Model checking security properties of control flow graphs

Abstract

A fundamental problem in software-based security is whether local security checks inserted into the code are sufficient to implement a global security property. This article introduces a formalism based on a linear-time temporal logic for specifying global security properties pertaining to the control flow of the program, and illustrates its expressive power with a number of existing properties. We define a minimalistic, security-dedicated program model that only contains procedure call and run-time security checks and propose an automatic method for verifying that an implementation using local security checks satisfies a global security property. We then show how to instantiate the framework to the security architecture of Java 2 based on stack inspection and privileged method calls.

Types and trace effects of higher order programs

“…Perhaps the principal division between previous approaches to the enforcement of trace based program properties is between those systems that detect errors at run-time [26,22,31,7,6,1,13], vs. those that detect errors at compile-time [3,11,8,30]. Run-time approaches are more accurate since a compiletime analysis must conservatively approximate what events could occur; the compiletime analysis will also reject some safe programs, due to the need to be conservative.…”

“…Trace Specification Logics and Model Checking Some of the aforecited systems also automatically verify assertions at compile-time via model-checking, including [3,11,8], though none of these define a rigorous process for extracting an LTS from higherorder programs. In these works, the specifications are temporal logics, regular languages, or finite automata, and the abstract control flow is extracted as an LTS in the form of a finite automaton, grammar, or PDA.…”

“…[21,8] assume that some (undefined) algorithm has already converted a program to a control flow graph, expressed as a form of PDA.…”

“…The systems in [12,9,21,8] use LTSs extracted from control-flow graph abstractions to model-check program security properties expressed in temporal logic. Their approach is close in several respects, but we are primarily focused on the programming language as opposed to the model-checking side of the problem.…”

Visualization of Permission Checks in Java Using Static Analysis

“…Most static analyses approximate stack inspection in terms of permissions [4,5,1,2,11]. Our proposed analysis is unique in that it compute success or fail information in terms of permission checks.…”