Journey Beyond Full Abstraction: Exploring Robust Property Preservation for Secure Compilation

Abstract

Good programming languages provide helpful abstractions for writing secure code, but the security properties of the source language are generally not preserved when compiling a program and linking it with adversarial code in a low-level target language (e.g., a library or a legacy application). Linked target code that is compromised or malicious may, for instance, read and write the compiled program's data and code, jump to arbitrary memory locations, or smash the stack, blatantly violating any source-level abstraction. By contrast, a fully abstract compilation chain protects source-level abstractions all the way down, ensuring that linked adversarial target code cannot observe more about the compiled program than what some linked source code could about the source program. However, while research in this area has so far focused on preserving observational equivalence, as needed for achieving full abstraction, there is a much larger space of security properties one can choose to preserve against linked adversarial code. And the precise class of security properties one chooses crucially impacts not only the supported security goals and the strength of the attacker model, but also the kind of protections a secure compilation chain has to introduce.We are the first to thoroughly explore a large space of formal secure compilation criteria based on robust property preservation, i.e., the preservation of properties satisfied against arbitrary adversarial contexts. We study robustly preserving various classes of trace properties such as safety, of hyperproperties such as noninterference, and of relational hyperproperties such as trace equivalence. This leads to many new secure compilation criteria, some of which are easier to practically achieve and prove than full abstraction, and some of which provide strictly stronger security guarantees. For each of the studied criteria we propose an equivalent "property-free" characterization that clarifies which proof techniques apply. For relational properties and hyperproperties, which relate the behaviors of multiple programs, our formal definitions of the property classes themselves are novel. We order our criteria by their relative strength and show several collapses and separation results. Finally, we adapt existing proof techniques to show that even the strongest of our secure compilation criteria, the robust preservation of all relational hyperproperties, is achievable for a simple translation from a statically typed to a dynamically typed language.(∀C T . ∀t 1 , .., t k , ..(∀i.C T [P i ] t i ) ⇒ (t 1 , .., t k , ..) ∈ R)

Trace-Relating Compiler Correctness and Secure Compilation

“…The statement of SC = can therefore be read as "whenever W↓ violates a safety property, then W does". By contraposition it has been shown that this is equivalent to the preservation of arbitrary safety properties [2]:…”

“…To account for this scenario, Abate et al [2] describe a class of secure compilation criteria based on the preservation of classes of properties against arbitrary target context. For each of these criteria, they give an equivalent "property-free" criterion, in the same manner as the duality between TP and CC.…”

“…Abate et al [2] propose many more equivalent pairs of criteria, each one preserving different classes of (hyper)properties we discussed earlier: properties, safety properties, hypersafety properties, subset-closed hyperproperties, hyperproperties and more. However, all these criteria are stated in a setting where source and target traces are the same.…”

“…For each secure compilation definition we again propose both a propertyfree characterization in the style of CC ∼ , and two characterizations in terms of preserving a class of source or target properties satisfied against arbitrary adversarial contexts. The additional quantification over contexts allows for finer distinctions when considering different property classes, so we study mapping classes not only of trace properties and hyperproperties, but also of relational hyperproperties [2]. An example secure compiler accounting for a target that can produce additional observations that are not possible in the source illustrates this approach.…”

The next 700 relational program logics

“…Generalizing unary properties, which describe single program runs, relational properties describe relations between multiple runs of one or more programs [Abate et al 2019;Clarkson and Schneider 2010]. Formally verifying relational properties has a broad range of practical applications.…”