A Theory of Runtime Enforcement, with Results

Abstract

Abstract. This paper presents a theory of runtime enforcement based on mechanism models called MRAs (Mandatory Results Automata). MRAs can monitor and transform security-relevant actions and their results. Because previous work could not model monitors transforming results, MRAs capture realistic behaviors outside the scope of previous models. MRAs also have a simple but realistic operational semantics that makes it straightforward to define concrete MRAs. Moreover, the definitions of policies and enforcement with MRAs are significantly simpler and more expressive than those of previous models. Putting all these features together, we argue that MRAs make good general models of runtime mechanisms, upon which a theory of runtime enforcement can be based. We develop some enforceability theory by characterizing the policies MRAs can and cannot enforce.

Runtime Enforcement with Partial Control

“…Khoury and Tawbi [15,16] and Bielova et al [7,5,6] further refine the notion of enforcement by suggesting alternative definitions of enforcement. In [23] Ligatti and Reddy introduced an alternative model, the mandatory-result automaton. This model distinguishes between the action set of the target and that of the system with which it interacts.…”

“…In that case, the monitor's enforcement is bounded by the reverse subword equivalence, meaning that the monitor's output is a subword of the original sequence. This enforcement paradigm is similar to the one described in [23], where the monitor is interposed between the target program and the system. Any action requested by the target program is intercepted by the monitor which must accept or reject it, and allows us to pose an upper bound to this enforcement paradigm.…”

History-Dependent Inference Control of Queries by Dynamic Policy Adaption

“…The works on "enforceable security properties" [10,9] treat states as abstract objects, without indicating implementations. Advanced discretionary access control based on logic programming, like the Flexible Authorization Framework [8] maintains a special "done-predicate", which can be seen as a kind of a user log or as a kind of a dynamic component of the access control policy, depending on the point of view.…”

A Suite of Monitoring Tools for Erlang

“…In Runtime Enforcement (RE) [16,25,26] the system behaviour is kept in line with the correctness requirement by anticipating incorrect behaviour and countering it before it actually happens. In RE the monitor is typically designed to act as a proxy which wraps around the system and analyses its external interactions (see the dotted-line in Figure 1c).…”

“…In RE the monitor is typically designed to act as a proxy which wraps around the system and analyses its external interactions (see the dotted-line in Figure 1c). The monitor is thus able to either drop incorrect events generated by the system, or add system events by executing actions on behalf of the system [25,26]. This contrasts with runtime adaptation, where monitors may allow violations to occur but then execute remedial actions to mitigate the effects of the violation.…”