A Hybrid Approach for Proving Noninterference of Java Programs

Abstract

Several tools and approaches for proving noninterference properties for Java and other languages exist. Some of them have a high degree of automation or are even fully automatic, but overapproximate the actual information flow, and hence, may produce false positives. Other tools, such as those based on theorem proving, are precise, but may need interaction, and hence, analysis is time-consuming.In this paper, we propose a hybrid approach that aims at obtaining the best of both approaches: We want to use fully automatic analysis as much as possible and only at places in a program where, due to overapproximation, the automatic approaches fail, we resort to more precise, but interactive analysis, where the latter involves the verification only of specific functional properties in certain parts of the program, rather than checking more intricate noninterference properties for the whole program.To illustrate the hybrid approach, in a case study we use this approach-along with the fully automatic tool Joana for checking noninterference properties for Java programs and the theorem prover KeY for the verification of Java programs-as well as the CVJ framework proposed by Küsters, Truderung, and Graf to establish cryptographic privacy properties for a non-trivial Java program, namely an e-voting system. The CVJ framework allows one to establish cryptographic indistinguishability properties for Java programs by checking (standard) noninterference properties for such programs.

CoSMeDis: A Distributed Social Media Platform with Formally Verified Confidentiality Guarantees

“…However, compared to the kernel, these layers require the establishment of much simpler, noninterference-like properties: That they transport the data back and forth between the end user and the verified kernel, without doing anything "interesting," like mixing identities. Such properties seem to be in the scope of static informationflow analyzers such as Joana [33]-so a hybrid verification scheme (as in, e.g., [39]) might be suitable here.…”

“…CoSMeDis belongs to a small, but expanding club of running systems proved to be secure using proof assistants, which includes an aircraft microprocessor [34] (in ACL2), a hardware architecture with information flow primitives [22] (in Coq), a separation kernel [21] (in HOL4), a noninterferent operating system kernel [51] (in Isabelle/HOL), a secure browser [36] (in Coq), and an e-voting system [39] (using the KeY theorem prover jointly with the Joana information flow analyzer).…”

A monadic framework for relational verification: applied to information security, program equivalence, and optimizations

“…Building on §5.1, we show how programs that fall outside the syntactic information-flow typing discipline can be proven secure using a combination of typechecking and semantic proofs of noninterference. This example is evocative (though at a smaller scale) of the work of Küsters et al (2015), who combine automated information-flow analysis in the Joana analyzer (Hammer and Snelting 2009) with semantic proofs in the KeY verifier for Java programs (Darvas et al 2005;Scheben and Schmitt 2011). In contrast, we sketch a combination of syntactic and semantic proofs of relational properties in a single framework.…”

Using Theorem Provers to Increase the Precision of Dependence Analysis for Information Flow Control

“…In what follows, we describe some approaches that are similar to ours. The Hybrid Approach [17] also aims to combine automatic dependence-graph analysis and theorem proving. The user first attempts to show noninterference using JOANA.…”