize HW-specific properties & features compositionality fixed communication channels Abstraction: lots of details irrelevant for security focus on communication hide internal state refine component models later

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 5 / 16

slide-9
SLIDE 9

ARMv8 platform model

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 6 / 16

slide-10
SLIDE 10

ARMv8 platform model

(S)MMU: active?, page table base, current translations, mem requests

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 6 / 16

slide-11
SLIDE 11

ARMv8 platform model

(S)MMU: active?, page table base, current translations, mem requests Core: execution mode, some hypervisor registers relevant

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 6 / 16

slide-12
SLIDE 12

ARMv8 platform model

(S)MMU: active?, page table base, current translations, mem requests Core: execution mode, some hypervisor registers relevant Device: mostly uninterpreted, DMA enabled?, track communication

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 6 / 16

slide-13
SLIDE 13

ARMv8 platform model

(S)MMU: active?, page table base, current translations, mem requests Core: execution mode, some hypervisor registers relevant Device: mostly uninterpreted, DMA enabled?, track communication Memory: flat map of contents, received requests, forwarded I/O

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 6 / 16

slide-14
SLIDE 14

ARMv8 platform model

(S)MMU: active?, page table base, current translations, mem requests Core: execution mode, some hypervisor registers relevant Device: mostly uninterpreted, DMA enabled?, track communication Memory: flat map of contents, received requests, forwarded I/O GIC: hypervisor-accessed registers, abstract interrupt state

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 6 / 16

slide-15
SLIDE 15

ARMv8 platform model

(S)MMU: active?, page table base, current translations, mem requests Core: execution mode, some hypervisor registers relevant Device: mostly uninterpreted, DMA enabled?, track communication Memory: flat map of contents, received requests, forwarded I/O GIC: hypervisor-accessed registers, abstract interrupt state hypervisor: fine-grained LTS, communication with GIC

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 6 / 16

slide-16
SLIDE 16

Hypervisor LTS: IGC interrupt injection

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 7 / 16

slide-17
SLIDE 17

Hypervisor LTS: IGC interrupt injection

entry await check cwait inject iwait dwait deact A c k s n d A c k r c v C h e c k s n d C h e c k r c v Inject snd Deact snd Inject rcv Deact snd D e a c t r c v

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 7 / 16

slide-18
SLIDE 18

Verification: Platform Invariants

Component Constraints & HV configuration ⇒ Invariant Inv: Messages & interrupts: preserve guest separation

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 8 / 16

slide-19
SLIDE 19

Verification: Platform Invariants

Component Constraints & HV configuration ⇒ Invariant Inv: Messages & interrupts: preserve guest separation Core: HV registers set up correctly, PC-safety in HV mode

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 8 / 16

slide-20
SLIDE 20

Verification: Platform Invariants

Component Constraints & HV configuration ⇒ Invariant Inv: Messages & interrupts: preserve guest separation Core: HV registers set up correctly, PC-safety in HV mode (S)MMU: active after init, points to right page table

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 8 / 16

slide-21
SLIDE 21

Verification: Platform Invariants

Component Constraints & HV configuration ⇒ Invariant Inv: Messages & interrupts: preserve guest separation Core: HV registers set up correctly, PC-safety in HV mode (S)MMU: active after init, points to right page table Device: inactive at boot

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 8 / 16

slide-22
SLIDE 22

Verification: Platform Invariants

Component Constraints & HV configuration ⇒ Invariant Inv: Messages & interrupts: preserve guest separation Core: HV registers set up correctly, PC-safety in HV mode (S)MMU: active after init, points to right page table Device: inactive at boot Memory: correct page tables set up

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 8 / 16

slide-23
SLIDE 23

Verification: Platform Invariants

Component Constraints & HV configuration ⇒ Invariant Inv: Messages & interrupts: preserve guest separation Core: HV registers set up correctly, PC-safety in HV mode (S)MMU: active after init, points to right page table Device: inactive at boot Memory: correct page tables set up GIC: correct distributor configuration

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 8 / 16

slide-24
SLIDE 24

Verification: Ideal Model

ideal core: HV invisible / atomic hypercall semantics

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 9 / 16

slide-25
SLIDE 25

Verification: Ideal Model

ideal core: HV invisible / atomic hypercall semantics buffer for outgoing IGC notification interrupts

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 9 / 16

slide-26
SLIDE 26

Verification: Ideal Model

ideal core: HV invisible / atomic hypercall semantics buffer for outgoing IGC notification interrupts IGC shared memory duplicated and copied on write

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 9 / 16

slide-27
SLIDE 27

Verification: Ideal Model

ideal core: HV invisible / atomic hypercall semantics buffer for outgoing IGC notification interrupts IGC shared memory duplicated and copied on write ideal GIC: interrupt separation by construction

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 9 / 16

slide-28
SLIDE 28

Verification: Ideal Model

ideal core: HV invisible / atomic hypercall semantics buffer for outgoing IGC notification interrupts IGC shared memory duplicated and copied on write ideal GIC: interrupt separation by construction message buffers as placeholders for (S)MMUs

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 9 / 16

slide-29
SLIDE 29

Verification: Ideal Model

ideal core: HV invisible / atomic hypercall semantics buffer for outgoing IGC notification interrupts IGC shared memory duplicated and copied on write ideal GIC: interrupt separation by construction message buffers as placeholders for (S)MMUs memory: only guest portion, intermediate physical addresses

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 9 / 16

slide-30
SLIDE 30

Verification: Bisimulation Theorem

⇓ R R

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 10 / 16

slide-31
SLIDE 31

Verification: Bisimulation Theorem

⇓ R R

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 10 / 16

slide-32
SLIDE 32

Verification: Bisimulation Theorem

⇑ R R

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 10 / 16

slide-33
SLIDE 33

Verification: Bisimulation Theorem

⇑ R R

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 10 / 16

slide-34
SLIDE 34

Verification: Bisimulation Theorem

⇑ R R Proof by induction on transition sequence: for any initial state σ0

P, Inv(σ0 P) and exists σ0 I such that σ0 P R σ0 I

for any initial state σ0

I , exists σ0 P such that σ0 P R σ0 I

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 10 / 16

slide-35
SLIDE 35

Verification: Bisimulation Theorem

⇑ R R Proof by induction on transition sequence: for any initial state σ0

P, Inv(σ0 P) and exists σ0 I such that σ0 P R σ0 I

for any initial state σ0

I , exists σ0 P such that σ0 P R σ0 I

for σP and σI with σP R σI and Inv(σP):

σP − → σ′

P =

⇒ ∃σ′

  • I. σI −

→∗ σ′

I ∧ σ′ P R σ′ I

σI − → σ′

I =

⇒ ∃σ′

  • P. σP −

→∗ σ′

P ∧ σ′ P R σ′ I

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 10 / 16

slide-36
SLIDE 36

Verification: Bisimulation Theorem

⇑ R R Proof by induction on transition sequence: for any initial state σ0

P, Inv(σ0 P) and exists σ0 I such that σ0 P R σ0 I

for any initial state σ0

I , exists σ0 P such that σ0 P R σ0 I

for σP and σI with σP R σI and Inv(σP):

σP − → σ′

P =

⇒ ∃σ′

  • I. σI −

→∗ σ′

I ∧ σ′ P R σ′ I

σI − → σ′

I =

⇒ ∃σ′

  • P. σP −

→∗ σ′

P ∧ σ′ P R σ′ I

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 10 / 16

slide-37
SLIDE 37

Verification: Bisimulation Theorem

⇑ R R Proof by induction on transition sequence: for any initial state σ0

P, Inv(σ0 P) and exists σ0 I such that σ0 P R σ0 I

for any initial state σ0

I , exists σ0 P such that σ0 P R σ0 I

for σP and σI with σP R σI and Inv(σP):

σP − → σ′

P =

⇒ ∃σ′

  • I. σI −

→∗ σ′

I ∧ σ′ P R σ′ I

σI − → σ′

I =

⇒ ∃σ′

  • P. σP −

→∗ σ′

P ∧ σ′ P R σ′ I

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 10 / 16

slide-38
SLIDE 38

Verification: Bisimulation Theorem

⇑ R R Proof by induction on transition sequence: for any initial state σ0

P, Inv(σ0 P) and exists σ0 I such that σ0 P R σ0 I

for any initial state σ0

I , exists σ0 P such that σ0 P R σ0 I

for σP and σI with σP R σI and Inv(σP):

σP − → σ′

P =

⇒ ∃σ′

  • I. σI −

→∗ σ′

I ∧ σ′ P R σ′ I

σI − → σ′

I =

⇒ ∃σ′

  • P. σP −

→∗ σ′

P ∧ σ′ P R σ′ I

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 10 / 16

slide-39
SLIDE 39

Verification: Bisimulation Relation

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 11 / 16

slide-40
SLIDE 40

Verification: Bisimulation Relation

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 11 / 16

slide-41
SLIDE 41

Verification: Bisimulation Relation

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 11 / 16

slide-42
SLIDE 42

Verification: Bisimulation Relation

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 11 / 16

slide-43
SLIDE 43

Verification: Bisimulation Relation

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 11 / 16

slide-44
SLIDE 44

Verification: Bisimulation Relation

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 11 / 16

slide-45
SLIDE 45

Verification: Bisimulation Relation

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 11 / 16

slide-46
SLIDE 46

Verification: Bisimulation Relation

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 11 / 16

slide-47
SLIDE 47

Verification: MMU steps

core!r buf?r buf!r mem?r core!r mmu?r mmu!w mem?w mem!q mmu?q mmu!r′ mem?r′

R ideal core sends memory request r to “MMU” buffer

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 12 / 16

slide-48
SLIDE 48

Verification: MMU steps

core!r buf?r buf!r mem?r core!r mmu?r mmu!w mem?w mem!q mmu?q mmu!r′ mem?r′

R ideal core sends memory request r to “MMU” buffer same request sent in platform model

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 12 / 16

slide-49
SLIDE 49

Verification: MMU steps

core!r buf?r buf!r mem?r core!r mmu?r mmu!w mem?w mem!q mmu?q mmu!r′ mem?r′

R ideal core sends memory request r to “MMU” buffer same request sent in platform model MMU sends page table lookup w to memory

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 12 / 16

slide-50
SLIDE 50

Verification: MMU steps

core!r buf?r buf!r mem?r core!r mmu?r mmu!w mem?w mem!q mmu?q mmu!r′ mem?r′

R ideal core sends memory request r to “MMU” buffer same request sent in platform model MMU sends page table lookup w to memory memory answers with reply q, matching w, translation r → r′

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 12 / 16

slide-51
SLIDE 51

Verification: MMU steps

core!r buf?r buf!r mem?r core!r mmu?r mmu!w mem?w mem!q mmu?q mmu!r′ mem?r′

R ideal core sends memory request r to “MMU” buffer same request sent in platform model MMU sends page table lookup w to memory memory answers with reply q, matching w, translation r → r′ (translated) request forwarded to memory

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 12 / 16

slide-52
SLIDE 52

Bisimulation Proof: Implementation

basic common ideal platform hyperv. bisim. total model specification 99 435 1,121 1,750 1,440 350 5,195 invariant specification – 17 387 518 – 453 1,375 machinery 309 – 95 – – 585 989 proofs 652 1,094 1,132 1,466 145 7,437 11,926 total 1,060 1,546 2,735 3,734 1,585 8,825 19,485

implemented in HOL4 theorem prover

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 13 / 16

slide-53
SLIDE 53

Bisimulation Proof: Implementation

basic common ideal platform hyperv. bisim. total model specification 99 435 1,121 1,750 1,440 350 5,195 invariant specification – 17 387 518 – 453 1,375 machinery 309 – 95 – – 585 989 proofs 652 1,094 1,132 1,466 145 7,437 11,926 total 1,060 1,546 2,735 3,734 1,585 8,825 19,485

implemented in HOL4 theorem prover most important cases verified

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 13 / 16

slide-54
SLIDE 54

Bisimulation Proof: Implementation

basic common ideal platform hyperv. bisim. total model specification 99 435 1,121 1,750 1,440 350 5,195 invariant specification – 17 387 518 – 453 1,375 machinery 309 – 95 – – 585 989 proofs 652 1,094 1,132 1,466 145 7,437 11,926 total 1,060 1,546 2,735 3,734 1,585 8,825 19,485

implemented in HOL4 theorem prover most important cases verified first steps towards automation

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 13 / 16

slide-55
SLIDE 55

Bisimulation Proof: Implementation

basic common ideal platform hyperv. bisim. total model specification 99 435 1,121 1,750 1,440 350 5,195 invariant specification – 17 387 518 – 453 1,375 machinery 309 – 95 – – 585 989 proofs 652 1,094 1,132 1,466 145 7,437 11,926 total 1,060 1,546 2,735 3,734 1,585 8,825 19,485

implemented in HOL4 theorem prover most important cases verified first steps towards automation simplifier and resolution solvers for trivial cases

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 13 / 16

slide-56
SLIDE 56

Bisimulation Proof: Implementation

basic common ideal platform hyperv. bisim. total model specification 99 435 1,121 1,750 1,440 350 5,195 invariant specification – 17 387 518 – 453 1,375 machinery 309 – 95 – – 585 989 proofs 652 1,094 1,132 1,466 145 7,437 11,926 total 1,060 1,546 2,735 3,734 1,585 8,825 19,485

implemented in HOL4 theorem prover most important cases verified first steps towards automation simplifier and resolution solvers for trivial cases proofs robust against local changes

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 13 / 16

slide-57
SLIDE 57

Bisimulation Proof: Implementation

basic common ideal platform hyperv. bisim. total model specification 99 435 1,121 1,750 1,440 350 5,195 invariant specification – 17 387 518 – 453 1,375 machinery 309 – 95 – – 585 989 proofs 652 1,094 1,132 1,466 145 7,437 11,926 total 1,060 1,546 2,735 3,734 1,585 8,825 19,485

implemented in HOL4 theorem prover most important cases verified first steps towards automation simplifier and resolution solvers for trivial cases proofs robust against local changes lots of technical lemmas

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 13 / 16

slide-58
SLIDE 58

Assumptions and Caveats

flat memory model

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 14 / 16

slide-59
SLIDE 59

Assumptions and Caveats

flat memory model

  • ne core memory request at a time

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 14 / 16

slide-60
SLIDE 60

Assumptions and Caveats

flat memory model

  • ne core memory request at a time
  • ne SMMU per device

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 14 / 16

slide-61
SLIDE 61

Assumptions and Caveats

flat memory model

  • ne core memory request at a time
  • ne SMMU per device

peripherals inactive at boot

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 14 / 16

slide-62
SLIDE 62

Assumptions and Caveats

flat memory model

  • ne core memory request at a time
  • ne SMMU per device

peripherals inactive at boot GICv2 model

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 14 / 16

slide-63
SLIDE 63

Conclusion & Future work

Summary: compositonal approach to SoC modeling for security verification reusability of models, adaptability of proofs top-down approach, abstraction and late refinement early identification of invariants and proof obligations case study in HOL4

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 15 / 16

slide-64
SLIDE 64

Conclusion & Future work

Summary: compositonal approach to SoC modeling for security verification reusability of models, adaptability of proofs top-down approach, abstraction and late refinement early identification of invariants and proof obligations case study in HOL4 TODOs: generalized formal framework, DSLs more automation advanced hardware features refinement of components property transfer

Baumann, Schwarz, Dam Compositional Platform Verification PROOFS 2017 15 / 16

slide-65
SLIDE 65

THANKS!

prosper.sics.se haspoc.sics.se