COVERN: A Logic for Compositional Verification of Information Flow Control

Murray, Toby; Sison, Robert; Engelhardt, Kai

doi:10.1109/eurosp.2018.00010

Cited by 31 publications

(44 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This construction applies to a broad range of security properties, including those specifiable in the HyperLTL logic [5]. When applied to automaton-based formulations of the non-interference and constant-time properties, the resulting proof rules are essentially identical to those developed in the literature in [7,8,17] for non-interference and in [3] for constant-time. Manna and Pnueli show in a beautiful paper [15] how to derive custom proof rules for deductive verification of a LTL property from an equivalent Büchi automaton; our constructions are inspired by this work.…”

Section: Discussion and Related Workmentioning

confidence: 99%

“…We establish connections to known proof rules for preservation of the noninterference [7,8,17] and constant-time [3] properties. We show that under the assumptions of those rules, there is a simple and direct definition of a relation that meets the automaton-based refinement conditions for automata representing these properties.…”

Section: Connections To Existing Proof Rulesmentioning

confidence: 99%

“…Refinement-based proof rules for preservation of non-interference have been introduced in [7,8,17]. The rules are not identical but are substantially similar in nature, providing conditions under which an ordinary simulation relation, ≺, between programs C and S implies preservation of non-interference.…”

Section: Non-interferencementioning

confidence: 99%

“…and How easy is it to generate and check witnesses for validity? Refinement proof systems are known only for two important security properties, non-interference [7,8,17] and constant-time execution [3].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Witnessing Secure Compilation

Namjoshi

Tabajara

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Compiler optimizations are designed to improve run-time performance while preserving input-output behavior. Correctness in this sense does not necessarily preserve security: it is known that standard optimizations may break or weaken security properties that hold of the source program. This work develops a translation validation method for secure compilation. Security (hyper-)properties are expressed using automata operating over a bundle of program traces. A flexible, automatonbased refinement scheme, generalizing existing refinement methods, guarantees that the associated security property is preserved by a program transformation. In practice, the refinement relations ("security witnesses") can be generated during compilation and validated independently with a refinement checker. This process is illustrated for common optimizations. Crucially, it is not necessary to verify the compiler implementation itself, which is infeasible in practice for production compilers.

show abstract

Section: Discussion and Related Workmentioning

confidence: 99%

Section: Connections To Existing Proof Rulesmentioning

confidence: 99%

Section: Non-interferencementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Witnessing Secure Compilation

Namjoshi

Tabajara

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…At the same time, recent work has heralded major advancements in program logics for reasoning about secure information flow [23,33,34]-i.e. whether programs properly protect their secrets-yielding the first general program logics and proofs of information flow security for non-trivial concurrent programs [34]. Yet so far, such logics have remained confined to interactive proof assistants, making them practically inaccessible to industrial developers.…”

Section: Introductionmentioning

confidence: 99%

SecCSL: Security Concurrent Separation Logic

Ernst

Murray

2019

Computer Aided Verification

Self Cite

View full text Add to dashboard Cite

We present SecCSL, a concurrent separation logic for proving expressive, data-dependent information flow security properties of low-level programs. SecCSL is considerably more expressive, while being simpler, than recent compositional information flow logics that cannot reason about pointers, arrays etc. To capture security concerns, SecCSL adopts a relational semantics for its assertions. At the same time it inherits the structure of traditional concurrent separation logics; thus SecCSL reasoning can be automated via symbolic execution. We demonstrate this by implementing SecC, an automatic verifier for a subset of the C programming language, which we apply to a range of benchmarks.

show abstract