+ All Categories
Home > Documents > State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf ·...

State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf ·...

Date post: 15-Jan-2020
Category:
Upload: others
View: 0 times
Download: 0 times
Share this document with a friend
56
Secure Information Flow and Pointer Confinement in a Java-like Language Anindya Banerjee and David A. Naumann Kansas State University and Stevens Institute of Technology ,
Transcript
Page 1: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Secure

Information

Flow

and

Pointer

Confinem

entina

Java-likeLanguage

Anindya

Banerjee

andD

avidA

.Naum

ann

������ ������� ��� � ����� ���� ���������

Kansas

State

University

andS

tevensInstitute

ofTechnology

��� �� �� �����������

,

��� ��� ���� ������ ���� ���� � ��

� ���� ����

Page 2: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

The

Prob

lem�

System

with

High

andLow

inputs,L�

H.

H

secret/private/classified

Lusers

permitted

tosee

Loutputs.

(Security

Policy:

Confidentiality

“PR

OT

EC

TS

EC

RE

TS

”)

Form

alisefor

systems

programm

edin

Java-likelanguages.

Noninterference

(NI)

[Goguen-M

eseguer’82]

“No

matter

howH

inputschange,L

outputsrem

ainsam

e”.

No

information

flowfrom

Hto

L.

� ���� �� �

Page 3: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

The

Prob

lem�

System

with

High

andLow

inputs,L�

H.

H

secret/private/classified

Lusers

permitted

tosee

Loutputs.

(Security

Policy:

Confidentiality

“PR

OT

EC

TS

EC

RE

TS

”)

Form

alisefor

systems

programm

edin

Java-likelanguages.

Noninterference

(NI)

[Goguen-M

eseguer’82]

“No

matter

howH

inputschange,L

outputsrem

ainsam

e”.

No

information

flowfrom

Hto

L.

� ���� �� � !"

Page 4: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Our

Contrib

ution

Type-basedanalysis

forsecure

information

flow.

Sequential,Java-like

language

#

privatefields,class-based

visibility

#

mutually

recursiveclasses,m

ethods

#

pointers,mutable

state,dynamic

allocation

#

inheritance,dynamic

dispatch

� ���� ��%$

Page 5: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Our

Contrib

ution

Type-basedanalysis

forsecure

information

flow.

Sequential,Java-like

language

Security

typesystem

Data

flow(via

mutable

fields)

Controlflow

(viadynam

icdispatch)

ProofofN

oninterference(denotationalsem

antics,com

positionalproofs)

� ���� ���&

Page 6: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Our

Contrib

ution

Type-basedanalysis

forsecure

information

flow.

Sequential,Java-like

language

Security

typesystem

#

Data

flow(via

mutable

fields)

Controlflow

(viadynam

icdispatch)

ProofofN

oninterference(denotationalsem

antics,com

positionalproofs)

� ���� �� & !"

Page 7: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Our

Contrib

ution

Type-basedanalysis

forsecure

information

flow.

Sequential,Java-like

language

Security

typesystem

#

Data

flow(via

mutable

fields)

#

Controlflow

(viadynam

icdispatch)

ProofofN

oninterference(denotationalsem

antics,com

positionalproofs)

� ���� ���& !'

Page 8: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Our

Contrib

ution

Type-basedanalysis

forsecure

information

flow.

Sequential,Java-like

language

Security

typesystem

#

Data

flow(via

mutable

fields)

#

Controlflow

(viadynam

icdispatch)

ProofofN

oninterference(denotationalsem

antics,com

positionalproofs)

� ���� ���& !(

Page 9: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

What

We

Have

Not

Done�

Extension

tofullJavaC

ard

#

Exceptions

#

Protected

fields,private/protectedclasses,

interfaces,packages

Extension

tofullJava

#

Threads

#

Class

loading,Reflection,N

ativem

ethods

#

Generics

#

...

� ���� ��%)

Page 10: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Pre

viousW

ork:M

ainInspirations

Noninterference:

Goguen-M

eseguer,Denning-D

enning

Type-basedanalyses

forinform

ationflow

:

1996–S

mith,V

olpano(S

imple

Imperative

Language)

1999–A

badietal.(D

CC

–Info.

flowas

dependenceanalysis)

1999–S

abelfeld,Sands

(Threads,P

oss.N

I,Prob.

NI)

1999M

yers(Java

–butN

Iopen)

2000–P

ottier,Sim

onet,Conchon

(Core

ML)

� ���� ��%*

Page 11: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Pre

viousW

ork:M

ainInspirations

AbstractInterpretation

basedanalyses

forinfo.

flow:

1992M

izuno,Schm

idt(Logicalrelationsto

proveN

I)

Our

focus:

Type-basedanalyses

forinform

ationflow

:(S

mith,

Volpano)

Cope

with

threads,non-determinism

,stochasticprocesses,declassification,...

Cope

with

realisticprogram

ming

languages.

� ���� ��%+

Page 12: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Pre

viousW

ork:M

ainInspirations

AbstractInterpretation

basedanalyses

forinfo.

flow:

1992M

izuno,Schm

idt(Logicalrelationsto

proveN

I)

Our

focus:

Type-basedanalyses

forinform

ationflow

:(S

mith,

Volpano)

#

Cope

with

threads,non-determinism

,stochasticprocesses,declassification,...

#

Cope

with

realisticprogram

ming

languages.

� ���� �� + !"

Page 13: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(1)

�,���-.��� �� /� ��0 �1 ��2 �� ��� ��3 ��� ��4�5 4

6 �4��7�� 8

6 �4��77 � 9� :;2 4��4�� ,<��� 8=

� ����� 9� : 6 �4��7�;

2 � ,<��� >@?�8=

=

� ���� ��%A

Page 14: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(1)

�,���-.��� �� /� ��0 �1 ��2 �� ��� ��3 ��� ��4�5 4

6 �4��7�� 8

6 �4��77 � 9� :;2 4��4�� ,<��� 8=

� ����� 9� : 6 �4��7�;

2 � ,<��� >@?�8=

=

�,���B.��� �� /� ��-.��� ��

2

6 �4��7���8�� 6 CDE CF

6 �4��77 � GHI:;2 4��4�� ,<����8=

� ����� GHI: 6 �4��7�;2 � ,<����> ?�8==

� ���� �� A !"

Page 15: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(1)

-.��� ��,3>@?4�J�,:;8

6 �4��7-K� <>@?,3 �7 � 9� :;8 6 �4��7GK� <>@?,3 �7 � 9� :;8

LBuf L

lp.name L

HB

uf

B.��� ��/3 >@?��B.��� ��:;8 /3 ��� 9� : -K� <;8

LBuf L

lp.name L

HB

uf L

xp.name

HB

ufxp.hiv;

LBuf

lp.name

xp.name

lp.name

xp.hiv

� ���� ��%M

Page 16: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(1)

-.��� ��,3>@?4�J�,:;8

6 �4��7-K� <>@?,3 �7 � 9� :;8 6 �4��7GK� <>@?,3 �7 � 9� :;8

LBuf L

lp.name L

HB

uf

B.��� ��/3 >@?��B.��� ��:;8 /3 ��� 9� : -K� <;8

LBuf L

lp.name L

HB

uf L

xp.name

6 �4��7GK� <>@?4�J45 F4���D �� �� ,:;8 /3 ��� GHI: GK� <;8

HB

uf L

xp.hiv;LB

uf Llp.nam

e L

xp.name

lp.name

xp.hiv

� ���� �� M !"

Page 17: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(1)

-.��� ��,3>@?4�J�,:;8

6 �4��7-K� <>@?,3 �7 � 9� :;8 6 �4��7GK� <>@?,3 �7 � 9� :;8

LBuf L

lp.name L

HB

uf

B.��� ��/3 >@?��B.��� ��:;8 /3 ��� 9� : -K� <;8

LBuf L

lp.name L

HB

uf L

xp.name

6 �4��7GK� <>@?4�J45 F4���D �� �� ,:;8 /3 ��� GHI: GK� <;8

HB

uf L

xp.hiv;LB

uf Llp.nam

e L

xp.name

-K� <>@?GK� <8 ,3 ��� 9� : /3 �7 � GHI:;;

lp.name

xp.hiv

� ���� ��%M !'

Page 18: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(1)

-.��� ��,3>@?4�J�,:;8

6 �4��7-K� <>@?,3 �7 � 9� :;8 6 �4��7GK� <>@?,3 �7 � 9� :;8

LBuf L

lp.name L

HB

uf

B.��� ��/3 >@?��B.��� ��:;8 /3 ��� 9� : -K� <;8

LBuf L

lp.name L

HB

uf L

xp.name

6 �4��7GK� <>@?4�J45 F4���D �� �� ,:;8 /3 ��� GHI: GK� <;8

HB

uf L

xp.hiv;LB

uf Llp.nam

e L

xp.name

-K� <>@?GK� <8 ,3 ��� 9� : /3 �7 � GHI:;;

lp.name L

xp.hiv

� ���� ��%M !(

Page 19: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Annotated

TypesP

reve

ntD

irectD

ataF

low

s

�,���-.��� �� /� ��0 �1 ��2

: 6 �4��7 � -;�� 8

: 6 �4��7 � -;7 � 9� :;2 4��4�� ,<��� 8=

: � ���� -;�� 9� :: 6 �4��7 � -;�;

2 � ,<��� >@?�8=

=

�,���B.��� �� /� ��-.��� ��

2

: 6 �4��7 � G;���8�� 6 CDE CF

: 6 �4��7 � G;7 � GHI:;2 4��4�� ,<����8=

: � ���� -;�� GHI: : 6 �4��7 � G;�;2 � ,<����>@?�8==

No

directassignmentfrom

Hto

L

� ���� �� ��

Page 20: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(1)

Revisited

: -.��� ��� -;,3>@?4�J�,:;8

: 6 �4��7 � -;-K� <>@?,3 �7 � 9� :;8

: 6 �4��7 � G;GK� <>@?,3 �7 � 9� :;8

: B.��� ��� -; /3 >@?��B.��� ��:;8 /3 ��� 9� : -K� <>-;8

: 6 �4��7 � G;GK� <>@?4�F4������8 /3 ��� GHI: GK� <>G;8

� ���� �� ��

Page 21: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(1)

Revisited

: -.��� ��� -;,3>@?4�J�,:;8

: 6 �4��7 � -;-K� <>@?,3 �7 � 9� :;8

: 6 �4��7 � G;GK� <>@?,3 �7 � 9� :;8

: B.��� ��� -; /3 >@?��B.��� ��:;8 /3 ��� 9� : -K� <>-;8

: 6 �4��7 � G;GK� <>@?4�F4������8 /3 ��� GHI: GK� <>G;8

-K� <>: 6 �4��7 � -;>@?GK� <>: 6 �4��7 � G;

,3 ��� 9� : /3 �7 � GHI:;>: 6 �4��7 � G;;

� ���� ����� !"

Page 22: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(1)

Revisited

�,���-.��� ��- /� ��0 �1 ��2

: 6 �4��7 � -;�� 8

: 6 �4��7 � -;7 � 9� :;2 4��4�� ,<��� 8=

: � ���� -;�� 9� :: 6 �4��7 � -;�;

2 � ,<��� >@?�8=

=

�,���B.��� ��- /� ��-.��� ��

2

: 6 �4��7 � G;���8�� 6 CDE CF

: 6 �4��7 � G;7 � GHI:;2 4��4�� ,<����8=

: � ���� -;�� GHI: : 6 �4��7 � G;�;2 � ,<����>@?�8==

� ���� �� ��

Page 23: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(2)

�,���-.��� ��- /� ��0 �1 ��2

�� �� �7 � 9� � �� 9�

: 6 �4��7 � -;3 ���6 ,<:;2

���5 � : � ,<;����� ���-� 47 � ��==

�,���B.��� ��- /� ��-.��� ��

2 �� ����7 � GHI� �� GHI=

� ���� �� �$

Page 24: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(2)

�,���-.��� ��- /� ��0 �1 ��2

�� �� �7 � 9� � �� 9�

: 6 �4��7 � -;3 ���6 ,<:;2

���5 � : � ,<;����� ���-� 47 � ��==

�,���B.��� ��- /� ��-.��� ��

2 �� ����7 � GHI� �� GHI=

�,���G.��� ��G /� ��B.��� ��

2 �� ��� 4���3 ���6 ,<:;=

� ���� ����$ !"

Page 25: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(2)

�,���-.��� ��- /� ��0 �1 ��2

���: 6 �4��7 � -;3 ���6 ,<:;2 ���5 � : � ,<;���==

�,���B.��� ��- /� ��-.��� ��

2 ���=

�,���G.��� ��G /� ��B.��� ��

2 �� ��� 4���3 ���6 ,<:;=

Require:

H-subclass

ofL-classoverrides

allinheritedm

ethods.

Restr ictive:

Why

overridegetN

ame?

Use

anonymous

method(?)

“self”notleaked...

� ���� �� �&

Page 26: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(2)

�,���-.��� ��- /� ��0 �1 ��2

���: 6 �4��7 � -;3 ���6 ,<:;2 ���5 � : � ,<;���==

�,���B.��� ��- /� ��-.��� ��

2 ���=

�,���G.��� ��G /� ��B.��� ��

2 �� ��� 4���3 ���6 ,<:;=

Require:

H-subclass

ofL-classoverrides

allinheritedm

ethods.

Restrictive:

Why

overridegetN

ame?

: 6 �4��7 � -;7 � 9� :;2 4��4�� ,<��� 8=

Use

anonymous

method(?)

“self”notleaked...

� ���� ����& !"

Page 27: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:A

liasing(2)

�,���-.��� ��- /� ��0 �1 ��2

���: 6 �4��7 � -;3 ���6 ,<:;2 ���5 � : � ,<;���==

�,���B.��� ��- /� ��-.��� ��

2 ���=

�,���G.��� ��G /� ��B.��� ��

2 �� ��� 4���3 ���6 ,<:;=

Require:

H-subclass

ofL-classoverrides

allinheritedm

ethods.

Restrictive:

Why

overridegetN

ame?

: 6 �4��7 � -;7 � 9� :;2 4��4�� ,<��� 8=

Use

anonymous

method(?)

“self”notleaked...

� ���� �� �& !'

Page 28: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:C

ontrolF

low

(Conditional)

�,���B.��� ��- /� ��-.��� ��

2 �� ����7 � GHI� �� GHI=

6 �4��7

,� �6 �����:;2

�� 46 �4��7

�8 �� ,� ,5 <� NNN

�<: � ,<����;

2 �>@?OOPC

6RQQ8= ,�2 �>@?OO90 QQ

= 8

4��4��8

=

Ifguardis

H,only

H-variables

andH

-fieldsm

aybe

modified.

� ���� �� �)

Page 29: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:C

ontrolF

low

(Conditional)

�,���B.��� ��- /� ��-.��� ��

2 �� ����7 � GHI� �� GHI=

: 6 �4��7 � G;,� �6 �����:;2

�� 4: 6 �4��7 � G;�8 �� ,� ,5 <� NNN

�<: � ,<����;

2 �>@?OOPC

6RQQ8= ,�2 �>@?OO90 QQ

= 8

4��4��8

=

Ifguardis

H,only

H-variables

andH

-fieldsm

aybe

modified.

� ���� ����) !"

Page 30: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:C

ontrolF

low

(Dynam

icD

ispatch)

�,���B.��� ��- /� ��-.��� ��

2�� �������

�,���P9- /� ��0 �1 ��2 : �55 ,� -; �� ,:;2 4��4��4�8==

�,���P- /� ��P9

2 : �55 ,� -; �� ,:;2 4��4��4�8==

�,���9- /� ��P9

2 : �55 ,� -; �� ,:;2 4��4�<� ,�8==

� ���� �� �*

Page 31: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:C

ontrolF

low

(Dynam

icD

ispatch)

�,���B.��� ��- /� ��-.��� ��

2�� �������

: P9� G;,� �:;2

�� 4: P9� G;58

�<: � ,<����;

2 5>@?��P:;8= ,�2 5>@?��9:;8=

4��4�58==

�,���P9- /� ��0 �1 ��2 : �55 ,� -; �� ,:;2 4��4��4�8==

�,���P- /� ��P9

2 : �55 ,� -; �� ,:;2 4��4��4�8==

�,���9- /� ��P9

2 : �55 ,� -; �� ,:;2 4��4�<� ,�8==

� ���� ����* !"

Page 32: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:C

ontrolF

low

(Dynam

icD

ispatch)

�,���B.��� ��- /� ��-.��� ��

2�� �������

: P9� G;,� �:;2

�� 4: P9� G;58

�<: � ,<����;

2 5>@?��P:;8= ,�2 5>@?��9:;8=

4��4�58==

/3 �,� �:;>: P9� G;8

�,���P9- /� ��0 �1 ��2 : �55 ,� -; �� ,:;2 4��4��4�8==

�,���P- /� ��P9

2 : �55 ,� -; �� ,:;2 4��4��4�8==

�,���9- /� ��P9

2 : �55 ,� -; �� ,:;2 4��4�<� ,�8==

� ���� �� �* !'

Page 33: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:C

ontrolF

low

(Dynam

icD

ispatch)

�,���B.��� ��- /� ��-.��� ��

2�� �������

: P9� G;,� �:;2

�� 4: P9� G;58

�<: � ,<����;

2 5>@?��P:;8= ,�2 5>@?��9:;8=

4��4�58==

/3 �,� �:;>: P9� G;8/3 �,� �:;��� ,:;>: �55 ,� NNN;

�,���P9- /� ��0 �1 ��2 : �55 ,� -; �� ,:;2 4��4��4�8==

�,���P- /� ��P9

2 : �55 ,� -; �� ,:;2 4��4��4�8==

�,���9- /� ��P9

2 : �55 ,� -; �� ,:;2 4��4�<� ,�8==

� ���� ����* !(

Page 34: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:C

ontrolF

low

(Dynam

icD

ispatch)

�,���B.��� ��- /� ��-.��� ��

2�� �������

: P9� G;,� �:;2 ���=

=�/3 �,� �:;>: P9� G;

�/3 �,� �:;��� ,:;>: �55 ,� G;

IflevelofreceiverH

,levelofreturnedresultfrom

method

callH.

� ���� �� �+

Page 35: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:D

ynamic

Dispatc

h–

Leaksvia

Heap

�,���P9�- /� ��0 �1 ��2

�55 ,�8

�55 ,�� ,:;2 4��4�� ,<��8=

� ������: �55 ,�;2 � ,<��>@?�8=

� �����:;2 � ,<����: � 4�;8==

�,���P�- /� ��P9�

2 � �����:;2 � ,<����: � 4�;8==

�,���9�- /� ��P9�

2 � �����:;2 � ,<����: <� ,�;8==

� ���� �� �A

Page 36: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:D

ynamic

Dispatc

h–

Leaksvia

Heap

�,���P9�- /� ��0 �1 ��2

�55 ,�8 �� ,� ,5 <� NNN

�55 ,�� ,:;2 4��4�� ,<��8=

� ������: �55 ,�;2 � ,<��>@?�8=

� �����:;2 � ,<����: � 4�;8==

/>@?/3 �,� �:;8 �� />: P9�� G;

/���:;8

�,���P�- /� ��P9�

2 � �����:;2 � ,<����: � 4�;8==

�,���9�- /� ��P9�

2 � �����:;2 � ,<����: <� ,�;8==

� ���� ����A !"

Page 37: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:D

ynamic

Dispatc

h–

Leaksvia

Heap

�,���P9�- /� ��0 �1 ��2

�55 ,�8 �� ,� ,5 <� NNN

�55 ,�� ,:;2 4��4�� ,<��8=

� ������: �55 ,�;2 � ,<��>@?�8=

� �����:;2 � ,<����: � 4�;8==

/>@?/3 �,� �:;8 �� />: P9�� G;

/���:;8 ���/��� ,:;���

�,���P�- /� ��P9�

2 � �����:;2 � ,<����: � 4�;8==

�,���9�- /� ��P9�

2 � �����:;2 � ,<����: <� ,�;8==

� ���� �� �A !'

Page 38: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Exam

ple:D

ynamic

Dispatc

h–

Leaksvia

Heap

�,���P9�- /� ��0 �1 ��2

: �55 ,� G;�8

: �55 ,� G;�� ,:;2 4��4�� ,<��8=

: � ���� -;���:: �55 ,� G;�;2 � ,<��> ?�8=

: � ���� -;��:;2 � ,<����: � 4�;8==

/>@?/3 �,� �:;8 /���:;8���/��� ,:;>G���

IflevelofreceiverH

,onlyH

-fieldsm

aybe

modified

inm

eth.call

� ���� �� �M

Page 39: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Pointer

Confinem

ent�

L-objectmay

bealiased

byL-var,H

-var

L-classm

ayhave

H-subclass

Show

L-Confinem

ent:

1.L-vars,L-fields

donotcontain

H-pointers.

2.M

eaningofL-expression

neverH

-pointer.

Inconditionals/dyn.dispatch,assignm

entmay

beconfined

toH

-vars,H-fields.

Show

H-C

onfinement:

Inputstates,outputstatesindistinguishable

byL.

� ���� �� ��

Page 40: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Pointer

Confinem

ent�

L-objectmay

bealiased

byL-var,H

-var

L-classm

ayhave

H-subclass

Show

L-Confinem

ent:

1.L-vars,L-fields

donotcontain

H-pointers.

2.M

eaningofL-expression

neverH

-pointer.

Inconditionals/dyn.dispatch,assignm

entmay

beconfined

toH

-vars,H-fields.

Show

H-C

onfinement:

Inputstates,outputstatesindistinguishable

byL.

� ���� �� �� !"

Page 41: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Form

alisation

Types:

STTVUWXZY

[TTVU� ���X �55 ,X]\

^TTVU_ [` Sa

//securitytype

TypingJudgem

ents:

//security

typecontext

“assignto

vars,update

fields”

� ���� �� ��

Page 42: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Form

alisation

Types:

STTVUWXZY

[TTVU� ���X �55 ,X]\

^TTVU_ [` Sa

//securitytype

TypingJudgem

ents:

bcdT_ [` Sa

//b

securitytype

context

bce T_ �5 Sf` Sga

“assignto

vars,update

fields”

� ���� �� �� !"

Page 43: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Form

alisation

Types:

STTVUWXZY

[TTVU� ���X �55 ,X]\

^TTVU_ [` Sa

//securitytype

TypingJudgem

ents:

bcdT_ [` Sa

//b

securitytype

context

bce T_ �5 Sf` Sga

“assignto

varshSf ,update

fieldshSg ”

� ���� �� �� !'

Page 44: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Form

alisation

Meanings

ofTypingJudgem

ents:

iijk

lm noop qriijk

sm tu voop q

w

Method

Environm

entx

Stack

y

Heap

_x ` ya

State

x z{{ b}|~~

Related

States

areindistinguishable

byL.

,iffdom

,ifthen

;iffsam

eL-locations

andthose

haveequalL-fields.

� ���� �� ��

Page 45: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Form

alisation

Meanings

ofTypingJudgem

ents:

iijk

lm noop qriijk

sm tu voop q

w

Method

Environm

entx

Stack

y

Heap

_x ` ya

State

x z{{ b}|~~

Related

States_x ` ya L_x��

` y �a are

indistinguishableby

L.

x Lx��

,iff� �z

dom

b

,if_ [` Wa Ub�

thenx �U

x���;

y Ly �

iffsame

L-locationsand

thosehave

equalL-fields.

� ���� �� �� !"

Page 46: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Safe

Express

ions

Suppose:

�bcdT_ [` Wa

�_x ` ya L_x �` y �a

�w `x `x��` y` y �

areL-confined

������w

(i.e.,method

callinL-confined

,,yields

relatedheaps

and(ifnon-

)returns

equalresultsifreturn

typeofm

ethodis

L)

�{{ b}|cdT[~~wx y� U�� U{{ b}|cdT[~~wx��y �

Then:

{{ b |cdT[~~wx y U{{ b |cdT[~~wx �y �

� ���� �� �$

Page 47: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Safe

Express

ions

Suppose:

�bcdT_ [` Wa

�_x ` ya L_x �` y �a

�w `x `x��` y` y �

areL-confined

������w (i.e.,m

ethodcallin

L-confinedw `x `x��` y` y �

,

_x ` ya L_x �` y �a ,yields

relatedheaps

and(ifnon- �

)returns

equalresultsifreturn

typeofm

ethodis

L)

�{{ b}|cdT[~~wx y� U�� U{{ b}|cdT[~~wx��y �

Then:

{{ b |cdT[~~wx y U{{ b |cdT[~~wx �y �

� ���� �� �$ !"

Page 48: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Safe

Com

mands

Suppose:

�bce T_ �5 Sf` Sga

�w

isH

-confined

...same

asfor

expressions...

�{{ b}|ce T �5 ~~wx y� U�� U{{ b |ce T �5 ~~wx �y �

.

Then

outputstatesrelated:_x �

` y�a L_x���` y ��a w

here

_x �` y�a U{{ b |ce T �5 ~~wx y

_x���` y ��a U{{ b |ce T �5 ~~wx �y �

� ���� �� �&

Page 49: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Ongoing/F

utureW

ork�

Extension

tofullJavaC

ard

Extension

tofullJava

#

Threads

#

Generics

#

...

Termination-insensitivity

Inferenceofannotations

(Pottier

et.al.)

Declassification

(Halpern&

O’N

eill,Myers&

Zdancew

ic)� ���� �� �)

Page 50: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

L-confinement

(�

)�

Define���� U

�Z�z ���X level� UW� .

For

heaps,define��y

iffforall�

z

dom

y

andevery

�z

fields_������ � ��a ,ifstype_ �` ����� � ��a U_ [` Wa for

some

[

andy��z ���

theny��z ����

.

For

environments,define��

bxifffor

every�

with

b�U

_ [` Wa forsom

e[

,ifx �z ���

thenx �z ����

.

For

method

environments,define��

wiffthe

following

holds:for

every�` \`x ` y

,if��y

,��bx

,and

w \�x y� U�

then� �y�

and

S� UW��z ���

�z ����

,

� ���� �� �*

Page 51: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

where

smtype_ �` \

a U_ [` Sa �

 ¡¢_ [` S�a

pars_ �` \aU

_ �T_ [` Saa

b

U�T_ [` Sa` selfT_ \` level\a

_ �` y�a

Uw \�x y

� ���� �� �+

Page 52: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

TypeR

ules

\U£

self

[�z

dfields\

£ cdf T\

£ cdg T¤¤�[

£ cdfV¥�TVUdg T �5

mtype

� ���� �� �A

Page 53: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

TypeR

ules

\U£

self

[�z

dfields\

£ cdf T\

£ cdg T¤¤�[

£ cdfV¥�TVUdg T �5

mtype_ �`@¦a U[ ¢[

£ cdT ¦

£ cdT¤

¤�[

£ cd¥�_ da T �5

� ���� �� �A !"

Page 54: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Security

TypeR

ules�� U

self

[g�[fSg�SfS� �Sf

b` �T_ [f` Sfa cdT_ [g` Sga

b` �T_ [f` Sfa c�TVUdT_ �5 S�` S§a

sdfields

� ���� �� �M

Page 55: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

Security

TypeR

ules�� U

self

[g�[fSg�SfS� �Sf

b` �T_ [f` Sfa cdT_ [g` Sga

b` �T_ [f` Sfa c�TVUdT_ �5 S�` S§a

_ [` Sga �z

sdfields\

bcdf T_ \` Sfabcdg T_ ¤` S�a

¤�[Sf]¨S� ¨S©�Sg

bcdf ¥ �TVUdg T_ �5 S§` S©a

� ���� �� �M !"

Page 56: State Secure Bane a ointer v a-lik Inf Con or esoftware.imdea.org/~ab/Publications/pf_talk.pdf · Secure Inf or mation Flo w and P ointer Con finement in a J a v a-lik e Langu age

smtype_ �`@¦

a U_ [` Sa �

ª¡¢_ [` Sga

bcdT_ ¦` S§abcdT_ ¤` S©a

¤�[S©�SS§ ¨S«�S�

bcd¥�_ da T_ �5 S¬` S«a

� ���� �� $�


Recommended