Model-Checking In-Lined Reference Monitors

Aspect-Oriented Runtime Monitor Certification

“…Our prior work [30] is the first to adopt a model-checking approach to verify such IRMs without trusted guard code. The prototype IRM certifier in [30] supports reified security state, but it does not support dynamic pointcuts and its support for advice is limited to a very constrained form of before-advice.…”

“…The prototype IRM certifier in [30] supports reified security state, but it does not support dynamic pointcuts and its support for advice is limited to a very constrained form of before-advice. It therefore does not support real-world IRM systems or their policies, which regularly employ dynamic pointcuts and after-advice.…”

“…To provide exceptionally high assurance guarantees, recent work has sought to reduce the (potentially large) trusted computing bases (TCBs) of IRM frameworks by separately machine-verifying the self-monitoring code they produce [17,1,30,31]. For example, the S 3 MS project uses a contract-based verifier [1] to avoid trusting the the much larger in-liner (over 900K lines of Java code if one includes the underlying AspectJ system [22]) that generates the IRMs.…”

“…Past case studies have demonstrated that such advice is extremely difficult to write correctly, especially when the policy is intended to apply to large classes of untrusted programs rather than individual applications [21]. Moreover, in many domains, such as web ad security, policy specifications change rapidly as new attacks and vulnerabilities are discovered (cf., [23,29,30]). Thus, the considerable effort that might be devoted to formally verifying one particular aspect implementation quickly becomes obsolete when the aspect is revised in response to a new threat.…”

“…Cheko was inspired by our prior work on model-checking IRMs [30,29,9], but includes numerous substantial theoretic and pragmatic leaps beyond those earlier works. These include:…”