Practical Mostly-Static Information Flow Control Andrew Myers MIT - - PowerPoint PPT Presentation

▶
practical mostly static information flow control
SMART_READER_LITE
LIVE PREVIEW

Practical Mostly-Static Information Flow Control Andrew Myers MIT - - PowerPoint PPT Presentation

Oct 30, 2022 640 likes •893 views

Practical Mostly-Static Information Flow Control Andrew Myers MIT Lab for Computer Science Privacy Old problem (secrecy, confidentiality) : prevent programs from leaking data Untrusted, downloaded code: more important Standard

slide-1
SLIDE 1

Practical Mostly-Static Information Flow Control

Andrew Myers MIT Lab for Computer Science

slide-2
SLIDE 2

Andrew Myers Practical Mostly-Static Information Flow Control

2

Privacy

  • Old problem (secrecy, confidentiality) :

prevent programs from leaking data

  • Untrusted, downloaded code: more

important

  • Standard security mechanisms not

effective (e.g., access control)

A B C

slide-3
SLIDE 3

Andrew Myers Practical Mostly-Static Information Flow Control

3

Privacy with Mutual Distrust

WebTax Tax Data Final Tax Form Proprietary Database Bob Preparer

slide-4
SLIDE 4

Andrew Myers Practical Mostly-Static Information Flow Control

4

Static Information Flow

  • Denning & Denning ’77
  • Programs must follow rules
  • Annotations added for tractability
  • Static analysis = type checking
  • Security property composes

A B A B + =

slide-5
SLIDE 5

Andrew Myers Practical Mostly-Static Information Flow Control

5

Jif Language

  • Jif = Java + information flow annotations

(Java Information Flow)

  • More practical than previous work

– Real language: supports Java features – Convenience: automatic label inference – Genericity: label polymorphism – Decentralized declassification mechanism – Run-time label checking

slide-6
SLIDE 6

Andrew Myers Practical Mostly-Static Information Flow Control

6

Architecture

  • Source to source translator (mostly erasure)
  • Modification to the PolyJ compiler

(Java + parametric polymorphism)

Program Java source Jif compiler Label annotations Java compiler Class file (Bytecode)

Label annotations Class file (Bytecode)

slide-7
SLIDE 7

Andrew Myers Practical Mostly-Static Information Flow Control

7

Jif Features

  • Labeled types
  • Convenience: automatic label inference
  • Genericity: label polymorphism
  • Static, decentralized declassification
  • Safe run-time label checking (first-class labels)
  • First-class principals
  • Object-oriented features

– Subtyping rules – Inheritance – Constructors – Method constraints

  • Exceptions
  • Arrays
  • Described by formal inference rules
slide-8
SLIDE 8

Andrew Myers Practical Mostly-Static Information Flow Control

8

Labeled Types

  • Variables, expressions have labeled type T{L}
  • Labels express privacy constraints
  • L2 is at least as restrictive as L1: L1 ⊑L2
  • Assignment rule (simplified)

v : T{Lv} ∈ A A ⊢ E : Le Le ⊑Lv A ⊢ v = E : Le

slide-9
SLIDE 9

Andrew Myers Practical Mostly-Static Information Flow Control

9

Decentralized Label Model

  • Label is a set of policies
  • Each policy is owner : reader1 , reader2 , ...

– owner (principal) – set of readers (principals) { Bob : Bob, Preparer ; Preparer : Preparer }

  • Every owner’s policy is obeyed
  • Relation ⊑is pre-order w/lattice properties [ML98]
slide-10
SLIDE 10

Andrew Myers Practical Mostly-Static Information Flow Control

10

Implicit Label Polymorphism

  • Method signatures contain labeled types

float {Bob: Bob} cos (float {Bob: Bob} x) {

float {Bob: Bob} y = x – 2*PI*(int)(x/(2*PI)); return 1 - y*y/2 + ...; }

  • Omitted argument labels: implicit label

polymorphism

float{x} cos (float x) { float y = x – 2*PI*(int)(x/(2*PI)); return 1 - y*y/2 + ...; }

slide-11
SLIDE 11

Andrew Myers Practical Mostly-Static Information Flow Control

11

Explicit Parameterization

class Cell[label L] { private Object{L} y; public void store{L} ( Object{L} x ) { y = x; } public Object{L} fetch ( ) { return y; } } Cell[{Bob: Amy}]

  • Straightforward analogy with type

parameterization

  • Allows generic collection classes
  • Parameters not represented at run time
slide-12
SLIDE 12

Andrew Myers Practical Mostly-Static Information Flow Control

12

Declassification

  • A principal can rewrite its part of the label

{O1: R1, R2; O2: R2} {O1: R1, R2} {O1: R1, R2; O2: R2, R3} O2

  • Other owners’ policies still respected
  • Must know authority of running process
  • Potentially dangerous: explicit operation

declassify(E, L)

slide-13
SLIDE 13

Andrew Myers Practical Mostly-Static Information Flow Control

13

Static Authority

  • Authority of code is tracked statically

class C authority(root) { ... }

  • Authority propagated dynamically:

void m(principal p, int {root:} x) where caller(p) { actsFor(p, root) { int{} y = declassify(x, {}) // checked statically } else { // can’t declassify x here } }

slide-14
SLIDE 14

Andrew Myers Practical Mostly-Static Information Flow Control

14

Implicit Flows and Exceptions

  • Implicit flow: information

transferred through control structure

  • Static program counter

label (pc) that expression label always includes

  • Fine-grained exception

handling: pc transfers via exceptions, break, continue

x = false; if (b) { x = true; } x = false; try { if (b) throw new Foo (); } catch (Foo f) { x = true; } x = b;

{b} ⊑{x}

slide-15
SLIDE 15

Andrew Myers Practical Mostly-Static Information Flow Control

15

class Cell[label L] { private Object{L} y; public void store{L} ( Object{L} x ) { y = x; } public Object{L} fetch ( ) { return y; } }

Methods and Implicit Flows

  • Begin-label constrains calling pc : pc ⊑{L}
  • Prevents implicit flow into method
  • Omitted begin-label: implicit parameter,

prevents mutation

begin-label = pc implicit begin-label

slide-16
SLIDE 16

Andrew Myers Practical Mostly-Static Information Flow Control

16

Run-time Labels

  • Labels may be first-class values, label
  • ther values:

final label a = ...; int{*a} b;

  • Run-time label treated statically like

label parameter: unknown fixed label

  • Exists at run time (Jif.lang.Label)
  • int{*a} is dependent type
slide-17
SLIDE 17

Andrew Myers Practical Mostly-Static Information Flow Control

17

Run-time Label Discrimination

  • switch label statement tests a run-time label

dynamically: final label a = ... ; int{*a} b; int { C: D } x; switch label(b) { case ( int { C: D } b2 ) x = b2; else throw new BadLabelCast(); } tests a ⊑ { C : D } at run time

slide-18
SLIDE 18

Andrew Myers Practical Mostly-Static Information Flow Control

18

Run-time Labels and Implicit Flows

  • Proper check is {b} ⊑{x}
  • In case clause, pc augmented with label of label a

(which is {b})

  • Therefore: x = true results in proper check

final label{b} a = b ? new label {L1} : new label {L2}; int{*a} dummy; switch label(dummy) { case ({L1}) : x = true; case ({L2}) : x = false; } x = b;

slide-19
SLIDE 19

Andrew Myers Practical Mostly-Static Information Flow Control

19

Implementation

  • Translates to efficient Java, mostly by erasure

– Labeled types become unlabeled types – Label parameters erased

  • First-class label, principal values remain
  • switch label, actsFor translated simply
slide-20
SLIDE 20

Andrew Myers Practical Mostly-Static Information Flow Control

20

Is it Practical yet?

  • Addresses limitations of earlier approaches to

checking information flow statically

– allows run-time checking – infers annotations – limited declassification mechanism – genericity: implicit & explicit polymorphism

  • Greater expressiveness and convenience
  • Only small programs so far
  • Can reuse existing Java code
  • Only sequential programs, no timing channels
slide-21
SLIDE 21

Andrew Myers Practical Mostly-Static Information Flow Control

21

Related Work

Denning, Denning. CACM 1977 Palsberg, Ørbæk. ISSA 1995 Volpano, Smith, Irvine. JCS 1996 Myers, Liskov. SOSP 1997, IEEE S&P 1998 Heintze, Riecke. POPL 1998 Smith, Volpano. POPL 1998 Abadi, Banerjee, Heintze, Riecke. POPL 1999

slide-22
SLIDE 22

Andrew Myers Practical Mostly-Static Information Flow Control

22

Conclusions

  • Most practical language yet for static

enforcement of privacy

  • Promising; more experience needed to

understand limitations

  • Why not 20 years ago?
slide-23
SLIDE 23

Andrew Myers Practical Mostly-Static Information Flow Control

23

Inheritance/Subtyping

  • Subclass signature (1) constrained by

superclass signature (2)

  • Argument, begin-label a : { a2 } ⊑{ a1 }
  • Return value, exception r : { r1 } ⊑{ r2 }
  • Class authority (set of principals) can only

increase with inheritance : A1 ⊇ A2 C2 C1