From Qualitative to Quantitative Program Analysis: Permissive - - PowerPoint PPT Presentation

from qualitative to quantitative program analysis
SMART_READER_LITE
LIVE PREVIEW

From Qualitative to Quantitative Program Analysis: Permissive - - PowerPoint PPT Presentation

Introduction Information Flow Qualitative IF Quantitative IF Conclusion From Qualitative to Quantitative Program Analysis: Permissive Enforcement of Secure Information Flow Mounir Assaf Software Security Lab, CEA LIST, Saclay CIDre,


slide-1
SLIDE 1

Mounir Assaf From Qualitative to Quantitative Information Flow 1 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion

From Qualitative to Quantitative Program Analysis: Permissive Enforcement of Secure Information Flow

Mounir Assaf

Software Security Lab, CEA LIST, Saclay CIDre, Inria/Irisa/CentraleSupélec, Rennes Since 2015-09, Stevens Institute of Technology, Hoboken, US

slide-2
SLIDE 2

Mounir Assaf From Qualitative to Quantitative Information Flow 2 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Security

Information security :

Confidentiality Integrity Availability

Traditionally, dissemination of information is prevented through Access control :

Deals with what piece of information can be accessed? by whom? Yet, is this piece of information handled correctly when accessed?

Information Flow Control :

Tracks how information is propagated through a program Verifies that information flows are secure with respect to a security policy

slide-3
SLIDE 3

Mounir Assaf From Qualitative to Quantitative Information Flow 3 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion A Security Property

Attacker model :

They know the source of programs and public outputs They control public inputs

SECRETinputs PUBLICinputs SECREToutputs PUBLICoutputs

slide-4
SLIDE 4

Mounir Assaf From Qualitative to Quantitative Information Flow 3 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion A Security Property

Attacker model :

They know the source of programs and public outputs They control public inputs

SECRETinputs PUBLICinputs SECREToutputs PUBLICoutputs X A program is secure if non-interfering

Roughly, non-interference (in the case of confidentiality) is independance of public outputs from secret inputs

slide-5
SLIDE 5

Mounir Assaf From Qualitative to Quantitative Information Flow 4 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Termination-Insensitive Non-Interference

Termination-Insensitive Non-Interference (TINI)

Two terminating executions which differ only on secret inputs deliver the same public outputs

SECRETinput PUBLICinput SECREToutput PUBLICoutput SECRET ′

input

PUBLICinput SECRET ′

  • utput

PUBLICoutput

slide-6
SLIDE 6

Mounir Assaf From Qualitative to Quantitative Information Flow 4 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Termination-Insensitive Non-Interference

Termination-Insensitive Non-Interference (TINI)

Two terminating executions which differ only on secret inputs deliver the same public outputs

SECRETinput PUBLICinput SECREToutput

✎ ✍ ☞ ✌

PUBLICoutput SECRET ′

input

PUBLICinput SECRET ′

  • utput

✓ ✒ ✏ ✑

PUBLICoutput

slide-7
SLIDE 7

Mounir Assaf From Qualitative to Quantitative Information Flow 5 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Explicit Information Flows

Explicit flows produced when information is transfered directly from source to destination destination := source Assignments generate explicit flows Explicit flow from variable source to destination

slide-8
SLIDE 8

Mounir Assaf From Qualitative to Quantitative Information Flow 6 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Implicit Information Flows

Implicit flows produced when an assignment is conditioned on the value of an expression

e l s e

print public public := true else skip if (secret) public := false execution path execution path Implicit flow from variable secret to variable public

slide-9
SLIDE 9

Mounir Assaf From Qualitative to Quantitative Information Flow 7 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Pointer-induced flows

Pointer-induced flows produced whenever a pointer is dereferenced x := &public_a x := &public_b print *x if (secret) Attackers knowing the values of variables public_a and public_b can deduce information about variable secret when observing the output *x.

slide-10
SLIDE 10

Mounir Assaf From Qualitative to Quantitative Information Flow 7 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Pointer-induced flows

Pointer-induced flows produced whenever a pointer is dereferenced x := &public_a x := &public_b print *x if (secret) Attackers knowing the values of variables public_a and public_b can deduce information about variable secret when observing the output *x.

Implicit flow from secret to pointer x

slide-11
SLIDE 11

Mounir Assaf From Qualitative to Quantitative Information Flow 7 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Pointer-induced flows

Pointer-induced flows produced whenever a pointer is dereferenced x := &public_a x := &public_b print *x if (secret) Attackers knowing the values of variables public_a and public_b can deduce information about variable secret when observing the output *x.

Implicit flow from secret to pointer x Pointer-induced flow from pointer x to *x

slide-12
SLIDE 12

Mounir Assaf From Qualitative to Quantitative Information Flow 8 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Contents

I Information Flow II Qualitative IF

1

Value Analysis

2

Information Flow Control for C programs

3

PWhile monitor

III Quantitative IF IV Conclusion

slide-13
SLIDE 13

Mounir Assaf From Qualitative to Quantitative Information Flow 9 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Value Analysis

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1

assert y_lab == 0;

z := 1/y

e l s e

Frama-C, an industrial-quality framework for source code analysis of C

[Kirchner et al.,2015]

Value Analysis plug-in

a tool based on Abstract Interpretation

[Cousot & Cousot,77]

  • ver-approximating the variation domains of variables

aimed at the detection of runtime errors

slide-14
SLIDE 14

Mounir Assaf From Qualitative to Quantitative Information Flow 9 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Value Analysis

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1

assert y_lab == 0;

z := 1/y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3]

Frama-C, an industrial-quality framework for source code analysis of C

[Kirchner et al.,2015]

Value Analysis plug-in

a tool based on Abstract Interpretation

[Cousot & Cousot,77]

  • ver-approximating the variation domains of variables

aimed at the detection of runtime errors

slide-15
SLIDE 15

Mounir Assaf From Qualitative to Quantitative Information Flow 9 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Value Analysis

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1

assert y_lab == 0;

z := 1/y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1]

Frama-C, an industrial-quality framework for source code analysis of C

[Kirchner et al.,2015]

Value Analysis plug-in

a tool based on Abstract Interpretation

[Cousot & Cousot,77]

  • ver-approximating the variation domains of variables

aimed at the detection of runtime errors

slide-16
SLIDE 16

Mounir Assaf From Qualitative to Quantitative Information Flow 9 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Value Analysis

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1

assert y_lab == 0;

z := 1/y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] y_lab[0,1] y[−1,3]

Frama-C, an industrial-quality framework for source code analysis of C

[Kirchner et al.,2015]

Value Analysis plug-in

a tool based on Abstract Interpretation

[Cousot & Cousot,77]

  • ver-approximating the variation domains of variables

aimed at the detection of runtime errors

slide-17
SLIDE 17

Mounir Assaf From Qualitative to Quantitative Information Flow 9 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Value Analysis

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1

assert y_lab == 0;

z := 1/y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] y_lab[0,1] y[−1,3]

zdiv z[−1,1]

Frama-C, an industrial-quality framework for source code analysis of C

[Kirchner et al.,2015]

Value Analysis plug-in

a tool based on Abstract Interpretation

[Cousot & Cousot,77]

  • ver-approximating the variation domains of variables

aimed at the detection of runtime errors

slide-18
SLIDE 18

Mounir Assaf From Qualitative to Quantitative Information Flow 10 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Value Analysis

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1

assert y_lab == 0;

z := 1/y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1]

Trace partitioning

[Rival & Mauborgne, 05 & 07]

In a nutshell, simulating a partition of executions Gaining precision by keeping both states separate

slide-19
SLIDE 19

Mounir Assaf From Qualitative to Quantitative Information Flow 10 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Value Analysis

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1

assert y_lab == 0;

z := 1/y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] z[0,0] z[−1,−1]

Trace partitioning

[Rival & Mauborgne, 05 & 07]

In a nutshell, simulating a partition of executions Gaining precision by keeping both states separate

slide-20
SLIDE 20

Mounir Assaf From Qualitative to Quantitative Information Flow 11 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

if (secret>public) y_lab skip y := -1 print y

e l s e

secret[minI,maxI],public[minI,maxI],y[3,3] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y[3,3] y[−1,−1]

The seed of an idea :

Instrument the source code of target programs according to traditional security type systems

[Hunt & Sands,06]

Rely on Value Analysis for the computations

slide-21
SLIDE 21

Mounir Assaf From Qualitative to Quantitative Information Flow 11 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

if (secret>public) y_lab skip y := -1 print y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0] secret[minI,maxI],public[minI,maxI],y[3,3] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y[3,3] y[−1,−1]

The seed of an idea :

Instrument the source code of target programs according to traditional security type systems

[Hunt & Sands,06]

Rely on Value Analysis for the computations Representing security labels: SECRET 1, PUBLIC 0 union over security labels: logical or

slide-22
SLIDE 22

Mounir Assaf From Qualitative to Quantitative Information Flow 11 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y := -1 print y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0] secret[minI,maxI],public[minI,maxI],y[3,3] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y[3,3] y[−1,−1]

The seed of an idea :

Instrument the source code of target programs according to traditional security type systems

[Hunt & Sands,06]

Rely on Value Analysis for the computations Representing security labels: SECRET 1, PUBLIC 0 union over security labels: logical or

slide-23
SLIDE 23

Mounir Assaf From Qualitative to Quantitative Information Flow 11 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 print y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0] secret[minI,maxI],public[minI,maxI],y[3,3] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y[3,3] y[−1,−1]

The seed of an idea :

Instrument the source code of target programs according to traditional security type systems

[Hunt & Sands,06]

Rely on Value Analysis for the computations Representing security labels: SECRET 1, PUBLIC 0 union over security labels: logical or

slide-24
SLIDE 24

Mounir Assaf From Qualitative to Quantitative Information Flow 11 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 assert y_lab == 0; print y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0] secret[minI,maxI],public[minI,maxI],y[3,3] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y[3,3] y[−1,−1]

The seed of an idea :

Instrument the source code of target programs according to traditional security type systems

[Hunt & Sands,06]

Rely on Value Analysis for the computations Representing security labels: SECRET 1, PUBLIC 0 union over security labels: logical or

slide-25
SLIDE 25

Mounir Assaf From Qualitative to Quantitative Information Flow 11 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 assert y_lab == 0; print y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y[3,3] y[−1,−1]

The seed of an idea :

Instrument the source code of target programs according to traditional security type systems

[Hunt & Sands,06]

Rely on Value Analysis for the computations Representing security labels: SECRET 1, PUBLIC 0 union over security labels: logical or

slide-26
SLIDE 26

Mounir Assaf From Qualitative to Quantitative Information Flow 11 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 assert y_lab == 0; print y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y[3,3] y[−1,−1]

The seed of an idea :

Instrument the source code of target programs according to traditional security type systems

[Hunt & Sands,06]

Rely on Value Analysis for the computations Representing security labels: SECRET 1, PUBLIC 0 union over security labels: logical or

slide-27
SLIDE 27

Mounir Assaf From Qualitative to Quantitative Information Flow 11 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 assert y_lab == 0; print y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1]

The seed of an idea :

Instrument the source code of target programs according to traditional security type systems

[Hunt & Sands,06]

Rely on Value Analysis for the computations Representing security labels: SECRET 1, PUBLIC 0 union over security labels: logical or

slide-28
SLIDE 28

Mounir Assaf From Qualitative to Quantitative Information Flow 11 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 assert y_lab == 0; print y

e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1]

leak

The seed of an idea :

Instrument the source code of target programs according to traditional security type systems

[Hunt & Sands,06]

Rely on Value Analysis for the computations Representing security labels: SECRET 1, PUBLIC 0 union over security labels: logical or

slide-29
SLIDE 29

Mounir Assaf From Qualitative to Quantitative Information Flow 12 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 if (y != -1) z := -1 z_lab skip print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1]

slide-30
SLIDE 30

Mounir Assaf From Qualitative to Quantitative Information Flow 12 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 if (y != -1) z := -1 z_lab skip print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] z[3,3], z_lab[0,0],

slide-31
SLIDE 31

Mounir Assaf From Qualitative to Quantitative Information Flow 12 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1) z := -1 z_lab skip print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] z[3,3], z_lab[0,0],

slide-32
SLIDE 32

Mounir Assaf From Qualitative to Quantitative Information Flow 12 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1)

z_lab := pc2 or 0;

z := -1 z_lab skip print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] z[3,3], z_lab[0,0],

slide-33
SLIDE 33

Mounir Assaf From Qualitative to Quantitative Information Flow 12 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1)

z_lab := pc2 or 0;

z := -1 z_lab skip assert z_lab == 0; print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] z[3,3], z_lab[0,0],

slide-34
SLIDE 34

Mounir Assaf From Qualitative to Quantitative Information Flow 12 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1)

z_lab := pc2 or 0;

z := -1 z_lab skip assert z_lab == 0; print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] z[3,3], z_lab[0,0],

slide-35
SLIDE 35

Mounir Assaf From Qualitative to Quantitative Information Flow 12 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1)

z_lab := pc2 or 0;

z := -1 z_lab skip assert z_lab == 0; print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] then else z[3,3], z_lab[0,0],

slide-36
SLIDE 36

Mounir Assaf From Qualitative to Quantitative Information Flow 12 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1)

z_lab := pc2 or 0;

z := -1 z_lab skip assert z_lab == 0; print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] then else z[3,3], z_lab[0,0], pc2[0,0] pc2[1,1] z_lab[0,0] z_lab[0,0] z[−1,−1] z[3,3]

slide-37
SLIDE 37

Mounir Assaf From Qualitative to Quantitative Information Flow 12 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Information Flow Control for C?

pc1 := secret_lab or public_lab; if (secret>public) y_lab skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1)

z_lab := pc2 or 0;

z := -1 z_lab skip assert z_lab == 0; print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] pc2[0,0] pc2[1,1] y_lab[0,0] y_lab[1,1] y[3,3] y[−1,−1] then else z[3,3], z_lab[0,0], pc2[0,0] pc2[1,1] z_lab[0,0] z_lab[0,0] z[−1,−1] z[3,3]

Information leak not detected

slide-38
SLIDE 38

Mounir Assaf From Qualitative to Quantitative Information Flow 13 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion IF monitoring to the Rescue!

Non-interference is not a safety property

[McLean,94] [Schneider,00]

Intuitively, even the fact that a variable is not modified during an execution may also leak sensitive information Information Flow Monitoring

[Le Guernic et al.,06] [Russo & Sabelfeld,10]

A prior static analysis of target programs computing the set of modified variables in non-executed conditional branches

slide-39
SLIDE 39

Mounir Assaf From Qualitative to Quantitative Information Flow 14 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion IF monitoring to the Rescue!

pc1 := secret_lab or public_lab; if (secret>public) skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1) z_lab := pc2 or 0; z := -1 skip assert z_lab == 0; print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[1,1] y[3,3] y[−1,−1] pc2[1,1] y_lab[1,1] y[3,3] y[−1,−1] then else z[3,3], z_lab[0,0], pc2[1,1] z[−1,−1] z[3,3]

slide-40
SLIDE 40

Mounir Assaf From Qualitative to Quantitative Information Flow 14 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion IF monitoring to the Rescue!

pc1 := secret_lab or public_lab; if (secret>public)

y_lab:=y_lab or pc1

skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1) z_lab := pc2 or 0; z := -1 skip assert z_lab == 0; print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[1,1] y[3,3] y[−1,−1] pc2[1,1] y_lab[1,1] y[3,3] y[−1,−1] then else z[3,3], z_lab[0,0], pc2[1,1] z[−1,−1] z[3,3]

slide-41
SLIDE 41

Mounir Assaf From Qualitative to Quantitative Information Flow 14 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion IF monitoring to the Rescue!

pc1 := secret_lab or public_lab; if (secret>public)

y_lab:=y_lab or pc1

skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1) z_lab := pc2 or 0; z := -1

z_lab:=z_lab or pc2

skip assert z_lab == 0; print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[1,1] y[3,3] y[−1,−1] pc2[1,1] y_lab[1,1] y[3,3] y[−1,−1] then else z[3,3], z_lab[0,0], pc2[1,1] z[−1,−1] z[3,3]

slide-42
SLIDE 42

Mounir Assaf From Qualitative to Quantitative Information Flow 14 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion IF monitoring to the Rescue!

pc1 := secret_lab or public_lab; if (secret>public)

y_lab:=y_lab or pc1

skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1) z_lab := pc2 or 0; z := -1

z_lab:=z_lab or pc2

skip assert z_lab == 0; print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[1,1] y_lab[1,1] y[3,3] y[−1,−1] pc2[1,1] y_lab[1,1] y_lab[1,1] y[3,3] y[−1,−1] then else z[3,3], z_lab[0,0], pc2[1,1] z[−1,−1] z[3,3]

slide-43
SLIDE 43

Mounir Assaf From Qualitative to Quantitative Information Flow 14 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion IF monitoring to the Rescue!

pc1 := secret_lab or public_lab; if (secret>public)

y_lab:=y_lab or pc1

skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1) z_lab := pc2 or 0; z := -1

z_lab:=z_lab or pc2

skip assert z_lab == 0; print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[1,1] y_lab[1,1] y[3,3] y[−1,−1] pc2[1,1] pc2[1,1] y_lab[1,1] y_lab[1,1] y[3,3] y[−1,−1] then else z[3,3], z_lab[0,0], pc2[1,1] pc2[1,1] z[−1,−1] z[3,3]

slide-44
SLIDE 44

Mounir Assaf From Qualitative to Quantitative Information Flow 14 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion IF monitoring to the Rescue!

pc1 := secret_lab or public_lab; if (secret>public)

y_lab:=y_lab or pc1

skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1) z_lab := pc2 or 0; z := -1

z_lab:=z_lab or pc2

skip assert z_lab == 0; print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[1,1] y_lab[1,1] y[3,3] y[−1,−1] pc2[1,1] pc2[1,1] y_lab[1,1] y_lab[1,1] y[3,3] y[−1,−1] then else z[3,3], z_lab[0,0], pc2[1,1] pc2[1,1] z_lab[1,1] z_lab[1,1] z[−1,−1] z[3,3]

slide-45
SLIDE 45

Mounir Assaf From Qualitative to Quantitative Information Flow 14 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion IF monitoring to the Rescue!

pc1 := secret_lab or public_lab; if (secret>public)

y_lab:=y_lab or pc1

skip y_lab := pc1 or 0; y := -1 pc2 := y_lab or 0; if (y != -1) z_lab := pc2 or 0; z := -1

z_lab:=z_lab or pc2

skip assert z_lab == 0; print z

e l s e e l s e

secret_lab[1,1],public_lab[0,0] y_lab[0,0],pc1[1,1] secret[minI,maxI],public[minI,maxI],y[3,3] y_lab[1,1] y_lab[1,1] y[3,3] y[−1,−1] pc2[1,1] pc2[1,1] y_lab[1,1] y_lab[1,1] y[3,3] y[−1,−1] then else z[3,3], z_lab[0,0], pc2[1,1] pc2[1,1] z_lab[1,1] z_lab[1,1] z[−1,−1] z[3,3]

leak leak

slide-46
SLIDE 46

Mounir Assaf From Qualitative to Quantitative Information Flow 15 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Pointers and Aliasing 1

int auth

2 3

int *leak

4 5 6

leak := &auth

7 8 9 10

print *leak Aliasing invariant: two expressions are aliased iff their auxiliary variables are aliased

slide-47
SLIDE 47

Mounir Assaf From Qualitative to Quantitative Information Flow 15 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Pointers and Aliasing 1

int auth

2

label auth_lab

3

int *leak

4 5 6

leak := &auth

7 8 9 10

print *leak Aliasing invariant: two expressions are aliased iff their auxiliary variables are aliased

slide-48
SLIDE 48

Mounir Assaf From Qualitative to Quantitative Information Flow 15 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Pointers and Aliasing 1

int auth

2

label auth_lab

3

int *leak

4

label leak_lab

5

label

∗leak_lab_d1

6

leak := &auth

7 8 9 10

print *leak Aliasing invariant: two expressions are aliased iff their auxiliary variables are aliased

slide-49
SLIDE 49

Mounir Assaf From Qualitative to Quantitative Information Flow 15 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Pointers and Aliasing 1

int auth

2

label auth_lab

3

int *leak

4

label leak_lab

5

label

∗leak_lab_d1

6

leak := &auth

7

leak_lab := 0

8

leak_lab_d1 := &auth_lab

9 10

print *leak Aliasing invariant: two expressions are aliased iff their auxiliary variables are aliased

slide-50
SLIDE 50

Mounir Assaf From Qualitative to Quantitative Information Flow 15 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Pointers and Aliasing 1

int auth

2

label auth_lab

3

int *leak

4

label leak_lab

5

label

∗leak_lab_d1

6

leak := &auth

7

leak_lab := 0

8

leak_lab_d1 := &auth_lab

9

assert leak_lab or

∗leak_lab_d1 == 0

10

print *leak Aliasing invariant: two expressions are aliased iff their auxiliary variables are aliased

slide-51
SLIDE 51

Mounir Assaf From Qualitative to Quantitative Information Flow 16 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion PWhile Monitor

Our approach:

Sound hybrid information flow monitor for a language supporting pointers and aliasing Sound inlining approach for our monitor

[Assaf et al.,13a & 13b]

Implemented the inlining approach as a Frama-C plug-in: support of arrays, pointer arithmetics, functions, structures. . .

Verifying TINI through:

Static analysis by relying on off-the-shelf tools, or Monitoring

Future work: a prior static analysis guiding the inlining approach to support casts, unions and dynamic allocation. . .

slide-52
SLIDE 52

Mounir Assaf From Qualitative to Quantitative Information Flow 17 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Contents

I Information Flow II Qualitative IF III Quantitative IF

1

Relative Secrecy

2

Cardinal Abstraction

3

Tree Abstraction

IV Conclusion

slide-53
SLIDE 53

Mounir Assaf From Qualitative to Quantitative Information Flow 18 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Termination-Insensitive Non-interference

print auth auth := 1 auth := 0 if (secret == public)

e l s e

public

⇓sec=pub

1

⇓sec=pub print auth auth := 1 while (true) skip if (secret == public)

e l s e

public

⇑sec=pub

1

⇓sec=pub

From attackers’ perspective: both programs are equivalent

slide-54
SLIDE 54

Mounir Assaf From Qualitative to Quantitative Information Flow 18 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Termination-Insensitive Non-interference

print auth auth := 1 auth := 0 if (secret == public)

e l s e

Interferent program

public

⇓sec=pub

1

⇓sec=pub print auth auth := 1 while (true) skip if (secret == public)

e l s e

Non-interferent program

public

⇑sec=pub

1

⇓sec=pub

From attackers’ perspective: both programs are equivalent

slide-55
SLIDE 55

Mounir Assaf From Qualitative to Quantitative Information Flow 19 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Termination-Insensitive Non-interference

Information leaks due to the observation of divergence are discarded

The probability of polynomial time attackers guessing the secret is negligible in the size of the secret

[Askarov et al.,08]

Let us prove security of programs wrt. this exact assumption A flavour of Relative Secrecy

[Volpano and Smith,00]

The framework of min-entropy/min-capacity

[Smith, 09 & 11]

Quantifying the leakage wrt. the probability of attackers guessing the secret

slide-56
SLIDE 56

Mounir Assaf From Qualitative to Quantitative Information Flow 20 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Relative Secrecy 1

if (secret == 0) {

2

print 1 }

3

else {

4

print 0 } Outputs 1 What’s the probability of attackers guessing the secret after

  • bserving an output? (secret ∈ [0,2N −1])
slide-57
SLIDE 57

Mounir Assaf From Qualitative to Quantitative Information Flow 20 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Relative Secrecy 1

if (secret == 0) {

2

print 1 }

3

else {

4

print 0 } Outputs 0secret=0 1secret=0 What’s the probability of attackers guessing the secret after

  • bserving an output? (secret ∈ [0,2N −1])
slide-58
SLIDE 58

Mounir Assaf From Qualitative to Quantitative Information Flow 20 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Relative Secrecy 1

if (secret == 0) {

2

print 1 }

3

else {

4

print 0 } Outputs 0secret=0 1secret=0 What’s the probability of attackers guessing the secret after

  • bserving an output? (secret ∈ [0,2N −1])

1 right guess right guess

1 2

N

2

N−

1 2

N

1

1 2N−1

slide-59
SLIDE 59

Mounir Assaf From Qualitative to Quantitative Information Flow 20 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Relative Secrecy 1

if (secret == 0) {

2

print 1 }

3

else {

4

print 0 } Outputs 0secret=0 1secret=0 What’s the probability of attackers guessing the secret after

  • bserving an output? (secret ∈ [0,2N −1])

1 right guess right guess

1 2

N

2

N−

1 2

N

1

1 2N−1

Pguess = ✁ 1 2N × 1

1

+ ✘✘✘ ✘

2N −1 2N

×

1

✘✘✘ ✘

2N −1

= 2

2N

slide-60
SLIDE 60

Mounir Assaf From Qualitative to Quantitative Information Flow 21 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Relative Secrecy

A pattern : Outputs . . .

  • 3
  • 2
  • 1
slide-61
SLIDE 61

Mounir Assaf From Qualitative to Quantitative Information Flow 21 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Relative Secrecy

A pattern : Outputs . . .

  • 3s∈K3
  • 2s∈K2
  • 1s∈K1
slide-62
SLIDE 62

Mounir Assaf From Qualitative to Quantitative Information Flow 21 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Relative Secrecy

A pattern : Outputs . . .

  • 3s∈K3
  • 2s∈K2
  • 1s∈K1

Pguess =

  • i∈Outputs

✟✟ |Ki|

2N × 1

✟✟ |Ki| = |Outputs|

2N

slide-63
SLIDE 63

Mounir Assaf From Qualitative to Quantitative Information Flow 21 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Relative Secrecy

A pattern : Outputs . . .

  • 3s∈K3
  • 2s∈K2
  • 1s∈K1

Pguess =

  • i∈Outputs

✟✟ |Ki|

2N × 1

✟✟ |Ki| = |Outputs|

2N The leakage of a program in bits, assuming a uniform distribution

πu of the secret:

[Smith,09 & 11]

L

πu Initial uncertainty−Remaining uncertainty

= −log2

1 2N

(−log2

|Outputs|

2N )

= log2 |Outputs|

slide-64
SLIDE 64

Mounir Assaf From Qualitative to Quantitative Information Flow 22 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Relative Secrecy

Outputs

∗ ∗ ∗ ∗

v1

∗ ∗

v2

...

slide-65
SLIDE 65

Mounir Assaf From Qualitative to Quantitative Information Flow 22 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Relative Secrecy

Outputs

∗ ∗ ∗ ∗

v1

∗ ∗

v2

...

Polynomial time attackers observe only a polynomial amount

  • f outputs:
  • i = v1 ·v2 ·v3 ... such that length(oi) ≤ b, with log(b) = o(N)
slide-66
SLIDE 66

Mounir Assaf From Qualitative to Quantitative Information Flow 22 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Relative Secrecy

Outputs

∗ ∗ ∗ ∗

v1

∗ ∗

v2

...

Polynomial time attackers observe only a polynomial amount

  • f outputs:
  • i = v1 ·v2 ·v3 ... such that length(oi) ≤ b, with log(b) = o(N)

Relative Secrecy for deterministic programs: log2 |Outputsb| = o(N) when log(b) = o(N)

slide-67
SLIDE 67

Mounir Assaf From Qualitative to Quantitative Information Flow 23 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

A problem : how do we count the cardinal of outputs? (ML = log2 |Outputsb|)

1

x := s mod 4

2

print x

1

x := s mod 4

2

print x

slide-68
SLIDE 68

Mounir Assaf From Qualitative to Quantitative Information Flow 23 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

A problem : how do we count the cardinal of outputs? (ML = log2 |Outputsb|)

1

x := s mod 4

2

print x

1

s → 0,s → 1,...,s → 2N −1

2

x → 0,x → 1,x → 2,x → 3

finding the set of final states,

1

x := s mod 4

2

print x

slide-69
SLIDE 69

Mounir Assaf From Qualitative to Quantitative Information Flow 23 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

A problem : how do we count the cardinal of outputs? (ML = log2 |Outputsb|)

1

x := s mod 4

2

print x

1

s → 0,s → 1,...,s → 2N −1

2

x → 0,x → 1,x → 2,x → 3

finding the set of final states, counting them !

1

x := s mod 4

2

print x

slide-70
SLIDE 70

Mounir Assaf From Qualitative to Quantitative Information Flow 23 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

A problem : how do we count the cardinal of outputs? (ML = log2 |Outputsb|)

1

x := s mod 4

2

print x

1

s → 0,s → 1,...,s → 2N −1

2

x → 0,x → 1,x → 2,x → 3

finding the set of final states, not computable counting them !

1

x := s mod 4

2

print x

slide-71
SLIDE 71

Mounir Assaf From Qualitative to Quantitative Information Flow 23 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

A problem : how do we count the cardinal of outputs? (ML = log2 |Outputsb|)

1

x := s mod 4

2

print x

1

s → 0,s → 1,...,s → 2N −1

2

x → 0,x → 1,x → 2,x → 3

finding the set of final states, not computable counting them !

A theory of sound semantics approximations : abstract interpretation

1

x := s mod 4

2

print x

1

s[0,2N−1]

2

x[0,3]

ML = log2(4) = 2 bits

slide-72
SLIDE 72

Mounir Assaf From Qualitative to Quantitative Information Flow 24 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

Over-approximating the set of reachable final states : a fairly large body of the literature in abstract interpretation . . .

quantifying information flow by a generic abstract interpretation (over-approximated bounds) and symbolic execution (under-approximated bounds)

[Köpf and Rybalchenko, 2010 & 2013]

slide-73
SLIDE 73

Mounir Assaf From Qualitative to Quantitative Information Flow 24 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

Over-approximating the set of reachable final states : a fairly large body of the literature in abstract interpretation . . .

quantifying information flow by a generic abstract interpretation (over-approximated bounds) and symbolic execution (under-approximated bounds)

[Köpf and Rybalchenko, 2010 & 2013]

First limitation :

1

x := s mod 2

2

x := x + input

3

print x

slide-74
SLIDE 74

Mounir Assaf From Qualitative to Quantitative Information Flow 24 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

Over-approximating the set of reachable final states : a fairly large body of the literature in abstract interpretation . . .

quantifying information flow by a generic abstract interpretation (over-approximated bounds) and symbolic execution (under-approximated bounds)

[Köpf and Rybalchenko, 2010 & 2013]

First limitation :

1

x := s mod 2

2

x := x + input

3

print x s → [0,2N −1],input → [0,2N −1]

1

x → [0,1]

2

x → [0,2N −1]

ML = log22N = N bits? no!

slide-75
SLIDE 75

Mounir Assaf From Qualitative to Quantitative Information Flow 24 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

Over-approximating the set of reachable final states : a fairly large body of the literature in abstract interpretation . . .

quantifying information flow by a generic abstract interpretation (over-approximated bounds) and symbolic execution (under-approximated bounds)

[Köpf and Rybalchenko, 2010 & 2013]

First limitation : public inputs?

1

x := s mod 2

2

x := x + input

3

print x s → [0,2N −1],input → [0,2N −1]

1

x → [0,1]

2

x → [0,2N −1]

ML = log22N = N bits? no!

slide-76
SLIDE 76

Mounir Assaf From Qualitative to Quantitative Information Flow 24 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

Over-approximating the set of reachable final states : a fairly large body of the literature in abstract interpretation . . .

quantifying information flow by a generic abstract interpretation (over-approximated bounds) and symbolic execution (under-approximated bounds)

[Köpf and Rybalchenko, 2010 & 2013]

First limitation : public inputs?

1

x := s mod 2

2

x := x + input

3

print x s → [0,2N −1],input → [0,2N −1]

1

x → [0,1]

2

x → [0,2N −1]

ML = log22N = N bits? no!

Second limitation : intermediate outputs?

slide-77
SLIDE 77

Mounir Assaf From Qualitative to Quantitative Information Flow 25 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

For each attacker-controlled low input, we have a channel – a sub-program – possibly leaking information

1

x := s mod 2

2

x := x + 1

3

print x

1

x := s mod 2

2

x := x + 2

3

print x

1

x := s mod 2

2

x := x + 3

3

print x

1

x := s mod 2

2

x := x + 4

3

print x . . . In fact, for each one of these sub-programs :

ML = log2 |Outputs| = log22 = 1 bit

slide-78
SLIDE 78

Mounir Assaf From Qualitative to Quantitative Information Flow 26 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

Compute the cardinal of reachable states – of outputs – for each possible public input?

sub-program 0 sub-program 1 . . . sub-program 2N −1 pp1 s[0,2N−1]input[0,0] s[0,2N−1]input[1,1] s[0,2N−1]input[2N−1,2N−1] pp2 x[0,1]s[0,2N−1]input[0,0] x[0,1]s[0,2N−1]input[1,1] x[0,1]s[0,2N−1]input[2N−1,2N−1] pp3 x[0,1]s[0,2N−1]input[0,0] x[1,2]s[0,2N−1]input[1,1] x[2N−1,2N]s[0,2N−1]input[2N−1,2N]

2 2 2

slide-79
SLIDE 79

Mounir Assaf From Qualitative to Quantitative Information Flow 26 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Over-approximating the leakage

Compute the cardinal of reachable states – of outputs – for each possible public input? computationally inefficient!

sub-program 0 sub-program 1 . . . sub-program 2N −1 pp1 s[0,2N−1]input[0,0] s[0,2N−1]input[1,1] s[0,2N−1]input[2N−1,2N−1] pp2 x[0,1]s[0,2N−1]input[0,0] x[0,1]s[0,2N−1]input[1,1] x[0,1]s[0,2N−1]input[2N−1,2N−1] pp3 x[0,1]s[0,2N−1]input[0,0] x[1,2]s[0,2N−1]input[1,1] x[2N−1,2N]s[0,2N−1]input[2N−1,2N]

2 2 2

Let us abstract more. . . And keep only the cardinal of values pp1 : s2N input1

slide-80
SLIDE 80

Mounir Assaf From Qualitative to Quantitative Information Flow 27 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Contents

I Information Flow II Qualitative IF III Quantitative IF

1

Relative Secrecy

2

Cardinal Abstraction

3

Tree Abstraction

IV Conclusion

slide-81
SLIDE 81

Mounir Assaf From Qualitative to Quantitative Information Flow 28 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Cardinal Abstraction

A dedicated abstract domain computing an

  • ver-approximation of the cardinal of values a variable can

take when attackers provide public inputs

1

x := s mod 2

2

x := x * input

3

print x A first step to quantify information flow for programs with low inputs Towards the combination of multiple domains to refine the cardinal abstraction

slide-82
SLIDE 82

Mounir Assaf From Qualitative to Quantitative Information Flow 28 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Cardinal Abstraction

A dedicated abstract domain computing an

  • ver-approximation of the cardinal of values a variable can

take when attackers provide public inputs

1

x := s mod 2

2

x := x * input

3

print x s → ({pp0},2N),input → ({pp0},1)

1

x → ({pp1},2)

2

x → ({pp2},2)

ML = log2(2) = 1 bit

A first step to quantify information flow for programs with low inputs Towards the combination of multiple domains to refine the cardinal abstraction

slide-83
SLIDE 83

Mounir Assaf From Qualitative to Quantitative Information Flow 29 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Contents

I Information Flow II Qualitative IF III Quantitative IF

1

Relative Secrecy

2

Cardinal Abstraction

3

Tree Abstraction

IV Conclusion

slide-84
SLIDE 84

Mounir Assaf From Qualitative to Quantitative Information Flow 30 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Tree Abstraction 1

x := s mod 2

2

print x

3

x := s * input

4

print x

1

x → ({pp1},2)

3

x → ({pp3},2) Computing a regular specification representing attackers’

  • bservations

Outputs ? ? ? ? ? ?

O2 an atomic combinatorial class

containing 2 undefined observations of size 1 Attackers’ observations :

C = O2 ·O2

slide-85
SLIDE 85

Mounir Assaf From Qualitative to Quantitative Information Flow 31 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Tree Abstraction

print y print x print z stop

Regular specifications:

concatenation · combinatorial sum ⊕ sequence construction ⋆

slide-86
SLIDE 86

Mounir Assaf From Qualitative to Quantitative Information Flow 31 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Tree Abstraction

print y (_,1) print x (_,2) print z (_,1) stop

Regular specifications:

concatenation · combinatorial sum ⊕ sequence construction ⋆

slide-87
SLIDE 87

Mounir Assaf From Qualitative to Quantitative Information Flow 31 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Tree Abstraction

print y (_,1) print x (_,2) print z (_,1) stop

Regular specifications:

concatenation · combinatorial sum ⊕ sequence construction ⋆

Attackers’ observations:

C =

  • O1 ⊕Oǫ
slide-88
SLIDE 88

Mounir Assaf From Qualitative to Quantitative Information Flow 31 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Tree Abstraction

print y (_,1) print x (_,2) print z (_,1) stop

Regular specifications:

concatenation · combinatorial sum ⊕ sequence construction ⋆

Attackers’ observations:

C =

  • O1 ⊕Oǫ

·O2

slide-89
SLIDE 89

Mounir Assaf From Qualitative to Quantitative Information Flow 31 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Tree Abstraction

print y (_,1) print x (_,2) print z (_,1) stop

Regular specifications:

concatenation · combinatorial sum ⊕ sequence construction ⋆

Attackers’ observations:

C =

  • O1 ⊕Oǫ

·O2 ·

  • O1⋆
slide-90
SLIDE 90

Mounir Assaf From Qualitative to Quantitative Information Flow 31 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Tree Abstraction

print y (_,1) print x (_,2) print z (_,1) stop

Regular specifications:

concatenation · combinatorial sum ⊕ sequence construction ⋆

Attackers’ observations:

C =

  • O1 ⊕Oǫ

·O2 ·

  • O1⋆

·O⇑

slide-91
SLIDE 91

Mounir Assaf From Qualitative to Quantitative Information Flow 32 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Generating Functions

Relying on Analytic Combinatorics to systematically translate regular specifications into Ordinary Generating Functions (OGF)

[Flajolet and Sedgewick,09]

C =

  • O1 ⊕Oǫ

· O2 ·

  • O1⋆

· O⇑

C(z) = (z +1)· 2z ·

  • 1

1−z

  • ·

z Extracting an asymptotic estimation of the leakage for polynomial time attackers by studying the singularities of the computed OGF Derived sufficient conditions on the OGF to prove Relative Secrecy

slide-92
SLIDE 92

Mounir Assaf From Qualitative to Quantitative Information Flow 33 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Contributions

Qualitative IF PWhile Monitor : A sound hybrid information flow monitor supporting pointers and aliasing A sound inlining approach Quantitative IF Relative Secrecy : Relaxing TINI while providing the same security guarantees wrt. polynomial time attackers Cardinal Abstraction : a sound analysis over-approximating the leakage for batch computations with public inputs Tree Abstraction : computing a regular specification of attackers’ observations and deriving sufficient conditions to prove Relative Secrecy

slide-93
SLIDE 93

Mounir Assaf From Qualitative to Quantitative Information Flow 33 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Contributions

Qualitative IF PWhile Monitor : A sound hybrid information flow monitor supporting pointers and aliasing A sound inlining approach Quantitative IF Relative Secrecy : Relaxing TINI while providing the same security guarantees wrt. polynomial time attackers Cardinal Abstraction : a sound analysis over-approximating the leakage for batch computations with public inputs Tree Abstraction : computing a regular specification of attackers’ observations and deriving sufficient conditions to prove Relative Secrecy

slide-94
SLIDE 94

Mounir Assaf From Qualitative to Quantitative Information Flow 34 / 36

Introduction Information Flow Qualitative IF Quantitative IF Conclusion Future Work

PWhile Monitor Overcoming an inherent limitation of the inlining approach: casts, dynamic allocation. . . Relative Secrecy Improving both the cardinal abstraction and the tree abstraction by combining different abstract domains : Numerical abstractions Selective Trace Partitioning Relational abstraction

[Miné,06]

slide-95
SLIDE 95

Mounir Assaf From Qualitative to Quantitative Information Flow 35 / 36

Last Words

❉➨✟✆❛♠➩

❍♦❧↕✝ ⑨❢❛s➫✝ ⑨t♦ ⑨❞➨✟✆❛♠➩ ❋♦r ✣✐➛✝ ⑨❞➨✟✆❛♠➩ ⑨↕✢➞❡✝ ➀✢✐➛❡✝ ✣✐➩ ⑨→✝ ⑨❜r♦➠❡✆➤✝✲➲✗✐♥➜✡✆↕✝ ⑨➣✗✐r↕✝ ❚❤❛➫✝ ⑨❝❛♥♥♦➫✝ ⑨❢➡✢➵✞✳ ❍♦❧↕✝ ⑨❢❛s➫✝ ⑨t♦ ⑨❞➨✟✆❛♠➩ ❋♦r ✇➝❡✆➤✝ ⑨❞➨✟✆❛♠➩ ⑨❣♦ ➀✢✐➛❡✝ ✣✐➩ ⑨→✝ ⑨❜❛r➨✟✆➤✝ ⑨➛✑➞❡✆❧↕✝ ❋r♦➸❡✆➤✝ ➲✗✐t➝✝ ⑨s♥♦✇✳

▲❛♥❣st♦➤✝ ❼➒✉❣➝❡✆➩