Provably Correct Runtime Enforcement of Non-interference Properties

Abstract

Non-interference has become the standard criterion for ensuring confidentiality of sensitive data in the information flow literature. However, application of non-interference to practical software systems has been limited. This is partly due to the imprecision that is inherent in static analyses that have formed the basis of previous non-interference based techniques. Runtime approaches can be significantly more accurate than static analysis, and have often been more successful in practice. However, they can only reason about explicit information flows that take place via assignments in a program. Implicit flows that take place without involving assignments, and can be inferred from the structure and/or semantics of the program, are missed by runtime techniques. This paper seeks to bridge the gap between the accuracy provided by runtime techniques and the completeness provided by static analysis techniques. In particular, we develop a hybrid technique that relies primarily on runtime information-flow tracking, but augments it with static analysis to reason about implicit flows that arise due to unexecuted paths in a program. We prove that the resulting technique preserves non-interference, while providing some of the traditional benefits of dynamic analysis such as improved accuracy.

Dynamic vs. Static Flow-Sensitive Security Analysis

“…Mechanisms by Venkatakrishnan et al [48], Le Guernic et al [28], [27], and Shroff et al [45] combine dynamic and static checks. The mechanisms by Le Guernic et al for sequential [28] and concurrent [27] programs are flowsensitive.…”

Value Sensitivity and Observable Abstract Values for Information Flow Control

“…Some perform static pre-analyzes, i.e., before the execution [13,21,25], or code inlining [12,6,23,29]. In other cases, the static analysis is triggered at runtime by the monitor [22,32,27,19]. A value sensitivity criterion can be applied in the static analysis of this second group.…”

“…However, a roadblock on the way to wider adoption of these tools has been their limited permissiveness i.e secure programs are falsely rejected due to over-approximations. Flow-, context-, and object-sensitive techniques [17] have been suggested to improve the precision of static information flow control, and dynamic and hybrid monitors [22,32,27,20,19] have been explored to leverage the knowledge about the current run for precision. Dynamic and hybrid techniques are particularly promising for highly dynamic languages such as JavaScript.…”

“…They aim to enhance the dynamic analysis with information that allows the label of write target to be changed before entering secret control, thus decoupling the label change from secret influence. For instance, a hybrid approach [22,32,27,19] is to apply a static analysis on the bodies of elevated contexts, e.g., secret conditionals, to find all potential write targets and upgrade them before the body is executed. This paper investigates an alternative approach that improves both pure and hybrid dynamic information flow control as well as other approaches relying on upgrading labels before elevated contexts.…”

Purpose Restrictions on Information Use

“…However, prior methods of detecting noninterference have typically required access to the program running the system in question. These analyses either used the program for directly analyzing its code (see [9] for a survey), for running an instrumented version of the system (e.g., [10][11][12][13]), or for simulating multiple executions of the system (e.g., [14][15][16]). Traditionally, the requirement of access to the program has not been problematic since the analysis has been motivated as a tool for software engineers securing a program that they have designed.…”