Noninterference under Weak Memory Models

Abstract

Research on information flow security for concurrent programs usually assumes sequential consistency although modern multi-core processors often support weaker consistency guarantees. In this article, we clarify the impact that relaxations of sequential consistency have on information flow security. We consider four memory models and prove for each of them that information flow security under this model does not imply information flow security in any of the other models. This result suggests that research on security needs to pay more attention to the consistency guarantees provided by contemporary hardware. The other main technical contribution of this article is a program transformation that soundly enforces information flow security under different memory models. This program transformation is significantly less restrictive than a transformation that first establishes sequential consistency and then applies a traditional information flow analysis for concurrent programs.

Prototyping Formal System Models with Active Objects

“…However, they are mostly used as a more precise alternative to pen-and-paper definitions and suffer from the similar downsides: (1) they provide no additional modularity or interface abstractions-they do not simplify reasoning about a model, they merely formalize it. For example, Weber [37] provides an Isabelle formalization of the memory model of Mantel et al [23] and finds notational errors that do not compromise the theoretical results, but hamper comprehensibility. These mistakes were discovered, because the tool enforces syntax checks, not because the formalization itself would provide a clearer structure.…”

“…Our model conceptually follows the one by Mantel et al [23], so we mostly compare it to theirs. Their main goal is to establish non-interference results for weak memory models, while ours is to produce a modular, easy-to-follow, and analyzable formalization.…”

“…the two main principles of weak memory models [1]. Our model is based on ideas taken from Boudol et al [6], where identifiers-similar to the futures in ABS-are used and from Mantel et al [23], where relaxation of the instruction order is characterized by pair-wise comparisons on the queue of memory accesses. To keep this paper within reasonable length, we give no examples for some features of memory models, such as fences and visibility beyond read-own-write.…”

“…In case of a write, the given value is written to memory. The strategy method implements the procedure defined in Mantel et al [23]: At each position i of list, the access at position i is compared to all accesses on positions j < i. The maySwap method takes two accesses and decides whether the second access can be executed before the first one.…”

“…The latter became very widespread, but their consequences are notoriously hard to understand. Currently, weak memory models are generally formulated as a term rewriting system for a small step operational semantics (SOS) [6,23], as abstract automata [30,33], or as axiomatic/algebraic description of traces [7,29]. The advantage of these formalisms is to give the modeler freedom to adjust the formal semantics so it matches the underlying intuition and to formulate properties of interest without any restriction.…”