Hypercollecting semantics and its application to static analysis of information flow

Abstract

We show how static analysis for secure information flow can be expressed and proved correct entirely within the framework of abstract interpretation. The key idea is to define a Galois connection that directly approximates the hyperproperty of interest. To enable use of such Galois connections, we introduce a fixpoint characterisation of hypercollecting semantics, i.e. a "set of sets" transformer. This makes it possible to systematically derive static analyses for hyperproperties entirely within the calculational framework of abstract interpretation. We evaluate this technique by deriving example static analyses. For qualitative information flow, we derive a dependence analysis similar to the logic of Amtoft and Banerjee (SAS'04) and the type system of Hunt and Sands (POPL'06). For quantitative information flow, we derive a novel cardinality analysis that bounds the leakage conveyed by a program instead of simply deciding whether it exists. This encompasses problems that are hypersafety but not k-safety. We put the framework to use and introduce variations that achieve precision rivalling the most recent and precise static analyses for information flow.

Whither Specifications as Programs

“…Mantel considers a range of security properties via closure operators [24]. The limited usefulness of trace refinement for proving NI even for deterministic programs, as in the chain (12), is discussed by Assaf and Pasqua [3,27]. The formulation of possibilistic noninterference as∼;R;∼ = R;∼ is due to Joshi and Leino [22] and resembles the formulation of Roscoe et al [35].…”

“…A primary precursor to this paper is the dissertion work of Assaf, which targets refinement chains in the style of abstract interpretation [13,11]. Assaf's work [3] introduced a set-of-sets lifted semantics from which our h-transformer semantics is adapted. In keeping with the focus on static analysis, Assaf shows the lifted semantics is an approximation of the underlying one.…”

“…Their inequational result corresponding to our Theorem is proved, in the loop case, using explicit induction on approximation chains. See the proof of Theorem 1 in[3] 6. Displayed formula {{| c | }T | T ∈ T} ⊆ c T following Theorem 1 of[3].…”

“…See the proof of Theorem 1 in[3] 6. Displayed formula {{| c | }T | T ∈ T} ⊆ c T following Theorem 1 of[3].…”

Constructive Galois Connections

“…If a relational analyzer (Cousot & Halbwachs, 1978) was desired, one could point exactly where in the calculation this information was lost via the independent attributes abstraction, and correct it locally. E.g., recent results in information flow analysis show how to obtain more precise analyzers in exactly this way: by pinpointing and correcting the loss of precision after deriving the analysis using the calculational method (Assaf et al, 2017).…”