A Theorem Proving Approach to Analysis of Secure Information Flow

Abstract

Abstract. Most attempts at analysing secure information flow in programs are based on domain-specific logics. Though computationally feasible, these approaches suffer from the need for abstraction and the high cost of building dedicated tools for real programming languages. We recast the information flow problem in a general program logic rather than a problem-specific one. We investigate the feasibility of this approach by showing how a general purpose tool for software verification can be used to perform information flow analyses. We are able to prove security and insecurity of programs including advanced features such as method calls, loops, and object types for the target language Java Card. In addition, we can express declassification of information.

Secure information flow by self-composition

“…Therefore, such an encoding is impractical for our purposes, since we aim to capture information flow policies without changing the verification logic every time that the security property needs to be adapted. More recently, Darvas, Hähnle, and Sands (2005) have shown how dynamic logic may be used to verify non-interference and some declassification policies of (sequential) Java programs. As in Andrews and Reitman's encoding, non-interference of a program P is captured by a formula over P -in this case a formula in dynamic logic.…”

Qualitative and quantitative information flow analysis for multi-threaded programs

“…This thesis discusses a method to encode the information flow property as a temporal logic property. To do this, we implement the idea of self-composition -a construction where a program is composed with its copy and each program copy keeps an independent memory [34,15]. Basically, we construct a program model that executes the program to be verified twice, in parallel with itself.…”

“…Therefore, recent work on adopting techniques from model checking [16,34,48] is emerging as an alternative approach to gain better precision. This thesis develops different methods to verify our information flow properties by combining newly developed and existing model-checking algorithms.…”

“…Self-composition is a technique to transform the verification of information flow properties into a standard safety verification problem [15,34]. The basic idea is that we compose a program C with a copy, denoted C , i.e., we execute C and C in parallel, and consider C||C as a single program (called a selfcomposed program).…”

“…The basic idea is that we compose a program C with a copy, denoted C , i.e., we execute C and C in parallel, and consider C||C as a single program (called a selfcomposed program). Program C is a copy of C, but all variables are renamed to make them distinguishable from the variables in C [15,34]. In this composed model, the two programs C and C are still distinguished; and therefore, we can express the information flow property as a property over the execution traces of the self-composed program C||C .…”