Verification of control flow based security properties

Abstract

A fundamental problem in software-based security is whether local security checks inserted into the code are sufficient to implement a global security property. We introduce a formalism based on a two-level lineartime temporal logic for specifying global security properties pertaining to the control-flow of the program, and illustrate its expressive power with a number of existing properties. We define a minimalistic, security-dedicated program model that only contains procedure call and run-time security checks and propose an automatic method for verifying that an implementation using local security checks satisfies a global security property. For a given formula in the temporal logic we prove that there exists a bound on the size of the states that have to be considered in order to assure the validity of the formula: this reduces the problem to finite-state model checking. Finally, we instantiate the framework to the security architecture proposed for Java (JDK 1.2).

Compositional Verification of Secure Applet Interactions

“…modal µ-calculus specifications [4]. The development of our program model follows earlier work by Jensen et al [11] which addresses security properties expressible as stack invariants. These form a strict subset of the properties which can be expressed in our framework, but allow for more efficient model checking procedures.…”

“…Standard models of this kind are provided by labeled transition systems (LTS), where the transition labels denote method invocations and returns. Interaction behavior can then be defined in an abstract and language independent fashion, following the approach by Jensen et al [11], as being induced by a transfer/call graph through a set of transition rules. Composition of behaviors is obtained in process algebraic style by using imperfect actions which handshake to produce perfect communications.…”

“…This model is inspired by [11], and was motivated and presented informally by the present authors in [2].…”

Adding Nesting Structure to Words

“…Decision procedures for certain classes of non-regular properties already exist [JMT99, CW02, EKS03, CMM + 04]. The idea of making calls and returns in a recursive program visible to the specification language for writing properties appears implicitly in [JMT99] which proposes a logic over stack contents to specify security constraints, and in [EKS03] which augments linear temporal logic with regular valuations over stack contents, and in our recent work on the temporal logic Caret that allows modalities for matching calls and returns [AEM04]. Also, properties expressing boundedness of stack, and repeatedly boundedness, have received a lot of attention recently [CDT02,BSW03].…”

Extended Weighted Pushdown Systems

“…Besides dataflow analysis, model-checking of pushdown systems has also been used for verifying security properties in programs [6,9,5]. Like WPDSs, we can use EW-PDS for this purpose, but with added precision that comes due to the presence of merging functions.…”