SLIDE 1 Information flow safety in multiparty sessions
Sara Capecchi, Ilaria Castellani and Mariangiola Dezani-Ciancaglini
(TORINO University and INRIA Sophia Antipolis Méditerranée)
Behavioural Types Workshop Lisbon, 19-21 April 2011
SLIDE 2 General goal
Information flow control in multiparty sessions where data may have different security levels.
A finite lattice of security levels :
T
⊥
l l’
... ... Secure information flow: the send or receive of a value can only depend on a receive or test of a value with l ≤ l
l
v vl0
levels assigned to variables and values
SLIDE 3 General goal
Information flow control in multiparty sessions, to preserve confidentiality of participant data.
- Security (detection): behavioural property based on
- Typing (prevention): session type system with security
How to prevent / detect information leaks ?
- bservational equivalence / bisimulation
SLIDE 4 Goal (past)
Information flow control in multiparty sessions, to preserve confidentiality of participant data.
- Security (detection): behavioural property based on
- Typing (prevention): session type system with security
How to prevent / detect information leaks ?
- bservational equivalence / bisimulation
⇓
done in previous work [CCD & Rezk, CONCUR’10]
SLIDE 5 Goal (present)
Information flow control in multiparty sessions, to preserve confidentiality of participant data.
- Security (detection): behavioural property based on
- Typing (prevention): session type system with security
How to prevent / detect information leaks ?
- bservational equivalence / bisimulation
- Safety (detection): induced by a monitored semantics
SLIDE 6 Tracking information leaks
3 ways to prevent / detect information leaks:
s[1]?(2, x⊤).s[1]!2, true⊥
- Safety (local detection): any “semantic leak” is bad
- Security (global detection): any “global semantic leak”,
- Typability (prevention): any “syntactic leak” is bad
detectable by observing the overall process, is bad typical leak:
SLIDE 7 Tracking information leaks
3 ways to prevent / detect information leaks:
s[1]?(2, x⊤).s[1]!2, true⊥
- Safety (local detection): any “semantic leak” is bad
- Security (global detection): any “global semantic leak”,
- Typability (prevention): any “syntactic leak” is bad
detectable by observing the overall process, is bad
ν(a)(a[1](α).
)
SLIDE 8 Tracking information leaks
Another typical information leak:
- Safety (local detection): any “semantic leak” is bad
- Security (global detection): any “global semantic leak”,
- Typability (prevention): any “syntactic leak” is bad
detectable by observing the overall process, is bad
if x⊤ then s[1]!2, true⊥ else s[1]!2, false⊥
s[1]?(2, x⊤).
SLIDE 9 Tracking information leaks
Another typical information leak:
- Safety (local detection): any “semantic leak” is bad
- Security (global detection): any “global semantic leak”,
- Typability (prevention): any “syntactic leak” is bad
detectable by observing the overall process, is bad
if x⊤ then s[1]!2, true⊥ else s[1]!2, true⊥
s[1]?(2, x⊤).
SLIDE 10 Relating the three properties
Relationship between the three properties ? detectable by observing the overall process, is bad
- Safety (local detection): any “semantic leak” is bad
- Security (global detection): any “global semantic leak”,
- Typability (prevention): any “syntactic leak” is bad
⇓ ⇓ ?
?
SLIDE 11 Relating the three properties
Relationship between the three properties ? detectable by observing the overall process, is bad
- Safety (local detection): any “semantic leak” is bad
- Security (global detection): any “global semantic leak”,
- Typability (prevention): any “syntactic leak” is bad
⇓
SLIDE 12 Multiparty sessions
a
initiator : starts a new session on service
when there are n suitable participants
¯ a[n]
Multiparty session: activation of an n-ary service arity roles
| a[1](α1).P1 | · · · | a[n](αn).Pn
¯ a[n]
[Honda, Yoshida, Carbone POPL
’08]
a
SLIDE 13
Security session calculus
SLIDE 14
Syntax: processes
SLIDE 15
Runtime syntax: queues
Text
SLIDE 16
Semantics: configurations
SLIDE 17
Semantics: computational rules
SLIDE 18
Semantics: choice
SLIDE 19
Online medical service
SLIDE 20
Online medical service (ctd)
SLIDE 21
Monitored semantics
SLIDE 22
Monitored semantics rules
SLIDE 23
Monitored semantics rules (ctd)
SLIDE 24
Safety: 1st attempt
SLIDE 25
Safety: definition
SLIDE 26
Security
SLIDE 27
Security (ctd)
SLIDE 28
Main results
SLIDE 29
Main results (ctd)
SLIDE 30 Conclusion and future work
- Complete the picture by showing typability => safety
[Submitted, full version soon on our web pages]
- Attach reputation and trust to participants, and
- Explore monitored semantics with labelled transitions,
possibly use them to refine delegation. to return informative error messages to the programmer.
