Abstraction-Carrying Code: a Model for Mobile Code Safety

Theory and Practice of Logic Programming

Puebla

et al. 2011

Self Cite

Link to this article: http://journals.cambridge.org/abstract_S1471068410000487How to cite this article: ELVIRA ALBERT, PURI ARENAS, GERMÁN PUEBLA and MANUEL HERMENEGILDO (2012). Certicate size reduction in abstraction-carrying code. AbstractAbstraction-Carrying Code (ACC) has recently been proposed as a framework for mobile code safety in which the code supplier provides a program together with an abstraction (or abstract model of the program) whose validity entails compliance with a predefined safety policy. The abstraction plays thus the role of safety certificate and its generation is carried out automatically by a fixpoint analyzer. The advantage of providing a (fixpoint) abstraction to the code consumer is that its validity is checked in a single pass (i.e., one iteration) of an abstract interpretation-based checker. A main challenge to make ACC useful in practice is to reduce the size of certificates as much as possible while at the same time not increasing checking time. The intuitive idea is to only include in the certificate information that the checker is unable to reproduce without iterating. We introduce the notion of reduced certificate which characterizes the subset of the abstraction which a checker needs in order to validate (and re-construct) the full certificate in a single pass. Based on this notion, we instrument a generic analysis algorithm with the necessary extensions in order to identify the information relevant to the checker. Interestingly, the fact that the reduced certificate omits (parts of) the abstraction has implications in the design of the checker. We provide the sufficient conditions which allow us to ensure that (1) if the checker succeeds in validating the certificate, then the certificate is valid for the program (correctness) and (2) the checker will succeed for any reduced certificate which is valid (completeness). Our approach has been implemented and A preliminary version of this work appeared in the Proceedings of ICLP'06 (Albert et al. 2006). E. Albert et al.benchmarked within the CiaoPP system. The experimental results show that our proposal is able to greatly reduce the size of certificates in practice. IntroductionProof-Carrying Code (PCC) Necula (1997) is a general framework for mobile code safety which proposes to associate safety information in the form of a certificate to programs. The certificate (or proof) is created at compile time by the certifier on the code supplier side, and it is packaged along with the code. The consumer that receives or downloads the (untrusted) code + certificate package can then run a checker, which by an efficient inspection of the code and the certificate can verify the validity of the certificate and thus comply with the safety policy. The key benefit of this "certificate-based" approach to mobile code safety is that the task of the consumer is reduced from the level of proving to the level of checking, a procedure that should be much simpler, efficient, and automatic than generating the original certificate.Abstraction-Carrying C...

mentioning

confidence: 99%

Certificate size reduction in abstraction-carrying code

Theory and Practice of Logic Programming

Puebla

et al. 2011

Self Cite

“…If the check succeeds, i.e., the loop condition does not hold, then the body of the loop is not executed and the control goes to instruction 31, where the constant −1 is returned as the result (instruction 32) of the method. Otherwise the value of (l+u)/2 is stored in m in instructions [3][4][5][6][7][8] This section describes how a bytecode program is analyzed in order to produce a cost relation system (CRS) which describes its resource consumption. The analysis consists of a number of steps: (1) the control flow graph of the program is computed, and afterwards (2) the program is transformed into a rule-based representation which facilitates the subsequent steps of the analysis without losing information about the resource consumption; (3) size analysis and abstract compilation are used to generate size relations which describe how the size of data changes during program execution; (4) the chosen cost model is applied to each instruction in order to obtain an expression which represents its cost; (5) finally, a cost relation system is obtained by joining the information gathered in the previous steps.…”

Section: The Context: Object-oriented Bytecodementioning

confidence: 99%

“…In addition, equations are not necessarily mutually exclusive, which means that at each evaluation step there are several equations that can be applied. For example, if all three recursive equations that we have seen above are defined in the same CR, then the upper bound would be max( [7,8,9]) * (2 nat(n0) − 1) + 3 * 2 nat(n0) . Note that the worstcase for the cost of each application is determined by the first equation, which contributes the largest cost, i.e., 9.…”

Section: Bounds On the Number Of Applications Of Equationsmentioning

confidence: 99%

“…In the case of COSTA, a PCC-based scenario can obtained by using ideas from Abstraction-Carrying Code [7] (ACC), which proposes to use abstract interpretation as enabling technology for PCC. The main idea in ACC is to use, at the producer's side, a fixed point-based static analyzer, in order to automatically infer an abstract model (or simply abstraction) of the mobile code which can then be used to prove that this code is secure w.r.t.…”

Section: Scenarios For Resource Certificationmentioning

confidence: 99%

See 1 more Smart Citation

Resource Usage Analysis and Its Application to Resource Certification

Foundations of Security Analysis and Design V

Genaim

et al. 2009

Self Cite

Abstract. Resource usage is one of the most important characteristics of programs. Automatically generated information about resource usage can be used in multiple ways, both during program development and deployment. In this paper we discuss and present examples on how such information is obtained in COSTA, a state of the art static analysis system. COSTA obtains safe symbolic upper bounds on the resource usage of a large class of general-purpose programs written in a mainstream programming language such as Java (bytecode). We also discuss the application of resource-usage information for code certification, whereby code not guaranteed to run within certain user-specified bounds is rejected.

“…Automatic cost analysis has interesting applications in the context of Java bytecode [3]. For instance, the code receiver may want to infer (or to check, in the spirit of Proof-Carrying Code [22]) cost information in order to decide whether to reject code which has too large cost requirements in terms of computing resources (in time and/or space) [6,17,12,9], and to accept code meeting the established requirements. Moreover, in parallel systems, knowledge about the cost of different procedures in the object code can be used in order to guide the partitioning, allocation and scheduling of parallel processes [13].…”

Section: Introductionmentioning

confidence: 99%

Removing useless variables in cost analysis of Java bytecode

Proceedings of the 2008 ACM Symposium on Applied Computing

Genaim

et al. 2008

Automatic cost analysis has interesting applications in the context of verification and certification of mobile code. For instance, the code receiver can use cost information in order to decide whether to reject mobile code which has too large cost requirements in terms of computing resources (in time and/or space) or billable events (SMSs sent, bandwidth required). Existing cost analyses for a variety of languages describe the resource consumption of programs by means of Cost Equation Systems (CESs), which are similar to, but more general than recurrence equations. CESs express the cost of a program in terms of the size of its input data. In a further step, a closed form (i.e., non-recursive) solution or upper bound can sometimes be found by using existing Computer Algebra Systems (CASs), such as Maple and Mathematica. In this work, we focus on cost analysis of Java bytecode, a language which is widely used in the context of mobile code and we study the problem of identifying variables which are useless in the sense that they do not affect the execution cost and therefore can be ignored by cost analysis. We identify two classes of useless variables and propose automatic analysis techniques to detect them. The first class corresponds to stack variables that can be replaced by program variables or constant values. The second class corresponds to variables whose value is cost-irrelevant, i.e., does not affect the cost of the program. We propose an algorithm, inspired in static slicing which safely identifies cost-irrelevant variables. The benefits of eliminating useless variables are two-fold: (1) cost analysis without useless variables can be more efficient and (2) resulting CESs are more likely to be solvable by existing CASs.