A verified information-flow architecture

Abstract

SAFE is a clean-slate design for a highly secure computer system, with pervasive mechanisms for tracking and limiting information flows. At the lowest level, the SAFE hardware supports fine-grained programmable tags, with efficient and flexible propagation and combination of tags as instructions are executed. The operating system virtualizes these generic facilities to present an information-flow abstract machine that allows user programs to label sensitive data with rich confidentiality policies. We present a formal, machine-checked model of the key hardware and software mechanisms used to dynamically control information flow in SAFE and an end-to-end proof of noninterference for this model.We use a refinement proof methodology to propagate the noninterference property of the abstract machine down to the concrete machine level. We use an intermediate layer in the refinement chain that factors out the details of the information-flow control policy and devise a code generator for compiling such information-flow policies into low-level monitor code. Finally, we verify the correctness of this generator using a dedicated Hoare logic that abstracts from low-level machine instructions into a reusable set of verified structured code generators.

Testing noninterference, quickly

“…This assumption ensures that, at the level of abstraction we consider here, allocations in high contexts cannot influence the values of pointers allocated in low contexts, and we can thus use syntactic equality to check indistinguishability of pointers. While this assumption on allocation might seem unrealistic, previous work has shown formally that because block identifiers are opaque, this machine can be realized by a lower-level machine with a single standard allocator (Azevedo de Amorim et al 2014). …”

“…We define what it means for this basic IFC machine to be "secure" using a standard notion of termination-insensitive noninterference (Austin and Flanagan 2009;Azevedo de Amorim et al 2014;Hriţcu et al 2013a;Sabelfeld and Myers 2003); we call it end-to-end noninterference (or EENI) to distinguish it from the stronger notions we will introduce in §6. The main idea of EENI is to directly encode the intuition that secret inputs should not influence public outputs.…”

“…In a (fine-grained) dynamic IFC system (Austin and Flanagan 2009;Azevedo de Amorim et al 2014;Bichhawat et al 2014b;Hriţcu et al 2013a;Sabelfeld and Russo 2009;Stefan et al 2011) security levels (called labels) are attached to runtime values and propagated during execution, enforcing the constraint that information derived from secret data does not leak to untrusted processes or to the public network. Each value is protected by an individual IFC label representing a security level (e.g., secret or public).…”

“…(Other choices would give the observer either somewhat more powere.g., we could make the stack observable-or somewhat less-e.g., we could restrict the observer to some designated region of "I/O memory," or extend the architecture with I/O instructions and only observe the traces of inputs and outputs (Azevedo de Amorim et al 2014). ) 2.2 Definition: Machine states S 1 = pc 1 s 1 m 1 i 1 and S 2 = pc 2 s 2 m 2 i 2 are indistinguishable with respect to memories, written S 1 ≈ mem S 2 , if m 1 ≈ m 2 and i 1 ≈ i 2 .…”

“…While even simpler notions of dynamic taint tracking are well studied for both high-and low-level languages, it has only recently been shown (Austin and Flanagan 2009;Sabelfeld and Russo 2009) that dynamic checks are capable of soundly enforcing strong security properties. Moreover, until recently (Azevedo de Amorim et al 2014;Bichhawat et al 2014a;Hriţcu et al 2013b), sound dynamic IFC has been studied only in the context of high-level languages (Austin and Flanagan 2009;Bichhawat et al 2014b;Hriţcu et al 2013a;Sabelfeld and Russo 2009;Stefan et al 2011); the unstructured control flow of a low-level machine poses additional challenges.…”