Micro-Policies: Formally Verified, Tag-Based Security Monitors

Abstract

Abstract-Recent advances in hardware design have demonstrated mechanisms allowing a wide range of low-level security policies (or micro-policies) to be expressed using rules on metadata tags. We propose a methodology for defining and reasoning about such tag-based reference monitors in terms of a high-level "symbolic machine," and we use this methodology to define and formally verify micro-policies for dynamic sealing, compartmentalization, control-flow integrity, and memory safety; in addition, we show how to use the tagging mechanism to protect its own integrity. For each micro-policy, we prove by refinement that the symbolic machine instantiated with the policy's rules embodies a high-level specification characterizing a useful security property. Last, we show how the symbolic machine itself can be implemented in terms of a hardware rule cache and a software controller.

Journey Beyond Full Abstraction: Exploring Robust Property Preservation for Secure Compilation

“…In particular, to help enforce security, the target-level linker could disallow linking with a suspicious context (e.g., one that is not welltyped [1,7,8,9,71]) or could always allow linking but introduce protection barriers between the program and the context (e.g., by instrumenting the program [35,71] or the context [5,95,96] to introduce dynamic checks). Similarly, the semantics of the target language can include various protection mechanisms (e.g., processes with different virtual address spaces [25,50,59,81,82], protected enclaves [76], capabilities [30,40,90,98], tags [5,14]). Finally, the compiler might have to refrain from aggressive optimizations that would break security [19,38,89].…”

A verified information-flow architecture

“…Using plain integers as tags allows us to delegate their interpretation entirely to software. In this paper we focus solely on using tags to implement IFC labels, although they could also be used for enforcing other policies, such as type and memory safety or control-flow integrity [9,35]. For instance, to implement the two-point abstract lattice with ⊥ ≤ , we could use 0 to represent ⊥ and 1 to represent , making the operations ∨ and ≤ easy to implement (see Section 6).…”

“…A key feature of SAFE is that every piece of data, down to the word level, is annotated with a tag representing policies that govern its use. While the tagging mechanism is very general [9,35], one particularly interesting use of tags is for representing information-flow control (IFC) policies. For example, an individual record might be tagged "This information should only be seen by principals Alice or Bob," a function pointer might be tagged "This code is trusted to work with Carol's secrets," or a string might be tagged "This came from the network and has not been sanitized yet."…”

“…In the latter case, an appropriate rule instance specifying tags for the instruction's results is added to the cache, and the faulting instruction is restarted. Thus, the hardware is generic and the interpretation of policies (e.g., IFC, memory safety or control flow integrity [9,35]) is programmed in software, with the results cached in hardware for common-case efficiency.…”

“…• a more extensive discussion of related work, including more recent work on transplanting the tagging mechanism of SAFE onto a mainstream RISC processor [30] and using it to enforce properties beyond IFC [9,35].…”