Multi-Execution Lattices Fast and Slow

Abstract

Methods for automatically, soundly, and precisely guaranteeing the noninterference security policy are predominantly based on multi-execution. All other methods are either based on undecidable theorem proving or suffer from false alarms. The multi-execution mechanisms, meanwhile, work by isolating security levels during program execution and running multiple copies of the target program, once for each security level with carefully tailored inputs that ensure both soundness and precision. When security levels are hierarchically organised in a lattice, this may lead to an exponential number of executions of the target program as the number of possible ways of combining security levels grows. In this paper we study how the lattice structure for security levels influences the runtime overhead of multi-execution. We additionally show how to use Galois connections to gain speedups in multi-execution by switching from lattices with high overhead to lattices with low overhead. Additionally, we give an empirical evaluation that corroborates our analysis and shows how Galois connections have potential to speed up multi-execution. REVIEW OF THE MULTI-EXECUTION FRAMEWORKA (join semi-)lattice L is a set L with a transitive, reflexive, and antisymmetric order ⊑ that has a least element ⊥ and is such that any two elements ℓ, ∈ L have a least upper bound ℓ ⊔ ∈ L. For a finite subset ⊆ L we write for the least upper bound of all elements in . For example, the two-point lattice has L = {L, H}, L denotes public information and H denotes secret information. Public information can flow to secret information so ⊑ is the smallest reflexive relation such that L ⊑ H. Finally, this means that L ⊔ L = L and ℓ ⊔ = H if either ℓ or is H.Following Algehed and Flanagan [2] we consider batch-job programs from labeled sets to labeled sets and let , , range over partial recursive functions from P ( × L) to P ( × L) for some set of inputs and outputs . This is a convenient formalism, as it allows us to succinctly state the core definitions that allow us to reason about multi-execution. The following definitions (from [2]) are sufficient to precisely define Noninterference.Definition 2.1. Assume ℓ ∈ L and , ⊆ × L for some , define the projection of at ℓ as (we write the pair ( , ) as ):We say that and are ℓ-equivalent, meaning they look the same to an observer at level ℓ, written ∼ ℓ , if and only if their ℓprojections are the same:The projection ↓ ℓ of at ℓ is precisely all the information in that is visible to ℓ. Likewise, this means that if two sets and look the same to ℓ, then they are ℓ-equivalent. The definition of noninterference meanwhile is that is noninterfering if it does not reveal more about its inputs than what one can know by looking at the input. In other words, if two inputs and differ only in values that are secret to an observer at level ℓ, they are ℓ-equivalent, then ( ) and ( ) should also be ℓ-equivalent.Definition 2.2 (Noninterference). We say that program : P ( × L) → P ( × L) is noninterfering if it preserves ℓ-equivalence....