A Logical System for Modular Information Flow Verification

Prabawa, Adi; Ameen, Mahmudul Faisal Al; Lee, Benedict; Chin, Wei-Ngan

doi:10.1007/978-3-319-73721-8_20

Cited by 3 publications

(1 citation statement)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Modular approaches based on information flow control are based on enforcing information flow control independently on each fragment of the program, protocol or software system. The enforced properties are then proven to be preserved at the whole program [206], protocol [8] or system level [277]. Andova et al [8], propose a framework to verify security protocols built from smaller subprotocols by first verifying that the subprotocols are independent and then analyzing each subprotocol in isolation.…”

Section: Modular Security Analysismentioning

confidence: 99%

Design and Analysis of Self-protection: Adaptive Security for Software-Intensive Systems

Skandylas¹

View full text Add to dashboard Cite

Today's software landscape features a high degree of complexity, frequent changes in requirements and stakeholder goals, and uncertainty.Uncertainty and high complexity imply a threat landscape where cybersecurity attacks are a common occurrence while their consequences are often severe. Self-adaptive systems have been proposed to mitigate the complexity and frequent changes by adapting at run-time to deal with situations not known at design time.Self-adaptive systems that aim to identify, analyse and mitigate threats autonomously are called self-protecting systems.This thesis contributes approaches towards developing systems with self-protection capabilities under two perspectives. Under the first perspective, we enhance the security of component-based systems and equip them with self-protection capabilities that reduce the exposedattack surface or provide efficient defenses against identified attacks. We target systems where information about the system components and the adaptationdecisions is available, and control over the adaptation is possible. We employ runtime threat modeling and analysis using quantitative risk analysis and probabilistic verification to rank adaptations to be applied in the system in terms of their security levels. We then introduce modular and incremental verification approaches to tackle the scalability issues of probabilistic verification to be able to analyze larger-scale software systems.To protect against cyberattacks that cannot be mitigated by reducing the exposed attack surface, we propose an approach to analyze the security of different software architectures incorporating countermeasures to decide on the most suitable ones to evolve to. Under the second perspective, we study open decentralized systems where we have limited information about and limited control over the system entities. We employ decentralized information flow control mechanisms to enforce security by controlling the interactions among the system elements.We extend decentralized information flow control by incorporating trust and adding adaptationcapabilities that allow the system to identify security threats and self-organize to maximize trust between the system entities.

show abstract

Section: Modular Security Analysismentioning

confidence: 99%

Design and Analysis of Self-protection: Adaptive Security for Software-Intensive Systems

Skandylas¹

View full text Add to dashboard Cite

show abstract

SecCSL: Security Concurrent Separation Logic

Ernst

Murray

2019

Computer Aided Verification

View full text Add to dashboard Cite

We present SecCSL, a concurrent separation logic for proving expressive, data-dependent information flow security properties of low-level programs. SecCSL is considerably more expressive, while being simpler, than recent compositional information flow logics that cannot reason about pointers, arrays etc. To capture security concerns, SecCSL adopts a relational semantics for its assertions. At the same time it inherits the structure of traditional concurrent separation logics; thus SecCSL reasoning can be automated via symbolic execution. We demonstrate this by implementing SecC, an automatic verifier for a subset of the C programming language, which we apply to a range of benchmarks.

show abstract

Compositional Security Analysis of Dynamic Component-based Systems

Khakpour,

Skandylas

2024

Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering

View full text Add to dashboard Cite

A Logical System for Modular Information Flow Verification

Cited by 3 publications

References 27 publications

Design and Analysis of Self-protection: Adaptive Security for Software-Intensive Systems

Design and Analysis of Self-protection: Adaptive Security for Software-Intensive Systems

SecCSL: Security Concurrent Separation Logic

Compositional Security Analysis of Dynamic Component-based Systems

Contact Info

Product

Resources

About