Foundations for Parallel Information Flow Control Runtime Systems

Abstract

We present the foundations for a new dynamic information flow control (IFC) parallel runtime system, LIOPAR. To our knowledge, LIOPAR is the first dynamic language-level IFC system to (1) support deterministic parallel thread execution and (2) eliminate both internaland external-timing covert channels that exploit the runtime system. Most existing IFC systems are vulnerable to external timing attacks because they are built atop vanilla runtime systems that do not account for security-these runtime systems allocate and reclaim shared resources (e.g., CPU-time and memory) fairly between threads at different security levels. While such attacks have largely been ignored-or, at best, mitigated-we demonstrate that extending IFC systems with parallelism leads to the internalization of these attacks. Our IFC runtime system design addresses these concerns by hierarchically managing resourcesboth CPU-time and memory-and making resource allocation and reclamation explicit at the language-level. We prove that LIOPAR is secure, i.e., it satisfies progress-and timing-sensitive non-interference, even when exposing clock and heap-statistics APIs.

Static Enforcement of Security in Runtime Systems

“…The goal of their work is securing the execution platform of LIO [33], a dynamic information flow control library for Haskell. Similar to our work, Vassena et al [38] consider a setting in which an attacker can obtain the current global time as a natural number counting execution steps, and (unlike our model) the current size of the heap. They design a system for hierarchically managing space and time resources with some amount of burden on the programmer: a parent thread has to manually kill their child thread to reclaim resources.…”

“…Vassena et al [38] present a new foundation for a dynamic information flow control parallel runtime system. The goal of their work is securing the execution platform of LIO [33], a dynamic information flow control library for Haskell.…”

Multi-Execution Lattices Fast and Slow

“…There is a significant body of work on embedding IFC in Haskell [3,17,22,27,38,41,43,48,[50][51][52]. Most of which falls into the category of "monadic" IFC libraries in which the code that is subject to IFC enforcement is written using a specialized interface exported by the library.…”

An Axiomatic Approach to Detect Information Leaks in Concurrent Programs

“…Other than the above approach, the majority of the mechanisms found in the literature to prevent timing leaks in concurrent programs are based on either (i) developing a sound typing rules to enforce secure-flow properties in concurrent programming languages [19], [21]; (ii) performing source transformation to balance the time variation or eliminate the timing channel [18], [20], [34]; or (iii) developing a run-time monitor to identify potentially dangerous executions that could leak information [14], [35], [36].…”

“…Then, output 'acdb' arising due to concurrent executions of T 1 and T 2 reveal the value of h as 0. There have been a few efforts aiming to prevent timing leaks in concurrent or multi-threaded programs [14], [15], [16], [17], [18], [19], [20], [21] but majorly have sidestepped the issue that arise due to output statements.…”