static analysis of security properties by abstract...

Static Analysis of Security Propertiesby Abstract Interpretation

École normale supérieure, équipe Abstraction

Mehdi Bouaziz

Friday, May 11 2012

Static Analysis of Security Properties by Abstract Interpretation

−→ course MPRI 2-6:Abstract Interpretation: application to verification and staticanalysis−→ ?

Mehdi Bouaziz, École normale supérieureStatic Analysis of Security Properties by Abstract Interpretation 2/13

Static Analysis

of Security Properties

by Abstract Interpretation

−→ course MPRI 2-6:Abstract Interpretation: application to verification and staticanalysis

−→ ?


Static Analysis of

Security Properties

by Abstract Interpretation

−→ course MPRI 2-6:Abstract Interpretation: application to verification and staticanalysis

−→ ?


Security?

Mehdi Bouaziz, École normale supérieureIntroduction to Security 3/13

Security?

Information Security?


Security?Access ControlAccountabilityAttackAuthenticityAuthorizationAvailabilityBuffer OverflowBugClassificationConfidentialityControl-FlowCovert ChannelsCross-Site ScriptingCryptanalysisCryptographyCryptologyDangling PointerData RaceDeclassification

DeadlockEarthquakeEncryptionFireFirewallFloodingFormat StringImplicit FlowInformation-FlowInput ValidationIntegrityIsolationLanguage-BasedLeast PrivilegeMalicious CodeMemory SafetyNon-InterferenceNon-RepudiationObfuscation

PhishingPolicyPossessionRandomizationReference MonitorRiskRuntime CheckSandboxSQL InjectionStack InspectionStack OverflowSymlink RaceTaintingTheftThreatType SafetyUtilityVulnerabilityWild Jump


Key Concepts

I ConfidentialityI IntegrityI Disponibility

I AuthenticityI AccountabilityI PossessionI Non-repudiationI Utility

Ipub

Ipriv

Opub

Opriv


Key Concepts

I Confidentiality

I IntegrityI Disponibility


Ipriv

Opub


Key Concepts

I ConfidentialityI Integrity

I Disponibility


Ipub

Opriv


Key Concepts

I ConfidentialityI IntegrityI Disponibility



Security Policy

A statement that partition the states of the system into a set ofauthorized (secure) states and a set of unauthorized (nonsecure)states.

Specify who can read/write what data, execute what command,under which condition.

I Natural language (law, documentation)I Encoded text (755 root root /bin)I Code (if (x.isPrivate()) exit(1); //avoid leak)I ∅


Security Policy



I Natural language (law, documentation)I Encoded text (755 root root /bin)

I Code (if (x.isPrivate()) exit(1); //avoid leak)I ∅


Security Policy



I Natural language (law, documentation)I Encoded text (755 root root /bin)I Code (if (x.isPrivate()) exit(1); //avoid leak)

I ∅


Security Policy



I Natural language (law, documentation)I Encoded text (755 root root /bin)I Code (if (x.isPrivate()) exit(1); //avoid leak)I ∅


Information Security Controls

I Access ControlI Information-Flow ControlI Control-Flow IntegrityI Encryption

−→ coursesMPRI 1-13: Initiation to cryptologyMPRI 2-12-1: CryptanalysisMPRI 2-12-2: Arithmetic algorithms for cryptologyMPRI 2-13-2: Error correcting codes and applications to cryptographyMPRI 2-30: Cryptographic protocols: computational and symbolic proofs


ThreatsI Physical: Earthquake, Fire, Flooding, TheftI In the code:

I Memory Safety:I Buffer OverrunsI Stack OverflowI Dangling pointers

I Concurrency:I DeadlocksI Data racesI Symlink races

I Input Validation:I SQL injectionI Cross-Site Scripting (XSS)I Format String

I Control/Data-Flow:I Type SafetyI Wild JumpsI Self Modifying Code


Language-Based Mechanisms

I Runtime Checks: Reference Monitor (OS, Interpreter,Firewall), Inlined Reference Monitor

I Programming Languages: Type-Safe Languages, TypedAssembly Language (TAL)

I Executing Model: Isolation, Sandboxing, Stack Inspection

I Static Analysis: Information-Flow Typing, AbstractInterpretation

I Exotic: Obfuscation, Randomization


Security Policy (2)

I Authorization

I History-Based

I Control-Flow

I Information-Flow

I Classification (private/public)

I Declassification (when, where, by who and what private informationcan be considered public)


Information-Flow Security

Non-Interference: No two executions are observably different if theydiffer solely by confidential inputs.

Explicit Flows: from assignments

Implicit Flows: from Indirect Flows and Covert Channels:I Termination ChannelI Timing ChannelI Probabilistic ChannelI Resource Exhaustion ChannelI Power Channel


Information-Flow Security Type System

` exp : high

h /∈ V ars(exp)

` exp : low

[pc] ` skip [pc] ` h := exp

` exp : low

[low] ` l := exp

[pc] ` C1 [pc] ` C2

[pc] ` C1;C2

` exp : pc [pc] ` C

[pc] ` while exp do C

` exp : pc [pc] ` C1 [pc] ` C2

[pc] ` if exp then C1 else C2

[high] ` C

[low] ` C


Issues

Non-interference is too restrictive. Most real-world programs needexceptions to non-interference: declassification.

Examples?

Other issues:I Expressiveness: first-class functions, exceptions, objectsI Concurrency: threads, nondeterminism, distributionI Covert channels: termination, timing, probabilityI Security policies: declassification, quantitative security,

dynamic policiesI Certification: proven compilers, proof-carrying codes


Thank you for listening

Questions are welcome


static analysis of security properties by abstract...

Documents