modular program monitors david walker princeton university (joint work with lujo bauer and jay...

Modular Program Monitors

David WalkerPrinceton University

(joint work with Lujo Bauer and Jay Ligatti)

Modular Run-time Program Monitors David Walker

Program Monitors

• A program monitor is a coroutine that runs in parallel with an untrusted application– monitors process security-relevant actions

• decide to allow/disallow application actions• may terminate or suspend application execution

– monitors detect, prevent, and recover from erroneous or malicious applications at run time


Simple Monitor Structure

• Monitors have 3 components– set of security-relevant application

actions– security state– computation

a

Access Control Monitor

fopenfclose

actions

acl

state computation

acl lookup


Polymer Project

• Polymer– An extension of Java designed to

simplify construction of run-time program monitors

• Design methodology– A formula for producing well-

structured, easy-to-understand, easy-to-modify monitors


Policy Architecture: The Problem

Java corePolymer language extensions

HostSystem(Java)

Program Monitor Definition

Untrusted application


Policy Architecture: Simple Policies


HostSystem(Java)

SimplePolicyDef.

systeminterface


class limitFiles extends Policy { private int openFiles = 0; private int maxOpen = 0; limitFiles(int max) { maxOpen = max; }

....

}

A Simple Polymer Policy

private policy state,protected from malicious applications

policy constructor


class limitFiles extends Policy { private int openFiles = ... private int maxOpen = ...

private ActionSet actions = new ActionSet( new String[] {“fileOpen(String)”, “fileClose()”} ); ....

}

A Simple Polymer Policy Continued

set of policy-relevant methods


class limitFiles extends Policy { private ActionSet actions = ... private int openFiles = ... private int maxOpen = ... Suggestion step(Action a) { aswitch (a) { case fileOpen(String s) : if (++openFiles <= maxOpen) return Suggestion.OK(); else return Suggestion.Halt(); case fileClose() : ...


policybehaviour


class limitFiles extends Policy { private ActionSet actions = ... private int openFiles = ... private int maxOpen = ... Suggestion step(Action a) { aswitch (a) { case fileOpen(String s) : if (++openFiles <= maxOpen) return Suggestion.OK(); else return Suggestion.Halt(); case fileClose() : ...



Realistic Monitors

• Protect complex system interfaces– interfaces replicate functionality in many

different places– method parameters communicate

information in different forms– eg: Java file system interface

• 9 different methods to open files• 4 different methods to close files• filename strings, file objects, self used to

identify files


Policy Architecture: Abstract Actions


HostSystem(Java)

AbstractActionDef.

concrete systeminterface

abstract systeminterface

SimplePolicyDef.


Abstract Action Definitions

java.lang.io

FileReader(String fileName);FileReader(File file);RandomAccessFile(...);...

FileReader.close();RandomAccessFile.close();...

fileOpen(String n);

fileClose();


Realistic Monitors

• Combine simple policies defined over a variety of different resources– eg: sample applet policy

• file system access control• bounds on bytes written and number of

files opened• restricted network access

– no access after file system read– communication with applet source only


Policy Architecture:Complex Policies


HostSystem(Java)

AbstractActionDef.

SimplePolicyDef.

PolicyComb.Def.

Complex, System-specific Policy

concrete systeminterface

abstract systeminterface


Policy Combinators

• Conjunction, Disjunction, Chinese wall,...

s1 s2

Conjunctive Policy

P1 P2

s


Related Work

• Aspect-oriented programming– New polymer features:

• first-class suggestions, abstract actions, action patterns, policy combinators, policy architecture, formal semantics

• Monitoring languages• Poet and Pslang, Naccio, Ariel, Spin Kernel

• Logical monitoring specifications• MAC (temporal logic), Bigwig (second-order

monadic logic)


Summary: Polymer

• First steps towards the design of a modern language for programming modular run-time security monitors

• For future software releases & papers see– www.cs.princeton.edu/sip/projects/

polymer/


End

modular program monitors david walker princeton university (joint work with lujo bauer and jay...

Documents

monitors slide

private int maxopen

private int openfiles

private actionset actions

policy relevant methods

system interface slide

application execution

jay ligatti slide