Hypercollecting semantics and its application to static analysis of information flow

Abstract

We show how static analysis for secure information flow can be expressed and proved correct entirely within the framework of abstract interpretation. The key idea is to define a Galois connection that directly approximates the hyperproperty of interest. To enable use of such Galois connections, we introduce a fixpoint characterisation of hypercollecting semantics, i.e. a "set of sets" transformer. This makes it possible to systematically derive static analyses for hyperproperties entirely within the calculational framework of abstract interpretation. We evaluate this technique by deriving example static analyses. For qualitative information flow, we derive a dependence analysis similar to the logic of Amtoft and Banerjee (SAS'04) and the type system of Hunt and Sands (POPL'06). For quantitative information flow, we derive a novel cardinality analysis that bounds the leakage conveyed by a program instead of simply deciding whether it exists. This encompasses problems that are hypersafety but not k-safety. We put the framework to use and introduce variations that achieve precision rivalling the most recent and precise static analyses for information flow.

Whither Specifications as Programs

“…Mathematically, abstract interpretation is very close to data refinement, where intermediate steps involve changes of data representation. For example, the state space Σ of R : Σ ⊸Σ would be connected with another, say ∆, by a coupling relation ρ : ∆ ⊸ Σ subject to a simulation condition such as S ; ρ ⊇ ρ ; R, recall (3). With a functional coupling, the connection could be ρ( S ∆) ⊒ R (ρ∆).…”

“…Mantel considers a range of security properties via closure operators [24]. The limited usefulness of trace refinement for proving NI even for deterministic programs, as in the chain (12), is discussed by Assaf and Pasqua [3,27]. The formulation of possibilistic noninterference as ∼;R;∼ = R;∼ is due to Joshi and Leino [22] and resembles the formulation of Roscoe et al [35].…”

Decomposition instead of self-composition for proving the absence of timing channels

“…Doing so directly (e.g. by constructing a self-composition [7,36] or a relational program analysis [5,9,11,34,40]) can magnify the overall state space to consider.…”

“…Other recent uses of product programs for program equivalence include [28,44]. Also, a recent work by Assaf et al [5] proposes to verify k-safety (and more general hyper-safety) problems via an abstract interpretation over program trace sets (as opposed to traces), which may be understood as an abstract interpretation over a (possibly unbounded) product of program copies. Recent work by Çiçek et al on relational cost analysis [11] describes a program analysis for checking and inferring resource-usage properties spanning multiple programs.…”

“…As such, several works have looked to improve the basic idea by exploiting structural similarities in the program (e.g., using interleaving composition [27,36,37]). Other works applied similar ideas to improve relational verifiers directly [5,11,31,34]. As discussed Section 7, these approaches (and others) nevertheless rely, at least implicitly, on making k copies of the program, which means that invariants are split across the product program.…”