Proving full-system security properties under multiple attacker models on capability machines

Abstract

Assembly-level protection mechanisms (virtual memory, trusted execution environments, virtualization) make it possible to guarantee security properties of a full system in the presence of arbitrary attacker provided code. However, they typically only support a single trust boundary: code is either trusted or untrusted, and protection cannot be nested. Capability machines provide protection mechanisms that are more finegrained and that do support arbitrary nesting of protection. We show in this paper how this enables the formal verification of full-system security properties under multiple attacker models: different security objectives of the full system can be verified under a different choice of trust boundary (i.e. under a different attacker model). The verification approach we propose is modular, and is robust: code outside the trust boundary for a given security objective can be arbitrary, unverified attacker-provided code. It is based on the use of universal contracts for untrusted adversarial code: sound, conservative contracts which can be combined with manual verification of trusted components in a compositional program logic. Compositionality of the program logic also allows us to reuse common parts in the analyses for different attacker models. We instantiate the approach concretely by extending an existing capability machine model with support for memorymapped I/O and we obtain full system, machine-verified security properties about external effect traces while limiting the manual verification effort to a small trusted computing base relevant for the specific property under study.inv P (F x , P x , tp x ) read spec(d r pr(x) , d e pr(x) , d r pr(x) , False) inv st (d r pr(x) , d w pr(x) , d e pr(x) , d r x , d w x , d e x , F x , P x ) read spec(d r x , d e x , d r x , tp x )

Formalizing, Verifying and Applying ISA Security Guarantees as Universal Contracts

“…As demonstrated before [25,26,52], such a UC is agnostic of software abstractions but supports reasoning about untrusted code. Essentially, one can register integrity properties of trusted code as invariants 2 , and then use the UC for justifying jumps to untrusted code.…”

“…A word on the machine is either an integer or a capability and these can be stored in general-purpose registers (GPRs) and in memory. MinimalCaps supports memory and object capabilities, a superset of what is supported in Cerise [25,26,52].…”

“…Syntactic properties like capability monotonicity [37], which expresses that the transitively available authority cannot increase during execution, have been shown insufficient in the presence of object capabilities [18]. Therefore, we use a semantic formulation of capability safety based on logical relations [18,25,26,48,50,52] and formulate the property as a contract over the fdeCycle, following Cerise [25,26,52]. The contract states that if we start from a configuration of safe values, arbitrary code will not be able to exceed the authority of those values.…”

“…Using universal contracts for generally specifying ISA security guarantees requires (1) a program logic that is sufficiently expressive to express guarantees of a broad range of ISAs, and (2) a verification methodology that can verify the contracts in a semi-automated way against authoritative, engineer-friendly ISA definitions, which are typically implemented as definitional interpreters [e.g., 4,10]. Universal contracts for ISAs have already been used for capturing the capability safety property of capability machine ISAs [26,48,52], and integrity and confidentiality properties of Armv7 [16,33], but neither approach reconciles these two essential requirements. In the capability machine setting, the universal contracts have a very specific shape: a logical relation is used to define the authority represented by a capability and the universal contract is presented as the fundamental property of the logical relation.…”

A Generic Framework to Develop and Verify Security Mechanisms at the Microarchitectural Level: Application to Control-Flow Integrity

“…The work of Georges et al [11], [12] and Skorstengaard et al [28], [29] prove a variety of stack safety properties that can be enforced on capability machines. Similarly, Van Strydonck et al [30] develop a library of verified wrappers around drivers leveraging capabilities for enforcing security properties. While these works also define and prove security properties about hardware, all their reasoning is done at the ISA level and must thus assume that the ISA is correctly implemented in hardware.…”