Information flow security of multi-threaded distributed programs

Abstract

We study noninterference in the setting of multi-threaded distributed programs in which threads share local memories and multi-threaded processes communicate over an insecure network using encryption primitives to secure messages. We extend a simple imperative language with cryptographic operations which are modelled as special expressions respecting the Dolev-Yao assumptions. Then, we adapt to our setting the notion of patterns proposed by Abadi and Rogaway for modelling the equivalence of cryptographic expressions. Based on this notion, we naturally obtain a definition of strongly secure programs corresponding to the one proposed by Sabelfeld and Sands for programs without cryptography. This is, to the best of our knowledge, the first definition of noninterference in a multi-threaded distributed setting, with insecure channels and cryptography. We prove compositionality of secure programs and we adapt the type system of Sabelfeld and Sands to our setting, proving its correctness.

Towards a Type System for Security APIs

“…This will allow us to analyse more accurate representations of functions in widely used security APIs such as PKCS #11 [20]. Adding conditionals will require a modified definition of the indistinguishability of stores, similar to the one given by Focardi and Centenaro [14]. It should be noted that such a change will not affect our results for the indistinguishability of expressions.…”

“…Focardi and Centenaro [14] give a type system for enforcing non-interference in multi-threaded distributed programs which share common memory locations. They use confounders (unique values associated with each new ciphertext) as an abstraction of probabilistic encryption, and give a definition of equivalence for low security values based on the notion of patterns [10].…”

Combining Symbolic and Numerical Domains for Information Leakage Analysis

“…Some of these approaches are, for example, applied to specific programs, e.g., written in VHDL [44], where the analysis of information flow is closely related to the context. Moreover, the secure information flow problem was also handled in different situation, for example with multi-threaded programs [42] or with programs that employ explicit cryptographic operations [3,21].…”

Non-termination and secure information flow

“…The proof is based on a new notion of fast simulation, which builds on the work of Baier, Katoen, Hermanns, and Wolf [BKHW05] on strong and weak simulation on discrete and continuous Markov chains. The theorem that stripping is a fast simulation shows that the theory of probabilistic simulation can be applied fruitfully to the secure information flow problem, giving another proof technique in addition to the more common bisimulation-based approach of work like [LV05], [SA06], and [FR08] on languages with cryptography, and [AFG98], [SV98], [Smi03], [ACF06], [FC08] on multi-threaded languages. The recent work [AS09] on secure information flow in a distributed language also makes use of the technique of stripping and fast simulation, although in a non-probabilistic context.…”