Efficient path conditions in dependence graphs for software safety analysis

Abstract

A new method for software safety analysis is presented which uses program slicing and constraint solving to construct and analyze path conditions , conditions defined on a program's input variables which must hold for information flow between two points in a program. Path conditions are constructed from subgraphs of a program's dependence graph, specifically, slices and chops. The article describes how constraint solvers can be used to determine if a path condition is satisfiable and, if so, to construct a witness for a safety violation, such as an information flow from a program point at one security level to another program point at a different security level. Such a witness can prove useful in legal matters.The article reviews previous research on path conditions in program dependence graphs; presents new extensions of path conditions for arrays, pointers, abstract data types, and multithreaded programs; presents new decomposition formulae for path conditions; demonstrates how interval analysis and BDDs (binary decision diagrams) can be used to reduce the scalability problem for path conditions; and presents case studies illustrating the use of path conditions in safety analysis. Applying interval analysis and BDDs is shown to overcome the combinatorial explosion that can occur in constructing path conditions. Case studies and empirical data demonstrate the usefulness of path conditions for analyzing practical programs, in particular, how illegal influences on safety-critical programs can be discovered and analyzed.

Andromeda: Accurate and Scalable Security Analysis of Web Applications

“…Snelting et al [28] make the observation that Program Dependence Graphs (PDGs) and noninterference are related in that dom(s 1 ) dom(s 2 ) implies s 1 / ∈ backslice(s 2 ), where backslice is maps each statement s to its static backwards slice. Based on this observation, Hammer et al [14] present an algorithm for verifying noninterference: For output statement s, backslice(s) must contain only statements whose security label is lower than s. Though promising, this approach has not been shown to scale.…”

“…However, many of the published approaches are not readily applicable to industrial Web applications. Solutions based on type systems tend to be overly complex and conservative [34,20,27], and are therefore unlikely to enjoy broad adoption, whereas those based on program slicing are often unsound [33] or limited in scalability [14,28].…”

Path-Sensitive Backward Slicing

“…A more scalable but not fully path-sensitive approach is described by Snelting et al [20,17,19]. They compute the dependency between two program points y and x using the Program Dependence Graph (PDG) [11] and apply the following rule to remove spurious dependencies: I(y, x) ⇒ ∃v : PC(y, x), where I(y, x) stands for y influences x (i.e., there is a dependency at x on y),v is some assignment of values to program variables and PC(y, x) is the path condition from y to x.…”

“…1(a), [20,17,19] would proceed as follows. In the PDG there will be a dependency edge from 8 0∧PC(4, 8)))) 8 , which is not unsatisfiable.…”

“…The fundamental reason for this is that for [20,17,19], path conditions are only necessary and not sufficient, so false alarms in examples such as the above are possible. An important consequence of this is the fact that even for loop-free programs, their algorithm cannot be considered "exact" in the sense described in Sec.…”