Automaton-based Confidentiality Monitoring of Concurrent Programs

Dynamic vs. Static Flow-Sensitive Security Analysis

“…Monitors that stop execution of programs are modeled in Figure 10 by the rule (O-Failstop), monitors that output default values are composed by the rule (O-Default), and monitors that suppresses outputs are modeled by the rule (O-Suppress). That the framework allows for useful combinations of these behaviors is illustrated by the rule (O-Default/Suppress), which is used by Le Guernic et al [28].…”

“…Interestingly, the (O-Default/Suppress) reaction instantiation corresponds to the hybrid enforcement by Le Guernic et al [28]. The instantiation for the static part of the analysis is simply the set of variables occurring on the left-hand side of assignment in c for function update H (c); and the union of security levels of variables occurring in expression e for function lev (e, Γ).…”

“…Clearly, we are not interested on this kind of monitors. It is often argued (e.g, [28], [45]) that one of the main advantages of monitors over static analysis is permissiveness. For example, assuming that l and h are respectively public and secret variables, program if l then output L (h) else output L (1) is rejected by the Hunt-Sands-style type system due to the presence of command output L (h).…”

“…Besides the general benefits of a single proof for multiple instantiations (for the static analysis part and for the reaction method of the enforcement), one consequence is a proof of a stronger (and arguably more adequate) security property for one of the instantiations: a monitor by Le Guernic et al [28] for a language with output. The original proof [28] is with respect to a batch-job style security where all diverging runs (which might simply output all secrets on a public channel before diverging) are considered secure. Our result implies a proof against a stronger version of terminationinsensitive noninterference [1], designed to reason about programs with output, where leaks due to (lack of) progress in the computation are ignored.…”

“…Fusion of static and dynamic techniques is becoming increasingly popular [28], [45], [27], [49]. These techniques offer benefits of increasing permissiveness because more information on the actual execution trace is available at runtime, while keeping runtime overhead moderate as some static information can be gathered before the execution.…”