A logic for information flow in object-oriented programs

Abstract

This paper specifies, via a Hoare-like logic, an interprocedural and flow sensitive (but termination insensitive) information flow analysis for object-oriented programs. Pointer aliasing is ubiquitous in such programs, and can potentially leak confidential information. Thus the logic employs independence assertions to describe the noninterference property that formalizes confidentiality, and employs region assertions to describe possible aliasing. Programmer assertions, in the style of JML, are also allowed, thereby permitting a more fine-grained specification of information flow policy.The logic supports local reasoning about state in the style of separation logic. Small specifications are used; they mention only the variables and addresses relevant to a command. Specifications are combined using a frame rule. An algorithm for the computation of postconditions is described: under certain assumptions, there exists a strongest postcondition which the algorithm computes.

From Exponential to Polynomial-Time Security Typing via Principal Types

“…[ABB06]). Do dynamic allocation, structured data and aliasing fundamentally change the algorithmic approach?…”

Software Security in Virtualized Infrastructures — The Smart Meter Example

“…Using program logics, non-interference can be directly formalized (e.g., [6,12,37]); or it can be translated into dependence properties, which in turn can be formalized in program logics logic (this has been investigated for a simple imperative language [2,1], for a simple object-oriented language [3], and for sequential Java [19]). Non-interference can also be translated into proof obligations that can -in principle -be handled by unmodified existing program verification tools using a technique called self-composition [12,11,6].…”

Specification and Checking of Software Contracts for Conditional Information Flow

“…Also note that correctness is phrased directly wrt. the underlying semantics, unlike [3,2] which first establish the semantic soundness of a logic and next provide a sound implementation of that logic. Theorem 2 is proved [6] much as the corresponding result [5] (that handled a language with heap manipulation but without procedure calls and without automatic computation of loop invariants), by establishing some auxiliary properties (e.g., the R component) that have largely determined the design of Pre.…”

“…To address that, and to analyze heapmanipulating languages, the logic of [2] employs three kinds of primitive assertions: agreement, programmer, and region (for a simple alias analysis). But, since those can be combined only through conjunction, programmer assertions are not smoothly integrated, and it is not possible to capture conditional information flows.…”

“…In previous work, Banerjee and the first author have developed Hoare logics that enable compositional reasoning about information flow [3,2]. Inspired by challenge problems from Rockwell Collins, this logic was extended to support conditional information flow [5].…”