Control and synthesis of non-interferent timed systems

Abstract

In this paper, we focus on the synthesis of secure timed systems which are modelled as timed automata. The security property that the system must satisfy is a non-interference property. Intuitively, non-interference ensures the absence of any causal dependency from a high-level domain to a lower-level domain. Various notions of non-interference have been defined in the literature, and in this paper we focus on Strong Non-deterministic Non-Interference (SNNI) and two (bi)simulation based variants thereof (CSNNI and BSNNI). We consider timed non-interference properties for timed systems specified by timed automata and we study the two following problems: (1) check whether it is possible to find a sub-system so that it is non-interferent; if yes (2) compute a (largest) sub-system which is non-interferent.Security Predicate (BSP) is presented but the synthesis problem is not addressed. Recently supervisory control for opacity property has been studied in [11], [12], [13] in the untimed setting. Opacity is undecidable for timed systems [14] and thus the associated control problem is undecidable as well. In [15] the controller synthesis problem for non-interference properties is addressed for untimed systems. In [16], supervisory control to enforce Intransitive non-interference for three level security systems is proposed in the untimed setting.The non-interference synthesis problem for dense-time systems specified by timed automata was first considered in [17]. The non-interference property considered in [17] is the state non-interference property, which is less demanding than the one we consider here. This paper extends the results of [18] about SNNI control problems for timed systems: Section V addresses the SNNI control problem for timed systems and is a detailed presentation of the result of [18] with proofs of the theorems that were unpublished. Sections III and IV are new and the latter provides a new result, Theorem 2. Section VI addresses the CSNNI and BSNNI control problems for timed systems and also contains new results: Theorems 9, 10, 11 and Propositions 4 and 5.Our Contribution. In this paper, we first exhibit a class dTA of timed automata for which the SNNI verification problem is decidable. The other main results are: (1) we prove that deciding whether there is a controller C for a timed automaton A such that (s.t. in the following) C(A) is SNNI, is decidable for the previous class dTA;(2) we reduce the SNNI controller synthesis problem to solving a sequence of safety timed games; (3) we show that there is not always a most permissive controller for CSNNI and BSNNI; (4) we prove that the control problem for CSNNI is decidable for the class dTA and that the CSNNI controller synthesis problem for dTA reduces to the SNNI controller synthesis problem. We also give the theoretical complexities of these problems. Organization of the paper. Section II recalls the basics of timed automata, timed languages and some results on safety timed games. Section III gives the definition of the non-interference propertie...

Parametric Timed Model Checking for Guaranteeing Timed Opacity

“…In [VNN18], Vasilikos et al define the security of timed automata in term of information flow using a bisimulation relation and develop an algorithm for deriving a sound constraint for satisfying the information flow property locally based on relevant transitions. In [Ben+15a], Benattar et al study the control synthesis problem of timed automata for SNNI. That is, given a timed automaton, they propose a method to automatically generate a (largest) sub-systems such that it is noninterferent if possible.…”

“…As far as we know, this is the first work on parametric model checking for timed automata for information flow property. Compared to [Ben+15a], our approach is more realistic as it does not require change of program structure. Rather, our result provides guidelines on how to choose the timing parameters (e. g., how long to wait after certain program statements) for avoiding information leakage.…”

Overview of discrete event systems opacity: Models, validation, and quantification

“…It is also referred to as symmetrical opacity (Bérard et al (2015b)). It was shown that anonymity (Bryans et al, 2008;Bérard & Mullins, 2014) and some non-interference problems (Cassez et al, 2007;Bryans et al, 2008;Benattar et al, 2015;Bérard et al, 2015c) may be reduced to opacity by using suitable observation functions and depending on the type of secret under consideration. The equivalence between opacity and intransitive non-interference is proven in Mullins & Yeddes (2013).…”

Parametric non-interference in timed automata

“…This work is partially supported by the ANR-NRF French-Singaporean research program ProMiS (ANR-19-CE25-0015). b) Related work: It is well-known (see e. g., [Koc96;Ben+15]) that time is a potential attack vector against secure systems. That is, it is possible that a non-interferent (secure) system can become interferent (insecure) when timing constraints are added [GMR07].…”

“…In [Ben+15], Benattar et al study the control synthesis problem of timed automata for SNNI. That is, given a timed automaton, they propose a method to automatically generate a (largest) sub-systems such that it is non-interferent if possible.…”