Dynamic intransitive noninterference revisited

Eggert, Sebastian; Meyden, Ron van der

doi:10.1007/s00165-017-0430-6

Cited by 6 publications

(3 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The future work goal of this paper is to improve the method of formal proof based on the context of loop sentences and strive to accurately output the final context of loop sentences. Moreover, we also will learn Nickel [24] framework, a formulation of noninterference amenable to automated verification static noninterference, and we will design an automatic verification framework that formalizations and interface designs that are amenable to automated verification of dynamic noninterference [25] to verify security for ARINC653 core services.…”

Section: Discussionmentioning

confidence: 99%

A Framework for Model and Verification of Safety-Critical Operating System Based on ARINC653

Xu¹,

Ma²

2021

Electronics

View full text Add to dashboard Cite

As the scale and complexity of safety-critical software continue to grow, it is necessary to ensure safety and reliability to avoid minor errors leading to catastrophic disasters. Meantime, the traditional method, such as testing and simulation alone is insufficient to ensure the correctness of systems. This leads to using formal methods to provide sufficient evidence for systems. However, design a high assurance safety-critical system by formal methods is challenging due to the complexity of operating systems. In addition, the traditional interactive theorem prover used in system verification requires hand-written proofs, which are more expensive. Therefore, the efforts of providing a standardized formal framework as well as safety proofs, are notable for the develop a safety-critical system. The purpose of this paper is to provide a safety framework to establish a highly reliable and safety-critical operating system based on the ARINC653 standard, a multilevel and standardized formal model. To verify the functional correctness of this model, we propose a context-based formal proof method for programs. To achieve this goal, we first model 57 core services of ARINC653 and define the high-level requirements as pre-and post-conditions. Then, we construct a set of specification statements a formal axiom system transformed into logical sentences, and the core service model is transformed into a logical sentence sequence to be proved. Finally, a context-based formal proof system for specification correctness is developed. We have verified the correctness of safety-critical operating system core services with this system. Experience shows that the verification system we developed can be achieved the functional correctness of a complete OS with a low implement burden, and that can simplify the difficulty of automated verification and increase the degree of automation of proof.

show abstract

Section: Discussionmentioning

confidence: 99%

A Framework for Model and Verification of Safety-Critical Operating System Based on ARINC653

Xu¹,

Ma²

2021

Electronics

View full text Add to dashboard Cite

show abstract

“…Monotonicity with respect to restrictiveness. In [18] the notion of monotonicity with respect to restrictiveness is discussed, which holds for a given notion of security X if, for all systems M and policies → over the domain set of M, the following statement holds: if M is X-secure with respect to → then M is X-secure with respect to every policy → ′ with →⊆ → ′ . If a notion of security satisfies this property, we will say that it is monotonic.…”

Section: Policiesmentioning

confidence: 99%

On Reductions from Multi-Domain Noninterference to the Two-Level Case

Woizekowski

Meyden

2016

Computer Security – ESORICS 2016

Self Cite

View full text Add to dashboard Cite

The literature on information flow security with respect to transitive policies has been concentrated largely on the case of policies with two security domains, High and Low, because of a presumption that more general policies can be reduced to this two-domain case. The details of the reduction have not been the subject of careful study, however. Many works in the literature use a reduction based on a quantification over "Low-down" partitionings of domains into those below and those not below a given domain in the information flow order. A few use "High-up" partitionings of domains into those above and those not above a given domain. Our paper argues that more general "cut" partitionings are also appropriate, and studies the relationships between the resulting multi-domain notions of security when the basic notion for the two-domain case to which we reduce is either Nondeducibility on Inputs or Generalized Noninterference. The Low-down reduction is shown to be weaker than the others, and while the High-up reduction is sometimes equivalent to the cut reduction, both it and the Low-down reduction may have an undesirable property of non-monotonicity with respect to a natural ordering on policies. These results suggest that the cut-based partitioning yields a more robust general approach for reduction to the two-domain case.

show abstract

“…More often than not, software systems are built as a collection of concurrently executing threads of execution that cooperate to process data. In doing so, these threads collectively implement security policies in which the sensitivity of the data being processed is often data-dependent [1]- [10], and the rules about to whom it can be disclosed and under what conditions can be non-trivial [11]- [16]. The presence of concurrency greatly complicates reasoning, since a thread that behaves securely when run in isolation can be woefully insecure in the presence of interference from others [10], [17]- [19] or due to scheduling [20], [21].…”

Section: Introductionmentioning

confidence: 99%

VERONICA: Expressive and Precise Concurrent Information Flow Security (Extended Version with Technical Appendices)

Schoepe,

Murray,

Sabelfeld

2020

Preprint

View full text Add to dashboard Cite

Methods for proving that concurrent software does not leak its secrets has remained an active topic of research for at least the past four decades. Despite an impressive array of work, the present situation remains highly unsatisfactory. With contemporary compositional proof methods one is forced to choose between expressiveness (the ability to reason about a wide variety of security policies), on the one hand, and precision (the ability to reason about complex thread interactions and program behaviours), on the other. Achieving both is essential and, we argue, requires a new style of compositional reasoning.We present VERONICA, the first program logic for proving concurrent programs information flow secure that supports compositional, high-precision reasoning about a wide range of security policies and program behaviours (e.g. expressive declassification, value-dependent classification, secret-dependent branching). Just as importantly, VERONICA embodies a new approach for engineering such logics that can be re-used elsewhere, called decoupled functional correctness (DFC). DFC leads to a simple and clean logic, even while achieving this unprecedented combination of features. We demonstrate the virtues and versatility of VERONICA by verifying a range of example programs, beyond the reach of prior methods.

show abstract

Dynamic intransitive noninterference revisited

Cited by 6 publications

References 38 publications

A Framework for Model and Verification of Safety-Critical Operating System Based on ARINC653

A Framework for Model and Verification of Safety-Critical Operating System Based on ARINC653

On Reductions from Multi-Domain Noninterference to the Two-Level Case

VERONICA: Expressive and Precise Concurrent Information Flow Security (Extended Version with Technical Appendices)

Contact Info

Product

Resources

About