Language-Based Information-Flow Security

Richard MancusiCSCI 297

References

Andrei Sabelfeld, Andrew C. Myers. Language-Based Information-Flow Security.

IEEE Journal on Selected Areas inCommunication, special issue on FormalMethods for Security, 21(1), January 2003,pages 5-19

Information-Flow

“Access control checks place restrictions on the release of information but not its propagation.”

“Information controlled by a confidentiality policy cannot flow to a location where that policy is violated.”

“…practical methods for controlling information flow have eluded researchers for some time.”

Symptoms of the Problem

SAIC Break-in Stresses Intertwined Nature of Physical and IT Security“A break-in at a government contractor's offices has opened 45,000 former and current employees and stockholders up to identity theft.”

SecurityInfoWatch.com, Feb 22, 2005

U.P.S. Loses A Shipment Of Citigroup Client Data“…box of computer tapes containing information on 3.9 million customers was lost on May 2 by United Parcel Service…”

The New York Times, June 7, 2005

Security Breach Could Expose 40M To Fraud, “…the security breach involves a computer virus that captured customer data…”

The Washington Post, June 18, 2005

Standard Security Methods

Computer systems have relied upon weak ad-hoc security mechanisms– Access control (i.e., file protections, ACL’s)– Firewalls– Antivirus software

“Access does not control how the data is used after it is read from the file”

Terminology

Confinement“…the ability to prevent capabilities (and hence authority) from being transmitted improperly.”

NoninterferenceA clear separation of confidential data from public data.

Terminology

Covert ChannelsSignal mechanisms which are not intendedto transfer information about a computing system– Implicit flows– Termination channels– Power channels– Timing channels

Implicit Flows

Implicit flows result from the control structures of the program

Problematic for security levels

“Confidentiality can be obtained byby ensuring that the process sensitivitylabel remains high throughout the restof the program.”

H := H mod 2;L := 0;if ( H == 1 )

L := 1

Semantics-Based Security

For a given semantic model, noninterference is formalized as follows: C is secure iff

212121 . sCLsCsLsSss

Which reads: “If two input states share the same low values, then the behaviors of the program executed on these states are indistinguishable by the attacker.

In Other Words…

212121 . sCLsCsLsSss

Indicates the absence of any dependency between the program values which operate within a higher security context and the program values which have a lower security context.

Security-Type System

Mathematically, a language—typing rules–can be defined which encapsulates the security context of a program.

With a security-type system in place, static checks can be performed upon programs to identify any security issues.

For Example:

Research Trends

Expanding the expressiveness underlying the language.

Exploring security-related concurrency issues

Analyzing convert channels Refining security policies

Language-based Information Flow Research

Language Expressiveness

Policies which use language constructs such as procedures and functions can guaranteed to noninterference within the parameters of specific security type systems.

Polymorphic concepts can be extended to a type system. This means that generic constructs can be created which depend upon the security context. Proveable.

Language Expressiveness

Exceptions under normal circumstances can result in nonlocal transfer of control, creating implicit flows. Restrictive type systems are possible which limit the security concerns. [Volpano and Smith]

Systems have been created demonstrating Java objects can enforce noninterference.

Concurrency

The higher security portions of the program must be protected at all times.

(simple) Example:h := 0; l := h;

With concurrency, values must be protected atall times.

enter_critical(); h := 0; l := h; exit_critical()

Concurrency

Thread security is tied to timing issues and probability.

Example:(if h = 1 then C else skip); l := 1 || l := 0

Variations of security levels must be protectedduring context swaps (difficult)

Covert Channels

Timing attacks against SSL encryption

Encryption attacks are possible because the timing of failure with different values can lead an attacker to understand the true value of a key.

Prevent attacks by equalizing the time for successful and failed decryption.

Security Policies

Systems which allow downgrading of secure channels are subject to exploitation.

Example: Password-checking programs– The security is only as good as the algorithm

which guards the passwords. Concept of approximate noninterferance.

Challenges

System-wide security- The integration of language flow and system-wide

Information Flow control. Certifying Compilation

– Move security checking into Java arena, to perform static analysis on the byte code prior to execution.

Challenges

Dynamic Policies– Not realistic to assume information-flow policies

are available at compile time.– Runtime policies create an additional channel

which needs protection. Restrictions placed in languages to deal with

the problems may become too restrictive for extensive use.

Conclusions

End-to-end security is not capable with existing practices.

Static analysis of type systems are possible. Something needs to be done with Jif

compilers which support languages that are not “security-expressive” enough.

There is a lot of ongoing research to be concluded.