Scheduler-Specific Confidentiality for Multi-threaded Programs and Its Logic-Based Verification

Abstract

Abstract. Observational determinism has been proposed in the literature as a way to ensure confidentiality for multi-threaded programs. Intuitively, a program is observationally deterministic if the behavior of the public variables is deterministic, i.e., independent of the private variables and the scheduling policy. Several formal definitions of observational determinism exist, but all of them have shortcomings; for example they accept insecure programs or they reject too many innocuous programs. Besides, the role of schedulers was ignored in all the proposed definitions. A program that is secure under one kind of scheduler might not be secure when executed with a different scheduler. The existing definitions do not ensure that an accepted program behaves securely under the scheduler that is used to deploy the program. Therefore, this paper proposes a new formalization of scheduler-specific observational determinism. It accepts programs that are secure when executed under a specific scheduler. Moreover, it is less restrictive on harmless programs under a particular scheduling policy. We discuss the properties of our definition and argue why it better approximates the intuitive understanding of observational determinism. In addition, we discuss how compliance with our definition can be verified, using model checking. We use the idea of self-composition and we rephrase the observational determinism property for a single program C as a temporal logic formula over the program C executed in parallel with an independent copy of itself. Thus two states reachable during the execution of C are combined into a reachable program state of the selfcomposed program. This allows to compare two program executions in a single temporal logic formula. The actual characterization is done in two steps. First we discuss how stuttering equivalence can be characterized as a temporal logic formula. Observational determinism is then expressed in terms of the stuttering equivalence characterization. This results in a conjunction of an LTL and a CTL formula, that are amenable to model checking.

Confidentiality for Probabilistic Multi-threaded Programs and Its Verification

“…Existing confidentiality properties, such as noninterference [12] and observational determinism [30,15] are not suitable to ensure confidentiality for multi-threaded programs. They only consider input-output behavior, and ignore the role of schedulers, while multi-threaded programs allow all interactions between threads and intermediate results to be observed [30,15,14]. Thus, new methods have to be developed for an observational model where an attacker can access the full code of the program, observe the traces of public data, and limit the set of possible program traces by selecting a scheduler.…”

“…Taking into account the effect of schedulers on confidentiality, we proposed a definition of scheduler-specific observational determinism (SSOD) for possibilistic multi-threaded programs [14]. Basically, a program respects SSOD if (SSOD-1) for any initial state, traces of each public variable are stuttering-equivalent, and (SSOD-2) for any two initial states I and I that are indistinguishable w.r.t.…”

“…Requiring only that a stuttering-equivalent public variable trace exists is not sufficient to guarantee confidentiality for multithreaded programs, as extensively discussed in [30,14]. The first condition avoids leakage of private information based on the observation of public data traces.…”

Qualitative and quantitative information flow analysis for multi-threaded programs

“…The definition of scheduler-specific observational determinism was first published in the proceedings of the 2011 International Conference on Formal Verification of Object-Oriented Software (FoVeOOS'11) (revised selected papers) [47] and also in a corresponding technical report (extended version) [46]. Later, this definition appeared in the Journal of Computer Security (JCS) (A special issue) [69].…”

“…This logic-based verification method was published in the proceedings of the 2011 International Conference on Formal Verification of Object-Oriented Software (FoVeOOS'11) (revised selected papers) [47], and also in a corresponding technical report (extended version) [46]. The top row indicates indexes of states.…”