Aspect-Oriented Runtime Monitor Certification

Abstract

Abstract. In-lining runtime monitors into untrusted binary programs via aspect-weaving is an increasingly popular technique for efficiently and flexibly securing untrusted mobile code. However, the complexity of the monitor implementation and in-lining process in these frameworks can lead to vulnerabilities and low assurance for code-consumers. This paper presents a machine-verification technique for aspect-oriented inlined reference monitors based on abstract interpretation and modelchecking. Rather than relying upon trusted advice, the system verifies semantic properties expressed in a purely declarative policy specification language. Experiments on a variety of real-world policies and Java applications demonstrate that the approach is practical and effective.

Vigiles: Fine-Grained Access Control for MapReduce Systems

“…AOP allows such implementations to be consolidated as aspects, which consist of (1) pointcuts-expressions that identify join points (sites throughout the rest of the code) that are relevant to the cross-cutting concern-and (2) advice consisting of code that modifies each join point to implement the concern. Prior work has recognized that such aspects are an elegant means of expressing RMs [16]- [20]. In such contexts, the pointcuts identify security-relevant program operations, and the advice introduces guard code that secures each such operation.…”

Hippocratic binary instrumentation: First do no harm

“…Though its bytecode language is type-safe, past malware has exploited VM buffer overflows [37], implemented cross-site-scripting attacks, and performed click-jacking [38,39] to damage browsers or disrupt victim host pages. The difficulty of enforcing rich AS security policies that prevent such attacks in web environments that are aggressively heterogeneous (e.g., composed of mash-ups that mix mobile code from many mutually distrusting sources) has led to application of IRM technologies to this challenging problem domain [9,[25][26][27][28]40].…”

“…Its certifier performs a static analysis that verifies that contract-specified guard code appears at each security-relevant code point. Our past work presents model-checking as an efficient approach for verifying such IRMs without trusted guard code [26,27].…”

“…Numerous past works have developed powerful technologies for formally machine-verifying the soundness of IRMs [7,8,[25][26][27][28][29][30]. This is important for establishing high assurance, and for minimizing and stabilizing the trusted computing base (TCB) of IRM systems.…”

“…• We show how prior work on verifying IRM soundness via model-checking [26,27] can be extended in a natural way to verify IRM transparency.…”