Generating In-Line Monitors for Rabin Automata

Chabot, Hugues; Khoury, Raphaël; Tawbi, Nadia

doi:10.1007/978-3-642-04766-4_20

Cited by 7 publications

(6 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They further show that in some cases, the set of properties enforceable in a non-uniform context is greater than that which is enforceable in an uniform context. Later Chabot et al (2009) showed that while this result did not apply to all runtime enforcement paradigms, it did apply to that of truncation-based monitor. Indeed, they show that in this monitoring context, a monitor operating with a subset of Σ ∞ is always more powerful than one which considers that every sequence can be output by its target.…”

Section: Non-uniform Enforcementmentioning

confidence: 98%

Equivalence-preserving corrective enforcement of security properties

Khoury

Tawbi

2015

IJICS

Self Cite

View full text Add to dashboard Cite

Runtime monitoring is a widely used approach for the enforcement of security policies. It allows the safe execution of untrusted code by observing the execution and reacting if needed to prevent a violation of a user-defined security policy. Previous studies have determined that the set of security properties enforceable by monitors is greatly extended by giving the monitor some licence to transform its target execution. In this study, we present a new framework to model and study the behaviour of such monitors. In order to assure that the enforcement is meaningful, we bound the monitor's ability to transform the target execution by a restriction stating that any transformation must preserve equivalence between the monitor's input and output. We proceed by giving examples of meaningful equivalence relations and identify the security policies that are enforceable with their use. We also relate our work to previous work in this field. Finally, we investigate how an a priori knowledge of the target program's behaviour would increase the monitor's enforcement power.

show abstract

Section: Non-uniform Enforcementmentioning

confidence: 98%

Equivalence-preserving corrective enforcement of security properties

Khoury

Tawbi

2015

IJICS

Self Cite

View full text Add to dashboard Cite

show abstract

“…Chabot et al [8] proposed to synthesize security automata from the security properties expressed as Rabin automata. They provide a construction from safety properties in general case and more than safety in case when additional information about the program is obtained by static analysis.…”

Section: Related Workmentioning

confidence: 99%

Iterative enforcement by suppression: Towards practical enforcement theories*

Bielova

Massacci

2012

JCS

View full text Add to dashboard Cite

Runtime enforcement is a common mechanism for ensuring that program executions adhere to constraints specified by a security policy. It is based on two simple ideas: the enforcement mechanism should leave good executions without changes (transparency) and make sure that the bad ones got amended (soundness). From the theory side, a number of papers (Hamlen et al., Ligatti et al., Talhi et al.) provide the precise characterization of good executions that can be captured by a security policy and thus enforced by mechanisms like security automata or edit automata.

show abstract

“…In [57], Chabot et al synthesize Schneider's security automata from properties expressed by Rabin automata [53]. Authors provide a construction from safety properties in the general case, and for more than safety when leveraged with static information gathered from the program.…”

Section: Synthesis Of Runtime Enforcement Monitorsmentioning

confidence: 99%

“…An open question is how static information on the program can leverage runtime enforcement. As suggested in [57], having a specification of the program under scrutiny allows to slightly increase the space of enforceable properties. However, the study has been conducted only for safety properties and security automata.…”

Section: Theoretical Open Questionsmentioning

confidence: 99%

You Should Better Enforce Than Verify

Falcone

2010

Runtime Verification

View full text Add to dashboard Cite

This tutorial deals with runtime enforcement and advocates its use as an extension of runtime verification. While research efforts in runtime verification have been mainly concerned with detection of misbehaviors and acknowledgement of desired behaviors, runtime enforcement aims mainly to circumvent misbehaviors of systems and to guarantee desired behaviors. First, we propose a comparison between runtime verification and runtime enforcement. We then present previous theoretical models of runtime enforcement mechanisms and their expressive power with respect to enforcement. Then, we overview existing work on runtime enforcement monitor synthesis. Finally, we propose some future challenges for the runtime enforcement technique. Runtime verification [1, 2] is a well established technique which consists in using a monitor to supervise, at runtime, the execution of an underlying program against a set of expected properties. A monitor is a decision procedure with an output function (e.g., a state machine when dealing with regular properties) processing (step by step) an execution sequence of the monitored program, and producing a sequence of verdicts (truth values of a truth-domain) indicating fulfillment or violation of a property. Whilst the detection might sometimes be a sufficient assurance for some systems, the occurrence (resp. non-occurrence) of property violations (resp. validations) might be unacceptable for others. Runtime enforcement [3-6] of the desired property is a possible solution to ensure expected behaviors and avoid misbehaviors. Within this technique the monitor not only observes the current program execution, but also modifies it. It uses an internal memorisation mechanism, in order to ensure that the expected property is fulfilled: it still reads an input sequence but now produces a new sequence of events in such a way that the property is enforced. The precise and formal relation between input and output sequences is usually ruled by two constraints: soundness and transparency. From an abstract point of view, those constraints entail the monitor to minimally modify the input sequence in order to ensure the desired property. When the program behaves well, the enforcement monitor lets the program execute with the least influence. If the program behavior is about to exhibit a deviation w.r.t. the expected property, the monitor uses its internal memorization mechanism to prevent the misbehavior. Practical applications of runtime enforcement. There have been many practical applications of the theory of runtime enforcement (e.g., in [7-9] for program safety, or in [10, 11] for access control policies). Most of them are built on ⋆ A longer version with more results and examples is available on the author's webpage.

show abstract

Generating In-Line Monitors for Rabin Automata

Cited by 7 publications

References 12 publications

Equivalence-preserving corrective enforcement of security properties

Equivalence-preserving corrective enforcement of security properties

Iterative enforcement by suppression: Towards practical enforcement theories*

You Should Better Enforce Than Verify

Contact Info

Product

Resources

About