A Temporal Logic Approach to Information-flow Control

Transcription

1 A Temporal Logic Approach to Information-flow Control Markus N. Rabe Saarland University UC Berkeley Berkeley, September

2 Collaborations with Rayna Dimitrova, Bernd Finkbeiner, Máté Kovács, and Helmut Seidl. Model Checking Information Flow in Reactive Systems. In Proceedings of the 13th International Conference on Verification, Model Checking, and Abstract Interpretation (VMCAI), pages , with Michael Clarkson, Bernd Finkbeiner, Masoud Koleini, Kristopher K. Micinski, and César Sánchez. Temporal Logics for Hyperproperties. In Proceedings of the 3rd Conference on Principles of Security and Trust (POST), pages , with Peter Lammich, and Andrei Popescu. A shallow embedding of HyperCTL. Archive of Formal Proofs, April Formal proof development. with Bernd Finkbeiner The Linear-Hyper-Branching Spectrum of Temporal Logics. it-information Technology, 56, no. 6, pages , with Bernd Finkbeiner and César Sánchez. Algorithms for Model Checking HyperLTL and HyperCTL. In Proceedings of the 27th International Conference on Computer Aided Verification (CAV), pages 30-48, / 29

3 Verification for information security I h I l plant controller/ web server/ ethernet module/ O h O l Secrecy/confidentiality No matter how we twiggle the secret, the observer can t tell a difference. 3 / 29

4 I What is information-flow control? II HyperLTL and HyperCTL III Case studies/hardware security 4 / 29

5 Part I What is information-flow control? 5 / 29

6 Incidents Major incidents in information security Heartbleed if ( payload + 16 > s->s3->rrec.length) return 0; Goto Fail if ((err = SSLHashSHA1.update(&hashCtx, &signedparams))!= 0) goto fail; goto fail; Shellshock parse_and_execute (temp_string, name, SEVAL_NONINT SEVAL_NOHIST); 6 / 29

7 Incidents Major incidents in information security Heartbleed 4.5m patient records leaked if ( payload + 16 > s->s3->rrec.length) return 0; Goto Fail encryption of >300M devices broken if ((err = SSLHashSHA1.update(&hashCtx, &signedparams))!= 0) goto fail; goto fail; Shellshock web servers attackable for 22 years parse_and_execute (temp_string, name, SEVAL_NONINT SEVAL_NOHIST); 6 / 29

8 Incidents Embedded systems/hardware security Programming errors happen frequently Hard to fix once shipped Specification Updates 7 / 29

9 Information-flow Control Information-flow control System view: High/low inputs/outputs I h I l plant controller/ web server/ ethernet module/ O h O l Security policies (confidentiality and integrity) Noninterference, generalized noninterference, observational determinism, declassification, quantitative noninterference, 8 / 29

10 Information-flow Control Noninterference/observational determinism webserver I client I s2c OpenSSL O server O client The users observations are independent of other users interactions. 9 / 29

11 Information-flow Control Noninterference/observational determinism webserver I client I s2c OpenSSL O server O client The users observations are independent of other users interactions. The users observations are deterministic in its public inputs: t, t : t = Ic,s2c t t = Oclient t 9 / 29

12 Information-flow Control Noninterference/observational determinism I client webserver I s2c OpenSSL O server Disclaimer: Heartbleed not solved yet by IFC! O client The users observations are independent of other users interactions. The users observations are deterministic in its public inputs: t, t : t = Ic,s2c t t = Oclient t 9 / 29

13 Information-flow Control Enforcement/analysis techniques Security type systems Program analysis Manual proofs Dynamic approaches/taint tracking Common problems: single-property techniques inherently imprecise 10 / 29

14 Information-flow Control Diversity of properties webserver I client I s2c OpenSSL O server O client Client status (unknown, authenticated, blocked, ) What is I i2c, I client, O client precisely? 11 / 29

15 Part II HyperLTL and HyperCTL 12 / 29

16 Temporal logics Noninterference not expressible in CTL AAφ? i i i i i i i i i i i i i i 13 / 29

17 Temporal logics Noninterference not expressible in CTL AAφ? i i i i i i i i i i i i i i 13 / 29

18 Temporal logics Noninterference not expressible in CTL AAφ? i i i i i i i i i i i i i i ϕ 13 / 29

19 Temporal logics Noninterference not expressible in CTL AAφ? i i i i i i i i i i i i i i ϕ Theorem [Alur et al. 06]: Noninterference is not a regular tree language. 13 / 29

20 Temporal logics HyperLTL and HyperCTL Quantifiers with path variables: π.φ π.φ Syntax: φ ::= a π π.φ π.φ Xφ Gφ φ U φ / 29

21 Temporal logics HyperLTL and HyperCTL Quantifiers with path variables: π.φ π.φ Syntax: φ ::= a π π.φ π.φ Xφ Gφ φ U φ... Formulas in prenex form are HyperLTL. 14 / 29

22 Temporal logics HyperLTL and HyperCTL Quantifiers with path variables: π.φ π.φ Syntax: φ ::= a π π.φ π.φ Xφ Gφ φ U φ... Formulas in prenex form are HyperLTL. Noninterference/observational determinism: π. π. G(i π i π ) G(o π o π ) 14 / 29

23 Temporal logics Semantics (HyperLTL) Π = K a π iff a L(Π(π)(0)) Π = K Gφ iff i 0 : Π[i, ] = K φ Π = K π. φ iff p Paths K ( s init ) : Π[π p] = K φ 15 / 29

24 Temporal logics Semantics (HyperLTL) Π = K a π iff a L(Π(π)(0)) Π = K Gφ iff i 0 : Π[i, ] = K φ Π = K π. φ iff p Paths K ( s init ) : Π[π p] = K φ π. π. G(i π i π ) G(o π o π ) i i i i i i i i i i i i i i 15 / 29

25 Temporal logics Semantics (HyperLTL) Π = K a π iff a L(Π(π)(0)) Π = K Gφ iff i 0 : Π[i, ] = K φ Π = K π. φ iff p Paths K ( s init ) : Π[π p] = K φ π. π. G(i π i π ) G(o π o π ) 1. {π p} = K π. G(...) G(...) i i i i i i i i i i i i i i π 15 / 29

26 Temporal logics Semantics (HyperLTL) Π = K a π iff a L(Π(π)(0)) Π = K Gφ iff i 0 : Π[i, ] = K φ Π = K π. φ iff p Paths K ( s init ) : Π[π p] = K φ π. π. G(i π i π ) G(o π o π ) 1. {π p} = K π. G(...) G(...) 2. {π p, π p } = K G(...) G(...) i i i i i i i i i i i i i i π π 15 / 29

27 Temporal logics Semantics (HyperLTL) Π = K a π iff a L(Π(π)(0)) Π = K Gφ iff i 0 : Π[i, ] = K φ Π = K π. φ iff p Paths K ( s init ) : Π[π p] = K φ π. π. G(i π i π ) G(o π o π ) 1. {π p} = K π. G(...) G(...) i i i i i i 2. {π p, π p } = K G(...) G(...) 3. i N : {π p[i, ], π p [i, ]} = K i π i π i i i i i i i i π π 15 / 29

28 Temporal logics Semantics (HyperLTL) Π = K a π iff a L(Π(π)(0)) Π = K Gφ iff i 0 : Π[i, ] = K φ Π = K π. φ iff p Paths K ( s init ) : Π[π p] = K φ π. π. G(i π i π ) G(o π o π ) 1. {π p} = K π. G(...) G(...) i i i i i i 2. {π p, π p } = K G(...) G(...) 3. i N : {π p[i, ], π p [i, ]} = K i π i π i i i i i i i i π π 4. i N : {π p[i, ], π p [i, ]} = K o π o π 15 / 29

29 Temporal logics Semantics (HyperCTL ) Π = K a π iff a L(Π(π)(0)) Π = K Gφ iff i 0 : Π[i, ] = K φ Π = K π. φ iff p Paths K (Π(π )(0)) : Π[π p, π p] = K φ π. π. G(i π i π ) G(o π o π ) 1. {π p} = K π. G(...) G(...) i i i i i i 2. {π p, π p } = K G(...) G(...) 3. i N : {π p[i, ], π p [i, ]} = K i π i π i i i i i i i i π π 4. i N : {π p[i, ], π p [i, ]} = K o π o π 15 / 29

30 Temporal logics Variants of confidentiality Noninference [McLean 94] π. π. (Gλ π ) G(lowIn π = lowin π lowout π = lowout π ) Generalized noninterference [McCullough 88] π. π. π. G(highIn π = highin π ) G(lowIn π = lowin π lowout π = lowout π ) Observational determinism [Zdancewich&Myers 03] π. π. lowin π = lowin π G(lowOut π = lowout π ) 16 / 29

31 Temporal logics Expressiveness Natural encodings of security policies. Symmetries in protocols Error correcting codes Subsume other temporal logics: LTL, CTL, CTL SecLTL Epistemic temporal logic (perfect recall semantics) 1 1 With one of two minor assumptions 17 / 29

32 Model Checking Algorithm Model checking complexity Complexity depends on the quantifier alternation depth. 0. π. π.ψ PSPACE in ψ, NLOGSPACE in K Observational determinism Goguen&Meseguer noninterference 18 / 29

33 Model Checking Algorithm Model checking complexity Complexity depends on the quantifier alternation depth. 0. π. π.ψ PSPACE in ψ, NLOGSPACE in K Observational determinism Goguen&Meseguer noninterference 1. π. π.ψ EXPSPACE in ψ, PSPACE in K 2. Noninference Generalized noninterference 18 / 29

34 Model Checking Algorithm Model checking complexity Complexity depends on the quantifier alternation depth. 0. π. π.ψ PSPACE in ψ, NLOGSPACE in K Observational determinism Goguen&Meseguer noninterference 1. π. π.ψ EXPSPACE in ψ, PSPACE in K 2. Noninference Generalized noninterference Rarely need more than one quantifier alternation! 18 / 29

35 Model Checking Algorithm Symbolically model checking circuits Alternation-free HyperLTL and HyperCTL Clean extension of the circuit construction for LTL Leverages existing symbolic model checkers (e.g. ABC) 19 / 29

36 Model Checking Algorithm A Circuit Based Approach π. π. G(i π i π ) G(o π o π ) 20 / 29

37 Model Checking Algorithm A Circuit Based Approach π. π. G(i π i π ) G(o π o π ) Negated: π. π. G(i π i π ) F(o π o π ) G(i π i π ) F(o π o π ) 20 / 29

38 Model Checking Algorithm A Circuit Based Approach π. π. G(i π i π ) G(o π o π ) Negated: π. π. G(i π i π ) F(o π o π ) s,i system i G(i π i π ) F(o π o π ) 20 / 29

39 Model Checking Algorithm A Circuit Based Approach π. π. G(i π i π ) G(o π o π ) Negated: π. π. G(i π i π ) F(o π o π ) G(i π i π ) F(o π o π ) s,i system i s,i system i 20 / 29

40 Model Checking Algorithm Implementation - MCHyper A transformation on Aiger circuits Workflow 1. Convert VHDL/Verilog to Aiger 2. Run MCHyper with a formula and the circuit 3. Call a hardware model checker on the resulting circuit Tool website: 21 / 29

41 Part III Case studies 22 / 29

42 Case studies Information flows in the I2C Bus Bus master implementation from OpenCores.org 256 latches 1207 gates Properties Under which circumstances can information flow from the inputs through the Master to the bus (and vice versa)? π. π. G(DAT_I π = DAT_I π ) G(SDA_O π =SDA_O π ) Is there a maximum delay for data transmission? π. π. G(DAT_I π = DAT_I π ) F G(SDA_O π =SDA_O π )) 23 / 29

43 Case studies Information flows - Experimental Data Verification time in s Model #Latches #Gates IC3 INT BMC Result IF1 (NI1) IF2 (NI2) IF3 (NI3) IF4 (NI4) I2C Master IF5 (NI5) IF6 (NI6) IF7 (NI7) TO IF8 (NI8) IF9 (NI2 ) Ethernet TO / 29

44 Case studies Symmetries in Protocols Bakery protocol from the VIS verification benchmark. 46 to 136 latches 1826 to 6775 gates Properties: Are the participants treated symmetrically? (simplified) π. π. G(select_0 π =select_1 π select_1 π =select_0 π ) G(pc_0 π =pc_1 π pc_1 π =pc_0 π ) Can we modify the implementation such that the symmetry breaking is minimal? 25 / 29

45 Case studies Symmetries in Protocols - Experimental Data Verification time in s Model #Latches #Gates IC3 INT BMC Result Sym1 (S1) Bakery Sym (S2) Sym3 Bakery.a TO Sym4 Bakery.a.n (S3) Sym TO - Bakery.a.n.s Sym6 (S4) TO - Sym7 (S5) TO - Bakery.a.n.s.5proc Sym8 (S6) TO - Sym9 (S7) Bakery.a.n.s.7proc TO - 26 / 29

46 Case studies Error Correcting Codes Traces with distinct inputs have at least Hamming distance d: π. π. F(DAT π DAT π ) Ham(d, π, π ) with Ham(0, π, π ) = false and Ham(d, π, π ) is: o π =o π W ( o π o π X Ham(d 1, π, π ) ) 27 / 29

47 Case studies Error Correcting Codes - Experimental Data Verification time in s Model #Latches #Gates IC3 INT BMC Result Huff1 (HD1) Huffman_enc Huff2 (HD2) b10b_1 (HD1) b10b_2 (HD1 ) 8b10b_enc b10b_3 (HD2 ) b10b_4 (HD1 ) 8b10b_dec Hamm1 (HD1 1 ) Hamm2 (HD1 2 ) Hamm3 (HD1 3 ) Hamm3 (HD1 3 ) Hamming_enc Hamm4 (HD1 4 ) Hamm5 (HD2 1 ) Hamm6 (HD2 2 ) Hamm7 (HD3) / 29

48 Conclusions HyperLTL/HyperCTL are versatile tools for information security and beyond. Model checking is decidable but hard in general. For alternation-free formulas there is an efficient algorithm. Case studies Information-flow control Symmetries in distributed systems Error resistant codes 29 / 29