Information Flow in Boxed Ambient I. Salvo a joint work ( in - - PowerPoint PPT Presentation

▶
information flow in boxed ambient
SMART_READER_LITE
LIVE PREVIEW

Information Flow in Boxed Ambient I. Salvo a joint work ( in - - PowerPoint PPT Presentation

Dec 18, 2023 37 likes •318 views

Information Flow in Boxed Ambient I. Salvo a joint work ( in progress ) with: M. Bugliesi, G. Castagna, S. Crafa journees methode formelle pour la mobilit` e, Paris, December 6, 2002 1 Outline of the talk From Mobile Ambients to

slide-1
SLIDE 1

Information Flow in Boxed Ambient

  • I. Salvo

a joint work (in progress) with:

  • M. Bugliesi, G. Castagna, S. Crafa

journees “methode formelle pour la mobilit` e”, Paris, December 6, 2002

1

slide-2
SLIDE 2

Outline of the talk

  • From Mobile Ambients to NBA
  • Information Flow in Distributed Systems
  • A Type System for Information Flow in Boxed

Ambients

  • Conclusions and Future Work

2

slide-3
SLIDE 3

Ambient Calculus

[Cardelli & Gordon 98]

  • Main Motivation:

– Define a calculus to model mobile computations (programming the Web)

  • Formalize:

– Named places (ambients) where computations happen – Hierarchical structure – Movement between places – Asyncronous communication among processes running in parallel inside the same ambient

3

slide-4
SLIDE 4

Operational Semantics

A process may:

  • communicate locally in an asyncronous way:

M | (x).P − → P{x := M}

  • cause the enclosing ambient to move inside or
  • utside another ambient:

n[in m.P | Q] | m[R] − → m[n[P | Q] | R] m[n[out m.P | Q] | R] − → n[P | Q] | m[R]

  • destroy the boundary of a sub-ambient:
  • pen n.P | n[Q] −

→ P | Q

4

slide-5
SLIDE 5

“Boxing” Ambients

[Bugliesi, Castagna & Crafa, 01]

  • open is essential for communication, but:

– Dangerous for security: m[in n.bad] | n[open m.P] − → n[P | bad] – Complicates type systems

  • Drop the open capability
  • Introduce parent-child communication for ex-

pressivess

5

slide-6
SLIDE 6

Boxed Ambient

(Local) (x)P | MQ − → P{x := M} | Q (Input n) (x)nP | n[M | Q] − → P{x := M} | n[Q] (Output n) Mn | n[(x)P | Q] − → n[P{x := M} | Q] (Input ↑) M | n[(x)↑P | Q] − → n[P{x := M} | Q] (Output ↑) (x)P | n[M↑ | Q] − → P{x := M} | n[Q]

6

slide-7
SLIDE 7

Boxed Ambient: Discussion

  • Powerful Communication Mechanism

Example: Broadcast

n[!M | m[(x)↑ | . . .] | . . . | p[(x)↑ | . . .]]

  • Source of grave interference

m[ (x)n .P | n[ M | (x) .Q | k[ (x)↑ .R]]]

7

slide-8
SLIDE 8

Boxed Ambient (II)

[Bugliesi, Castagna & Crafa, 02]

  • two non-interfering channels for local and up-

ward communication: (Local) (x)P | MQ − → P{x := M} | Q (Input n) (x)nP | n[M↑ | Q] − → P{x := M} | n[Q] (Output n) Mn | n[(x)↑P | Q] − → n[P{x := M} | Q]

8

slide-9
SLIDE 9

NBA Calculus

[Bugliesi, Crafa, Merro & Sassone 02]

  • Expressiveness:

– Ambients must statically know their children – do not learn about incoming ambients

  • Introduce coaction as binder:

n[enterm, k.P | Q] | m[enter(x, k).R | S] − → m[n[P | Q] | R{x := n} | S] n[m[exitn, k.P | Q] | R] | exit(x, k).S − → m[P | Q] | n[R] | S{x := m}

9

slide-10
SLIDE 10

NBA: Discussion

  • Expressiveness: using guarded choice allow to en-

code the first version of BA

  • Nice equational laws: LTS sematics
  • Barbs:

P ↓n iff P ≡ (ν m)(n[enter(x, k).Q | R] | S) P ⇓n iff ∃Q and P − →∗ Q, Q ↓n

  • It is equivalent to observe ·↑

10

slide-11
SLIDE 11

NBA Type System

  • Types:

Message Types W ::= N[E] ambient/password |

C[E]

capability Exchange Types E, F ::= Shh silent process | W1 . . . Wk Tuples, k ≥ 0 Process Types T ::= [E, F] local/upward exchange

11

slide-12
SLIDE 12

NBA Typing Rules

Γ ⊢ M : N[E] Γ ⊢ N : N[F] (Exit) Γ ⊢ exitM, N : C[F] Γ ⊢ M : N[F] Γ ⊢ P : [E, F] (Amb) Γ ⊢ M[P] : T Γ ⊢ M : N[ ˜ W] Γ, ˜ x : ˜ W ⊢ P : T (Input M) Γ ⊢ (˜ x : ˜ W)M.P : T Γ, ˜ x : ˜ W ⊢ P : [E, ˜ W] (Input ↑) Γ ⊢ (˜ x : ˜ W)↑P : [E, ˜ W] Γ ⊢ M : ˜ W Γ ⊢ P : [ ˜ W, E] (Output) Γ ⊢ M.P : [ ˜ W, E] Γ ⊢ M : N[ ˜ W] Γ, x : N[ ˜ W] ⊢ P : [E, F] (Co-Exit) Γ ⊢ exit(x, M).P : [E, F]

12

slide-13
SLIDE 13

Outline of the talk

  • From Mobile Ambients to NBA
  • Information Flow in Distributed Systems
  • A Type System for Information Flow in Boxed

Ambients

  • Conclusions and Future Work

13

slide-14
SLIDE 14

MAC Security Policy in NBA

  • Each Ambient has a security clearance (types)
  • Consider a set of subjects (Processes) and of ob-

jects (Ambients)

  • Define a security policy (e.g no read-up, no write-

down)

  • Read Access: m[(x)nP | n[M↑Q | R] | S]
  • Write Access: m[MnP | n[(x)↑Q | R] | S]

14

slide-15
SLIDE 15

Implicit Information Flows

  • The behavior of a low level entity depends

indirectly from high level ones

  • Example: testing the existence of a high level pro-

cess maybe a relevant information

  • Information flow is difficult to formalize:

non interference (Goguen, Meseguer 82)

15

slide-16
SLIDE 16

Example: e-commerce

  • Consider an agent P that visits sites that offer a

given service

  • P stores the offer in its private aerea H
  • We do not want a new offer depends on previously

stored data and the vendors know the agent visited

  • ther sites

P ≡ l[!enter(x, k).enterh, k′ | Q | h[!enter(x, k′).R | S]]

16

slide-17
SLIDE 17

What the Example Shows

  • The secret component contains low-level subcom-

ponents

  • Testing the presence of the secret component is a

relevant information

  • To enter the secret component a capability is com-

municated (low level information)

  • Information inside H will be inside other secrets

components

17

slide-18
SLIDE 18

What has been done so far...

[HR98, BCC02, ...]

  • Usual approaches: Consider Γ ⊢ H a high level

process

  • Only well-typed contexts wrt a type system which

discards “dangerous” flows of information

  • Interference Free Processes P

is interference free if, for all high level sources H, P | H ∼ =L P P ∼ =L Q iff ∀C(), C(P) ⇓l⇐ ⇒ C(Q) ⇓l

18

slide-19
SLIDE 19

Our (forthcoming) approach

  • Consider processes typed in a lightweight type sys-

tem without information flow constraints

  • Define the set of interference free process
  • Define a type system that accepts only interference

free processes

19

slide-20
SLIDE 20

Non Interference (revisited)

  • High Level Sources H is a high level source if

(ν h)H ∼ = 0, where h is the set of high free names of H

  • Interference Free Processes P

is interference free if, for all high level sources H, (ν h)(P | H) ∼ = (ν h)P, where h is the set of high free names of H and P

20

slide-21
SLIDE 21

Outline of the talk

  • From Mobile Ambients to NBA
  • Information Flow in Distributed Systems
  • A Type System for Information Flow in Boxed

Ambients

  • Conclusions and Future Work

21

slide-22
SLIDE 22

Security Types for NBA

  • Types:

Message Types W ::= N[σ, E] ambient/password |

C[σ, E]

capability Exchange Types E, F ::= Shh silent process | W1 . . . Wk Tuples, k ≥ 0 Process Types T ::= [σ, E, F] local/upward exchange

22

slide-23
SLIDE 23

Security Types for NBA

Clearence of types:

α(N[σ, E]) = σ α(C[σ, E]) = ⊥ α(W1 . . . Wk) = maxi α(Wi)

Type formation rules:

Γ ⊢ E Γ ⊢ α(E) ≤ σ (Type Amb) Γ ⊢ N[σ, E] Γ ⊢ Ei Γ ⊢ α(Ei) ≤ σ (Type Proc) Γ ⊢ [σ, E1, E2]

23

slide-24
SLIDE 24

“Information Flow” Types for NBA

  • Message types becomes: N[σ, τ, E]
  • Judgement has the shape:

Γ ⊢φ P : [σ, E, F]

24

slide-25
SLIDE 25

“Information Flow” Types Rules

Γ ⊢ M : N[τ, ρ, E] Γ, x : N[τ, −, ˜ W] ⊢τ P : [σ, E, F] (CoExit) Γ ⊢φ exit(x, M).P : [σ, E, F] provided Safe(σ, φ, τ) ρ = H & τ = L ⇒ σ = H Γ ⊢ M : N[τ, −, ˜ W] Γ, ˜ x : ˜ W ⊢τ P : [σ, E, F] Safe(σ, φ, τ) (Input M) Γ ⊢ (˜ x : ˜ W)M.P : [σ, E, F]

25

slide-26
SLIDE 26

Outline of the talk

  • From Mobile Ambients to NBA
  • Information Flow in Distributed Systems
  • A Type System for Information Flow in Boxed

Ambients

  • Conclusions and Future Work

26

slide-27
SLIDE 27

Conclusion and Future Work

  • Main achievement: “type indepedent” definition of

interference free process

  • Study less restrictive type system
  • Apply this approach to π-calculus and compare

with previous work

27

slide-28
SLIDE 28

Outline of the talk

  • From Mobile Ambients to NBA
  • Information Flow in Distributed Systems
  • A Type System for Information Flow in Boxed

Ambients

  • Conclusions and Future Work

28