Formal verification of low-level execution platforms Roberto - - PowerPoint PPT Presentation

▶
formal verification of low level execution platforms
SMART_READER_LITE
LIVE PREVIEW

Formal verification of low-level execution platforms Roberto - - PowerPoint PPT Presentation

Jan 02, 2023 175 likes •897 views

Roberto Guanciale Estonian Winter School Day 01 Formal verification of low-level execution platforms Roberto Guanciale Assistant professor Computer Security Department of Theoretical Computer Science @KTH Research interest in Formal

slide-1
SLIDE 1

Formal verification

  • f low-level

execution platforms

Roberto Guanciale Estonian Winter School Day 01

slide-2
SLIDE 2

Assistant professor Computer Security Department of Theoretical Computer Science @KTH Research interest in Formal Verification Enthusiast software developer

Roberto Guanciale

slide-3
SLIDE 3

Distributed Attacks

A B

slide-4
SLIDE 4

Distributed Attacks Software vulnerabilities

  • Design flows
  • Web parameter injection
  • Broken authentication
slide-5
SLIDE 5

Distributed Attacks Software vulnerabilities Poor Management

  • Password re-usage
  • Social engineering
  • Misconfiguration
slide-6
SLIDE 6

Distributed Attacks Software vulnerabilities Poor Management

slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9
slide-10
SLIDE 10

500 000 Lines of Code 1 Buffer Overflow Introduced 2012 Discovered 2014

OpenSSL

slide-11
SLIDE 11

Motivations

Host 1

Hardware OS Apps

slide-12
SLIDE 12
slide-13
SLIDE 13
slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16

Motivations

Host 1

Hardware OS Apps

slide-17
SLIDE 17

Motivations

Host 1

Hardware OS Apps

slide-18
SLIDE 18

Motivations

Host 1

Hardware OS Apps

slide-19
SLIDE 19

Motivations

Host 1

Hardware OS Apps

slide-20
SLIDE 20

Motivations

Host 1

Hardware OS Apps Hypervisor Crypto Service

slide-21
SLIDE 21

Formal Verification

Models Assumptions Verifjcation

∀ s. secure(s)

slide-22
SLIDE 22

Formal Verification

Models Assumptions Verifjcation CPU MEMORY

slide-23
SLIDE 23

Formal Verification

Models Assumptions Verifjcation Hypervisor CPU MEMORY

OS

slide-24
SLIDE 24

Formal Verification

Models Assumptions Verifjcation Hypervisor CPU MEMORY

OS

slide-25
SLIDE 25

1) Formal verification 2) CPU models and proof strategy 3) Verification of memory virtualization 4) When the models are incorrect

Lecture plan

slide-26
SLIDE 26

Formal verification

slide-27
SLIDE 27
  • states of the system
  • Deterministic Finite Automata: integers
  • Stack, Heap, Current instruction: Java
  • …

Formal models

slide-28
SLIDE 28
  • states of the system
  • Deterministic Finite Automata: integers
  • Stack, Heap, Current instruction: Java
  • …
  • transition relation (behavior of the system)
  • DFA: depends on the transition function
  • Java: depends on the program and the Java semantics

Formal models

slide-29
SLIDE 29
  • states of the system
  • Deterministic Finite Automata: integers
  • Stack, Heap, Current instruction: Java
  • …
  • transition relation (behavior of the system)
  • DFA: depends on the transition function
  • Java: depends on the program and the Java semantics
  • labeled transition system
  • DFA: labels represent the accepted input characters
  • weak transition system (when some event is not important)

Formal models

slide-30
SLIDE 30

 {P} C {Q} : when the precondition P is met, executing the program C establishes the postcondition Q. 

Contract Verification

slide-31
SLIDE 31

 {P} C {Q} : when the precondition P is met, executing the program C establishes the postcondition Q.  

Contract Verification: Hoare logic

slide-32
SLIDE 32

 {P} C {Q} : when the precondition P is met, executing the program C establishes the postcondition Q.    Java Modeling Language (JML)

Contract verification: Hoare logic

slide-33
SLIDE 33

Contract verification

int SQRT(x) { int r = 0; while (r*r<=x) r++; return r; }

slide-34
SLIDE 34

Hoare logic: weakest preconditon

 Find the weakest precondition that guarantees that executing the program C establishes the postcondition Q.  Then prove P => WP

slide-35
SLIDE 35

Hoare logic: weakest preconditon

 Find the weakest precondition that guarantees that executing the program C establishes the postcondition Q  x:= exp {Q(x)}  WP = Q(exp)  Example  x:= 5 {Q(x) = x > y}  WP = Q(5) = 5 > y

slide-36
SLIDE 36

Hoare logic: weakest preconditon

 Find the weakest precondition that guarantees that executing the program C establishes the postcondition Q.  x:= exp {Q(x)}  WP = Q(exp)  Example  x:= y+1 {Q(x) = x > y}  WP = Q(y+1) = y+1 > y

slide-37
SLIDE 37

Hoare logic: weakest preconditon

 Find the weakest precondition that guarantees that executing the program C establishes the postcondition Q.  WP (C1; C2, Q) = WP(C1; WP(C2, Q))  Example 1) WP(y:=x+y, y>5) = x+y > 5 2) WP(x:=z+1, x+y > 5) = z+1+y>5

x:=z+1 y:=x+y Q = y > 5

slide-38
SLIDE 38

Hoare logic: weakest preconditon

 Find the weakest precondition that guarantees that executing the program C establishes the postcondition Q.  WP (IF C THEN C1 ELSE C2, Q) =  Example x>y => WP(z=x, z >= x /\ z >= y) eq x>y => x >= x /\ x >= y x<=y => WP(z=y, z >= x /\ z >= y) eq x<=y => y >= x /\ y >= y

if (x>y) then z = x else z=y Q: z >= x /\ z >= y

slide-39
SLIDE 39

 Implementation model  Java Classes  DFA  Specification model  Interfaces  NFA

Trace inclusion

slide-40
SLIDE 40

 Implementation model  trace  traces  Specification model

Trace inclusion

slide-41
SLIDE 41

 Implementation model  trace  traces  Specification model

Trace inclusion

slide-42
SLIDE 42

 Implementation model  trace  traces  Specification model  Trace Inclusion

Trace inclusion

slide-43
SLIDE 43

Formal verification: Trace inclusion

slide-44
SLIDE 44

Formal verification: Trace inclusion

slide-45
SLIDE 45

Formal verification: Trace inclusion

slide-46
SLIDE 46

 Implementation model  Specification model  Trace Inclusion  Contract verification  Then

Formal verification: Trace inclusion

slide-47
SLIDE 47

  Relation

Formal verification: Trace inclusion

slide-48
SLIDE 48

  Relation  Trace Inclusion  Contract verification  Property transfer

Formal verification: Trace inclusion

slide-49
SLIDE 49

  Relation  Trace Inclusion  Contract verification  Property transfer

Formal verification: Trace inclusion

slide-50
SLIDE 50

  Relation  Trace Inclusion 

Formal verification: simulation

slide-51
SLIDE 51

 K1 and K2 are secret variables (e.g. keys)  P1 and P2 are public variables  The attacker can invoke the function F  F should not leak the value of Ks

Formal verification: express secrecy

int F (P1) { P2 := K1; }

slide-52
SLIDE 52

 K1 and K2 are secret variables (e.g. keys)  P1 and P2 are public variables  The attacker can invoke the function F  F should not leak the value of Ks

Formal verification: express secrecy

int F (P1) { P2 := K1; }

slide-53
SLIDE 53

 K1 and K2 are secret variables (e.g. keys)  P1 and P2 are public variables  The attacker can invoke the function F  F should not leak the value of Ks

Formal verification: express secrecy

int F (P1) { P2 := P1; }

slide-54
SLIDE 54

 K1 and K2 are secret variables (e.g. keys)  P1 and P2 are public variables  The attacker can invoke the function F  F should not leak the value of Ks

Formal verification: express secrecy

int F (P1) { P2 := P1+K1; }

slide-55
SLIDE 55

 K1 and K2 are secret variables (e.g. keys)  P1 and P2 are public variables  The attacker can invoke the function F  F should not leak the value of Ks

Formal verification: express secrecy

int F (P1) { if (K1 < 10) P2 := P1; }

slide-56
SLIDE 56

 K1 and K2 are secret variables (e.g. keys)  P1 and P2 are public variables  The attacker can invoke the function F  F should not leak the value of Ks

Formal verification: express secrecy

int F (P1) { if (P1 < 10) P2 := P1; K2 := K1 + P1; }

slide-57
SLIDE 57

 K1 and K2 are secret variables (e.g. keys)  P1 and P2 are public variables

Information flow security

slide-58
SLIDE 58

Information flow security: refinement

slide-59
SLIDE 59

Information flow security: refinement

slide-60
SLIDE 60

Information flow security: refinement

slide-61
SLIDE 61

Information flow security: refinement

slide-62
SLIDE 62

Information flow security: refinement

int S() { P := RND()*2; } K:0 P:1 P:0 P:2 P:4 K:1 P:1 P:0 P:2 P:4

slide-63
SLIDE 63

Information flow security: refinement

int S() { P := RND()*2; } int I() { P := K*2; } K:0 P:1 P:0 P:2 P:4 K:1 P:1 P:0 P:2 P:4

slide-64
SLIDE 64

Information flow security: refinement

int S() { P := RND()*2; } int I() { P := K*2; } K:0 P:1 P:0 P:2 P:4 K:1 P:1 P:0 P:2 P:4 K:0 P:1 P:0 P:2 P:4

slide-65
SLIDE 65

Information flow security: refinement

int S() { P := RND()*2; } int I() { P := K*2; } K:0 P:1 P:0 P:2 P:4 K:1 P:1 P:0 P:2 P:4 K:0 P:1 P:0 P:2 P:4 K:1 P:1 P:0 P:2 P:4

slide-66
SLIDE 66

Information flow security: refinement

slide-67
SLIDE 67

  Relation  Trace Inclusion 

Formal verification: bisimulation

slide-68
SLIDE 68

Fully automated (propositional logic)

Automated, but not necessarily terminating (first order logic)

With automation, but mainly interactive (higher-order logic)

Isabelle

HOL4

Theorem prover

slide-69
SLIDE 69

A generic interactive proof assistant

Interactive:

more than just yes/no, you can interactively guide the system

Proof assistant:

helps to explore, find, and maintain proofs

Widely used systems, Active development, Reasonably easy to use

Internal Logic and object logic (HOL)

Isabelle/HOL4

slide-70
SLIDE 70

Summary

  • Motivations
  • Refinements
  • Information flow security
  • Upcoming
  • Formal models of CPUs
  • High level proof
slide-71
SLIDE 71

THANKS! Any questions?

You can find me at robertog@kth.se http://prosper.sics.se/

References