Proof Carrying Code(PCC)

Transcription

1 Discussion p./6 Proof Carrying Code(PCC Languaged based security policy instead of OS-based A mechanism to determine with certainity that it is safe execute a program or not Generic architecture for providing and checking safety properties(generalization techquies adopted in javabyte verifiertypechecking(certified compiling No cryptography no additional runtime checks A PCC contains an encoding of a formal proof that obeys the safety policy code should passed through security policy

2 Discussion p.2/6 PCC Architecture CODE PRODUCER CODE CONSUMER Scource Code Compiler/ Certifying Compiler ANNOTATED NATIVE CODE EXECUTE Security policy for Code Producer Security Policy for Code Consumer HINTS Verification Condition PROVER Safety Proof Verification Condition CHECKER OK

3 . 2-

4 Security Policy Component LOGIC VC Generator SPECIFICATION logic able to describe the precondition under which a given agent is allowed specification all the functions that CC is obliged to provide and all the receiver function that agents is allowed to invoke VC Generator Construct VC from codepolicy according to his/her specification and annotated code Discussion p.3/6

5 Discussion p.4/6 Proof Carrying Code(PCC Code Producers takes code with annotated information and security policy and construct loop invariants(or is provided in code constructs VC from codepolicy and invariants constructs a proof that VCs hold Verifier takes code loop invariants and security policy and calculates VC checks that the given proof is a valid proof of VCs Fails if given proof is not valid

6 JavaByte Code verifier Type-based certifying compilers use static type information to help generate provably safe target code ML Java all have a strong type system illtyped operations at functions doesn t violate the access restrictions like private and protected fields Jumping to data as it ut were code it doesn t forge pointers illegal casting of objects Type cheking capture other properties like Secure Information flowtype safety(like JavaByte code verifier Discussion p.5/6

7 Discussion p.6/6 A logic for byte code Can be used to apply PCC concept to bytecode level to verify the correctness of bytecode program Handles OO features inheritance dynamic methods binding and unstructured control flow with jumps handles inheritance and virtual methods through subtyping Hoare style logic for a sequential java bytecode Instead of using Hoare logic like triples it uses each instruction I is preceded by an assertions that must hold at the point(including all jumps to I

8 Discussion p.7/6 A logic for byte code Object Store is introduced to model the dynamic heap The states of all objects and the information whether an object is allocated in the current program states is stored in an abstract data type Configuration K Environment maps values to Current Object Store maps variables this and p to stack is a list of values and program counter at a valid position always

9 A logic for byte code Transition relations v ( ] ; pushc v v ( ]; pop x ] ; goto # "! ] ; newobj T v ( T ( ' % Discussion p.8/6

10 * - '/ * * Method Invoking method specifications: P comp where P and Q are first order formula * + method implementation or a method body.- a virtual method pre- and pre conditions of method specifications must not refer to variables or stack elements preconditions may refer to the formal parameters this and p as well as current object post conditions may refer to and. sequents of the form 2 0 P comp Q where 0 is a set of method specifications Discussion p.9/6

11 * Discussion p.0/6 Instruction Specification Instruction with its preconditions is called an instructions specification Means if the precondition counter is at position s successor instruction termination of : : 5 4 holds when the program then the preconditions holds after normal connecting instruction and method specification method implementation.- satisfies its method specification if all instructions in the body of satisfies their instruction specification - of

12 Rules for Instruction Specification Precondition of precondition of instructions of has to imply the weakest w.r.t. all possible successor Call of a virtual method one has to prove satisfies its method specification precondtion of the 8 : 9 ' implies the precondition of the methods instruction specification with formal arguments substitued postcondition of the method specification implies the precondition of the instruction following / ; 8 9 ' with result substituted by the stack top Discussion p./6

13 8 - - Discussion p.2/6 Rules for Instruction Specification Call of a virtual method one has to prove satisfies its method specification precondtion of the invokefunction instruction implies the precondition of the methods specification with formal arguments substitued postcondition of the method specification implies the precondition of the instruction following / ; 8 9 ' with result substituted by the stack top

14 ; Discussion p.3/6 Relation Between subtyping Inherita subtyping relation is inheritance 8 < 8 - for the classes A type B inherits from another type A if some functions for B are written in terms of functions of A A tye B is a subtype of A if every function that can be invoked on an object of type A can also be invoked on an object B

15 Soundness of the logic soundnesson on the level of method specification We embed both the operational and axiomatic semantics into higher order logic ( by technique developed by Gordon in HOL we develop axiom and rules of the axiomatic semantics are dervied from those of operational semantics technique for soundness proofs provides a good basis for applying proof checkers mechanical checking can be easily done using the available tools like HOL PVSIsabelleetc Discussion p.4/6

16 Discussion p.5/6 Soundness of the logic soundnesson on the level of method specification HOL has the following advantage It is more expressive than first order logic specification are more natural functions and predicates are treated as first class objects several general HOL theorem provers are available HOLIsabellePVSVeritas IMPS Correctness specification can be specified in HOL

17 + C? C Semantics for Triples and Sequents in Considers the pre and post conditions as states : P(S S + > = - ' - A - F%G 8 H( +.- > = ED + - IJ H > A F%G 8 QWVH( RTS QU PQ 4NMO ALK O? + > = ED IJ H > A Discussion p.6/6