Towards a practical secure concurrent language

Abstract

We demonstrate that a practical concurrent language can be extended in a natural way with information security mechanisms that provably enforce strong information security guarantees. We extend the X10 concurrent programming language with coarse-grained information-flow control. Central to X10 concurrency abstractions is the notion of a place: a container for data and computation. We associate a security level with each place, and restrict each place to store only data appropriate for that security level. When places interact only with other places at the same security level, then our security mechanisms impose no restrictions. When places of differing security levels interact, our information security analysis prevents potentially dangerous information flows, including information flow through covert scheduling channels. The X10 concurrency mechanisms simplify reasoning about information flow in concurrent programs.We present a static analysis that enforces a noninterference-based extensional information security condition in a calculus that captures the key aspects of X10's place abstraction and async-finish parallelism. We extend this security analysis to support many of X10's language features, and have implemented a prototype compiler for the resulting language.

Compositional Non-interference for Concurrent Programs via Separation and Framing

“…Moreover, we wish to investigate a generalization of our concurrency model to an X10-like [30,42] setting where instead of one scheduler, we have several coarse-grained scheduling partitions.…”

“…A scheduling function sf takes a scheduler state, a thread pool, a message pool and a heap as arguments and returns a new scheduler state and a thread identifier of the next thread to be scheduled [30,33]. A thread pool T is a partial function from thread identifiers to sequences of statements, a message pool is a function from channel names to natural numbers, each representing a number of signals available on the respective channel, and a heap is a function from variables to values.…”

“…By contrast, our approach builds upon the technique of explicit refiners [30,33], which allows non-determinism as long as it is not influenced by secrets, and does not exhibit the aforementioned semantic pitfalls.…”

“…A number of approaches assume a particular scheduling strategy, typically round-robin [30,39,45]. Mantel and Sudbrock [24] define a class of robust schedulers as the schedulers where "the scheduling order of low threads does not depend on the high threads in a thread pool" [24].…”

Hybrid Monitors for Concurrent Noninterference

“…Intuitively, the program is secure because the synchronization between threads ensures that the order of the low output does not depend on confidential information, even though the low output is nondeterministic [20,21].…”