Adjoining Declassification and Attack Models by Abstract Interpretation

Abstract

Abstract. In this paper we prove that attack models and robust declassification in language-based security can be viewed as adjoint transformations of abstract interpretations. This is achieved by interpreting the well known Joshi and Leino's semantic approach to non-interference as a problem of making an abstraction complete relatively to a program's semantics. This observation allows us to prove that the most abstract property on confidential data which flows, here called private observation, and the most concrete harmless attacker observing public data, here called public observable, both modeled as abstractions of the program's semantics, are respectively the adjoint solutions of a completeness problem in standard abstract interpretation theory. In particular declassification corresponds to refining the given model of an attacker with the minimal amount of information in order to achieve completeness, which is non-interference, while the harmless attacker corresponds to remove this information. This proves an adjunction relation between two basic approaches to language-based security: declassification and the construction of suitable attack models, and allows us to apply relevant techniques for abstract domain transformation in language-based security.

Hiding Information in Completeness Holes: New Perspectives in Code Obfuscation and Watermarking

“…We are also interested in deriving appropriate metrics for estimating the quality of an obfuscation and watermarking method. The completeness-based approach to information hiding may provide here useful metrics, such as the one in [1,24] measuring the degree of information leakage, which is known to be strongly related with the incompleteness of an abstract interpretation [28]. Of particular interest could be exploiting incompleteness holes derived from the inaccurate propagation of roundoff errors in floating-point operations [38].…”

“…In order to model secrecy in code transformations we consider a higher-order version of ANI, called HOANI, which shares with ANI all relevant properties [27,28]. Here programs in P are partitioned in cover programs P ⊆ P and secret programs Q ⊆ P. The cover (unaffected) program plays the role of the public input, the private input is the secret code whose properties have to be kept secret by the program integration method I.…”

Modelling declassification policies using abstract domain completeness

“…We will rely on this intution for checking (declassified) NI. The formal justification of this choice of semantics rests on the connection between NI and completeness of abstract interpretations (Giacobazzi and Mastroeni 2005) which we now consider.…”

“…By starting from Joshi and Leino's characterization of classic NI, (Giacobazzi and Mastroeni 2005) noted that classic NI is a completeness problem in abstract interpretation. (Joshi and Leino 2000) use a weakest precondition semantics of imperative programs to arrive at an equational definition of NI: a program P containing H and L variables (ranged over by h and l respectively) is secure iff HH ; P ; HH = P ; HH where HH is an assignment of an arbitrary value to h. "The postfix occurrences of HH on each side mean that we are only interested in the final value of l and the prefix HH on the left-hand-side means that the two programs are equal if the final value of l does not depend on the initial value of h" (Sabelfeld and Sands 2001).…”

“…Now the Joshi-Leino definition can be rewritten (Giacobazzi and Mastroeni 2005) in the following way, where P is the concrete, denotational semantics of P .…”