Security-Typed Programming within Dependently-Typed Programming Dan Licata Joint work with Jamie Morgenstern Carnegie Mellon University Supported by NSF CCF-0702381 and CNS-0716469
Security-Typed Programming Access control: who gets access to what? read a file play a song make an FFI call Information flow: what can they do with it? post the file contents on a blog copy the mp3 save the result in a database Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 2
Security-Typed Programming Access control: who gets access to what? read a file play a song make an FFI call Information flow: what can they do with it? post the file contents on a blog copy the mp3 save the result in a database Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 3
Access Control Access control list (ACL) for secret.txt Read secret.txt Alice: r Bob: rw Alice Server (slide by Kumar Avijit) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 4
Access Control Access control list (ACL) for secret.txt Read secret.txt Alice: r Bob: rw Alice Server Enforcement: Authentication + ACL lookup (slide by Kumar Avijit) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 4
Decentralized Access Control Digital library Read paper.pdf • All students of members can read papers • CMU is a member Alice CMU • Alice is a student • Charlie is a student • … (slide by Kumar Avijit) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 5
Decentralized Access Control Digital library Read paper.pdf • All students of members can read papers • CMU is a member Alice CMU • Alice is a student Need a mechanism to • Charlie is a student specify and enforce • … decentralized policies... (slide by Kumar Avijit) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 5
Decentralized Access Control ACM says ∀ s:principal, Digital library ∀ i:principal, • All students of ∀ p:paper, members can read papers (member(i) ⋀ i says student(s)) • CMU is a member ⊃ MayRead(s, p) ... CMU • Alice is a student • Charlie is a student CMU says student(Alice) • … ... (slide by Kumar Avijit) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 6
Proof Carrying Authorization [Appel+Felten] Digital library Read “paper.pdf” • All students of members can read papers • CMU is a member Alice CMU • Alice is a student • Charlie is a student • … (slide by Kumar Avijit) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 7
Proof Carrying Authorization [Appel+Felten] Digital library Read “paper.pdf” • All students of members can read papers • CMU is a member Alice p : mayread(Alice,paper.pdf) CMU • Alice is a student • Charlie is a student • … (slide by Kumar Avijit) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 7
Proof Carrying Authorization Read “paper.pdf” Proof OK? Alice p : mayread(Alice,paper.pdf) Access granted Runtime error Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 8
Proof Carrying Authorization • ACM says ... Policy Read “paper.pdf” Proof OK? Alice p : mayread(Alice,paper.pdf) Access granted Runtime error Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 8
Proof Carrying Authorization • ACM says ... Policy State Read “paper.pdf” Proof OK? Alice p : mayread(Alice,paper.pdf) Access granted Runtime error Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 8
An API for PCA Digital library Read “paper.pdf” Alice p : mayread(Alice,paper.pdf) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 9
An API for PCA read : prin → file → proof → contents Digital library Read “paper.pdf” Alice p : mayread(Alice,paper.pdf) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 9
An API for PCA read : prin → file → proof → contents Digital library Read “paper.pdf” Alice p : mayread(Alice,paper.pdf) { read(Alice,paper.pdf,p) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 9
An API for PCA read : prin → file → proof → contents e.g. read(Alice, paper.pdf,p) Problems: p might not be a well-formed proof p might not be a proof of the right theorem! Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 10
Dependent Types! read : prin → file → proof → contents read : (k : prin) (f : file) (p : proof(mayread(k,f)) → contents Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 11
Dependent Types! read : prin → file → proof → contents read : (k : prin) (f : file) (p : proof(mayread(k,f)) → contents typing ensures p is a well-formed proof theorem is explicit in p’s type Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 11
Verification Spectrum static dynamic Predict the policy Prove consequences statically Do all proving at run-time Failures only if prediction was wrong Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 12
Verification Spectrum Reuse proofs static dynamic for several API calls Predict the policy Prove consequences statically Do all proving at run-time Failures only if prediction was wrong Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 12
Dependent PCA Several new languages: PCML5 [Avijit,Datta,Harper, TLDI’10] Aura [Jia,Vaughan,Zdancewic, et al., ICFP’08 ] Fine [Swamy,Chen,Chugh, ESOP’10] F7 [Gordon,Bengston,Bhargavan,Fournet,Maffeis, CSF’08] … Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 13
This paper: We can do security-typed programming within an existing dependently-typed language Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 14
Our library Supports programming as in PCML5 [Avijit,Datta,Harper, TLDI’10] Aura [Jia,Vaughan,Zdancewic, et al., ICFP’08 ] Fine [Swamy,Chen,Chugh, ESOP’10] F7 [Gordon,Bengston,Bhargavan,Fournet,Maffeis, CSF’08] … Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 15
Aglet: Security-typed Programming in Agda 1.Representing an authorization logic 2.Compile-time and run-time theorem proving 3.Stateful and dynamic policies Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 16
Aglet: Security-typed Programming in Agda 1.Representing an authorization logic 2.Compile-time and run-time theorem proving 3.Stateful and dynamic policies Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 17
Dependent Types! read : file → prin → proof → contents read : (k : prin) (f : file) (p : proof(mayread(k,f)) → contents typing ensures p is a well-formed proof theorem is explicit in p’s type Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 18
Representing BL 0 [Garg+Pfenning] says (Prin CMU, CMU says student(Alice) student(Prin Alice)) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 19
Representing BL 0 [Garg+Pfenning] says (Prin CMU, CMU says student(Alice) student(Prin Alice)) data Propo where says : Principal → Propo → Propo ... Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 19
Representing BL 0 [Garg+Pfenning] Sequent as indexed inductive definition: data _ ⊢ _ : Ctx → Propo → Type Γ ⊢ A Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 20
Representing BL 0 [Garg+Pfenning] Sequent as indexed inductive definition: data _ ⊢ _ : Ctx → Propo → Type Γ ⊢ A Classifying only well-formed derivations: D D : Γ ⊢ A Γ ⊢ A Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 20
Representing BL 0 [Garg+Pfenning] Sequent as indexed inductive definition: data _ ⊢ _ : Ctx → Propo → Type Γ ⊢ A Classifying only well-formed derivations: D D : Γ ⊢ A Γ ⊢ A Inference rules as datatype constructors: ⊃ R : ∀ { Γ A B} Γ , A ⊢ B → (A :: Γ ) ⊢ B Γ ⊢ A ⊃ B → Γ ⊢ (A ⊃ B) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 20
Representing BL 0 [Garg+Pfenning] Sequent as indexed inductive definition: data _ ⊢ _ : Ctx → Propo → Type Γ ⊢ A Classifying only well-formed derivations: D D : Γ ⊢ A Γ ⊢ A Inference rules as datatype constructors: dependent ⊃ R : ∀ { Γ A B} Γ , A ⊢ B de Bruijn → (A :: Γ ) ⊢ B Γ ⊢ A ⊃ B indices → Γ ⊢ (A ⊃ B) Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 20
BL0 [Garg+Pfenning] Logic with says modality: CMU says student(Alice) principal we’re reasoning as k Ω ; Δ ; Γ → A individuals: claims: truth: x : τ k claims A A true Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 21
Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 22
Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 22
Outline 1.Representing an authorization logic 2.Compile-time and run-time theorem proving 3.Stateful and dynamic policies Security-Typed Programming within DTP Dan Licata and Jamie Morgenstern 23
Recommend
More recommend
