Progress-Sensitive Security for SPARK

Rafnsson, Willard; Garg, Deepak; Sabelfeld, Andrei

doi:10.1007/978-3-319-30806-7_2

Cited by 7 publications

(2 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…SecCSL [Ernst and Murray 2019] Insecurity Separation logic (InsecSL) (Section 4) This kind of compositionality is common, however, to formal program logics (and type systems) used to prove the absence of information leaks [Broberg and Sands 2010;Ernst and Murray 2019;Murray et al 2018;Myers 1999], as well as to static analysis techniques for the same purpose [Rafnsson et al 2016]. Unfortunately, because they are necessarily over-approximate, these techniques may suffer from false alarms, unlike our under-approximate approach.…”

Section: Local Correctness and Securitymentioning

confidence: 99%

Compositional Vulnerability Detection with Insecurity Separation Logic

Murray¹,

Yan²,

Ernst³

2021

Preprint

View full text Add to dashboard Cite

We present the first compositional, incremental static analysis for detecting memory-safety and information leakage vulnerabilities in C-like programs. To do so, we develop the first under-approximate relational program logics, including Insecurity Separation Logic (InsecSL). We show how InsecSL can be automated via backpropagating symbolic execution (BPSE) to build a bottom-up, inter-procedural and incremental analysis for detecting vulnerabilities. We prove our approach sound in Isabelle/HOL and implement it in a proof-of-concept tool, Underflow, for analysing C programs, which we apply to various case studies.

show abstract

Section: Local Correctness and Securitymentioning

confidence: 99%

Compositional Vulnerability Detection with Insecurity Separation Logic

Murray¹,

Yan²,

Ernst³

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…IFC tools IFC research has produced compilers capable of preserving confidentiality of data: Jif [46] and Paragon [12] (based on Java), and FlowCaml [60] (based on Caml). The SPARK language presents a IFC analysis which has been extended to guarantee progress-sensitive non-inference [51]. JSFlow [23] is one of the state-of-the-art IFC system for the web (based on JavaScript).…”

Section: Related Workmentioning

confidence: 99%