Information Flow Security in Tree-Manipulating Processes

Transcription

1 TECHNISCHE UNIVERSITÄT MÜNCHEN Lehrstuhl für Informatk II Informaton Flow Securty n Tree-Manpulatng Processes Máté Amadé Kovács Vollständger Abdruck der von der Fakultät für Informatk der Technschen Unverstät München zur Erlangung des akademschen Grades enes genehmgten Dssertaton. Doktors der Naturwssenschaften (Dr. rer. nat.) Vorstzende: Unv.-Prof. Dr. Clauda Eckert Prüfer der Dssertaton: 1. Unv.-Prof. Dr. Helmut Sedl 2. Unv.-Prof. Dr. Markus Müller-Olm Westfälsche Wlhelms-Unverstät Münster De Dssertaton wurde am be der Technschen Unverstät München engerecht und durch de Fakultät für Informatk am angenommen.

2

3 Abstract Ths work descrbes methods to verfy nformaton flow propertes of processes manpulatng tree-structured data. The developed technques can be appled, e.g., to enterprse workflows and web servce technologes, where data s frequently represented n the form of XML documents. These systems are hghly securty crtcal, because they may be n control of mportant processes of organzatons, whle communcatng wth external partners over the network. The frst soluton s a runtme montor. It apples generalzed constant propagaton to overapproxmate the results of secret-dependent branchng constructs n order to prove ther equalty. The second method s a statc analyss that verfes nformaton flow propertes at complaton tme. It reles on relatonal abstract nterpretaton appled to a statcally determned algnment of two copes of the program and regular overapproxmatons of sets of pars of program states. Both methods allow to enforce end-to-end nformaton flow polces only, whch are composed n terms of the ntal and fnal states of computatons. In the thrd part of the thess tree-manpulatng reactve systems are consdered, where nformaton flow polces may change over tme. The postve fragment of the Lnear Temporal Logc s extended wth a modal operator, the so-called hde operator, n order to express that the observable behavor of the system s ndependent of specfc nput values untl a certan pont n tme. A model checkng algorthm s provded to verfy temporal nformaton flow propertes, whch combnes methods of abstract nterpretaton wth model checkng. In order to foster semantc clarty, the algorthms and technques are presented for a small assembly language for tree-manpulaton.

4 Zusammenfassung Dese Arbet beschrebt Methoden, de Informatonsfluss-Egenschaften von Programmen scherstellen können, deren Schwerpunkt de Verarbetung von baumstrukturerten Daten st. De entwckelten Technken können z.b. be Enterprse- Workflow-Systemen und Web-Servce-Technologen engesetzt werden, be denen Daten oft durch XML Dokumente repräsentert werden. Dese Systeme snd scherhetskrtsch, wel se wchtge Prozessabläufe ener Organsaton kontrolleren können, während se mt externen Partnern über das Netzwerk kommunzeren. De erste Methode nutzt enen Laufzet-Montor. En verallgemenerter Konstantenfaltungs-Algorthmus wrd verwendet, um das Ergebns von Verzwegungen, de von gehemzuhaltenden Informatonen abhängen, zu überapproxmeren, damt deren Äquvalenz bewesen werden kann. De zwete Methode verfzert Informatonsfluss-Egenschaften zur Übersetzungszet. Se basert auf relatonaler abstrakter Interpretaton, angewandt auf de statsche Abglechung zweer Kopen des Programms, und regulärer Überapproxmaton von Mengen von Paaren von Programmzuständen. Bede Methoden können ledglch sogenannte end-to-end Informatonsfluss-Egenschaften scherstellen, de n Bezug auf de ersten und letzten Zustände der Ausführung defnert snd. Im drtten Tel deser Dssertaton werden Baummanpulerende reaktve Systeme betrachtet, deren Scherhetsegenschaften sch zur Laufzet ändern können. Scherhetsegenschaften werden n ener Erweterung des postven Tels der lnearen temporalen Logk erfasst, de es ermöglcht, mthlfe des hde Operators de Unabhänggket des beobachtbaren Verhaltens des Systems von bestmmten Werten bs zu enem bestmmten Zetpunkt zu spezfzeren. Im Rahmen deser Arbet wurde en Model-Checkng-Algorthmus für de Analyse derartger Egenschaften entwckelt, der Methoden aus der abstrakten Interpretaton mt Model-Checkng kombnert. Um de semantsche Klarhet zu fördern, werden de Algorthmen und Methoden mthlfe ener klenen Assemblersprache für Baummanpulatonen dargestellt.

5 Contents 1 Introducton 1 2 Runtme Montor Prelmnares Bnary Trees Assembly Language for Tree Manpulaton Informaton Flow Polces The Runtme Montor through an Example Formal Treatment of the Montor Guarantees Related Work Relatonal Abstract Interpretaton Merge over all Twn Computatons Self-Compostons of Control Flow Graphs Provng Nonnterference Case Study Practcal Experments Combnng the Results of Multple Analyses Related Work Model Checkng Transton Systems Temporal Informaton Flow Polces Model Checkng Systems wth Fnte State Space Model Checkng Systems wth Infnte State Space Constructng the Abstract Transton System Constructng an Abstract State Machne Havng Fnte State Space Computng the Result Implementaton Transformng Formulae nto Büch Automata The Verfcaton Procedure Case Studes Related Work Concluson 79

6 v CONTENTS 6 Proofs Proofs for Chapter Proofs for Chapter Proofs for Chapter

7 Chapter 1 Introducton Today companes and organzatons frequently use computer systems to store data and to execute busness logc. These workflow systems bear the rsk of revealng crtcal nformaton through software bugs, attacks, or smple msconfguraton. Snce these systems are frequently used by several prncpals possbly havng conflctng nterests, the conscous desgn and enforcement of nformaton flow polces s of paramount mportance. Conference Management System Revewers Program Commttee Char Authors Fgure 1.1: An magnary conference management system and ts cooperatng partners. As an example, Fgure 1.1 llustrates the users of an magnary conference management system lke EasyChar. The users cooperate n order to successfully execute the workflow of submttng, revewng and decdng about the acceptance of papers. The conference management system tself mantans a document base descrbng the state of the submsson and revew process. The document base stores among others the uploaded documents, the comments and scores gven by the revewers, and a value descrbng whether the submssons have been accepted. Some examples for conflctng nterests n the context of 1

8 2 CHAPTER 1. INTRODUCTION conference management systems may be the followng: Authors mght be nterested n knowng the dentty of ther revewers. Authors mght wsh to know about ther compettors prevous to the dsclosure of accepted papers. There have already been securty breaches n conference management systems. For nstance HotCRP 40 verson 2.47 had a bug whch exposed comments of revewers to the authors, whch were exclusvely meant for the program commttee. There are well establshed programmng languages and technologes for the mplementaton of process management systems that are responsble for the coordnaton of workflows of organzatons. The famly of standards for web servces (e.g., 37, 20) enables the platform ndependent communcaton of computer programs on a network usng messages n XML 16 format. Based on ths technology, hgh level workflows can be composed from the functonaltes of ndvdual web servces usng the Web Servces Busness Process Executon Language (BPEL) 6. Accordngly, BPEL s desgned to mplement the autonomous busness logc of companes and organzatons that can also communcate wth external, ndependent enttes. Therefore, the nformaton flow securty of these processes may be crucal for organzatons to fulfll ther mssons. Another central aspect of BPEL workflows s that the values of varables are document trees. Even though the goal of BPEL programs s not to carry out complex computatons, stll the language s Turng complete. Data manpulaton can be carred out usng the XML Path Language 14 (XPath), and XSL Transformatons 46 (XSLT). As motvated above, the goal of ths work s to gve methods for the verfcaton and enforcement of nformaton flow propertes of programs manpulatng tree-structured data. We wll llustrate the developed solutons usng examples that mplement fragments of the magnary conference management system sketched n Fgure 1.1. We suppose that the workflow of organzng a conference conssts of a seres of phases. In one phase authors are allowed to upload papers, an other phase s e.g., when the submsson deadlne s passed, and papers are revewed. 1 <f name="if1"> 2 <condton> 3 <!CDATA$phase = "notfy"> 4 </condton> 5 <assgn> <copy> <from>$subdb </from> 6 <to> $toauthors </to> </copy> 7 </assgn> 8 <else> 9 <sequence> 10 <f name="if2"> 11 <condton> <!CDATA$averageScore < 1.5> 12 </condton> 13 <assgn name="evalreject"> 14 <copy> <from>"rejected"</from> 15 <to> $subdb/submssond=$paperid 16 /acceptance/text() 17 </to> </copy>

9 3 18 </assgn> 19 <else> 20 <assgn name="evalaccept"> 21 <copy> <from>"accepted"</from> 22 <to> $subdb/submssond=$paperid 23 /acceptance/text() 24 </to> </copy> 25 </assgn> 26 </else> 27 </f> 28 <assgn> <copy> <from>$subdb </from> 29 <to> $subdb_output </to> </copy> 30 </assgn> 31 </sequence> 32 </else> 33 </f> Lstng 1.1: A BPEL-lke pseudo-code fragment of an magnary conference management system. root submsson submsson d acceptance d acceptance 123 accepted 42 pendng Fgure 1.2: An example database mappng the dentfers of submssons to ther acceptance values. The dotted rngs mark the elements that can be addressed by the XPath expressons at lnes 15 and 22 n Lstng 1.1 dependng on the value of the varable paperid. Lstng 1.1 shows a possble fragment of a document submsson system lke EasyChar mplemented n a BPEL-lke language. A tree-shaped data structure stored n varable subdb s manpulated, whch contans the dentfers and acceptance states of the uploaded papers. The code covers two phases of the revew process. In the phase revew the average scores of papers are processed by the workflow engne. In ths phase, the code s executed each tme a revew s submtted. Based on the value of varable averagescore contanng the average of the scores already submtted for a paper, the program updates the acceptance status of the paper dentfed by the value of varable paperid. In the phase notfy the database s sent to the authors by assgnng t to the varable toauthors. A possble data structure representng a database s llustrated n Fgure 1.2. A smple nformaton flow polcy for the document submsson system could be the followng: The scores of the papers may not be revealed to the authors before the notfcaton phase. (1.1)

10 4 CHAPTER 1. INTRODUCTION The propertes ths work ams to analyze belong to the class of propertes called hyperpropertes 21. A hyperproperty s a statement about multple runs of a system. Semantcally, the requrement n (1.1) refers to at least two executons, the ntal state of whch may dffer n the value of the varable averagescore and the acceptance status of documents n the database. It poses the requrement that authors should not be able to observe any dfference n the outputs of any two executons untl a specfc pont n tme. The polcy n (1.1) llustrates the nature of problems ths work seeks to tackle. The goal of ths work s, therefore, to gve methods to verfy and enforce nformaton flow securty polces on programs manpulatng tree-structured data, as motvated by the BPEL language. The correspondng techncal challenges are the followng: 1. Formalsms are needed that can express nformaton flow polces specfyng the secrecy of subtrees of document trees. Furthermore, algorthms have to be found that can ether enforce the polces durng runtme, or prove them n complaton tme. 2. Enterprse workflows may run for an unbounded perod of tme, whle nformaton flow polces may change n response to events trggered by the envronment. Therefore, formalsms are needed that can express the temporal nature of nformaton flow polces, and algorthms are needed for ther verfcaton or runtme enforcement. Ths work presents the followng contrbutons: In Chapter 2 a runtme montor s ntroduced that enforces nformaton flow polces on tree-manpulatng programs. The runtme montor addresses challenge 1, the focus s on the propertes of programs manpulatng tree-structured documents. The presented soluton s based on the results publshed n 48. In Chapter 3 a statc analyss s developed based on relatonal abstract nterpretaton. The goal of ths analyss s to prove nformaton flow propertes of programs at complaton tme. Agan, Chapter 3 addresses challenge 1. The presented results are based on 49. In Chapter 4 a model checkng algorthm s descrbed that tackles challenge 2. Polces are composed usng the logc Restrcted SecLTL. Restrcted SecLTL extends the postve fragment of the Lnear Temporal Logc wth an addtonal modal operator, the so-called hde operator. The hde operator expresses that the observable behavor of the system s ndependent of specfc peces of secret untl an event occurs. The presented algorthm extends the model checkng procedure of 28 to systems wth unbounded state space. Much effort has been nvested n fndng adequate formalsms that descrbe the functonalty of servce orchestratons and choreography, n partcular, the BPEL 6 language. The majorty of the publcatons n ths topc can be sorted nto two groups. One 42, 74, 73, 61 apples formalsms based on Petr-nets 55 to model workflows, the other 39, 50, 63, 81, 18 prefers algebrac calcul lke the Π-calculus 52 as the bass for nvestgatons. The authors of 3 and 82

11 present securty-related results usng Petr-net based formalsms. A common property of these approaches s that they mostly focus on the control flow of orchestratons, sometmes wth emphass on error handlng, whereas data values undergo severe abstractons: They are ether consdered as atomc values, or completely dsregarded by handlng branchng decsons as nondetermnsm. The goal of ths work s to provde securty guarantees by takng advantage of the propertes of data values. Therefore, we ntroduce an assembly language for tree manpulaton that formalzes busness workflows, and apply program analyss and model checkng technques n order to tackle the challenges lsted above. 5

12 6 CHAPTER 1. INTRODUCTION

13 Chapter 2 Runtme Montor In ths chapter we present a runtme montor to enforce end-to-end nformaton flow polces on programs manpulatng tree-structured data. The authors of 66 note that runtme approaches 38, 77, 64 are on the rse, because they can be more permssve than statc solutons, whle provdng the same guarantees. In our case ths statement especally holds, because our montor takes advantage of the fact that durng runtme data nstances are avalable. In prncple, our montor executes programs n parallel to the operatonal semantcs of the language, whle mantanng a state whch only depends on publc data. In other words, the montor carres out a parallel computaton on the publc vew. The computaton of the publc vew s challengng n the case, when the result of a branchng construct, whose condton depends on the secret, s about to be evaluated. In ths case we apply a dataflow analyss procedure, whch s a generalzaton of constant propagaton (see e.g. 68) for handlng sem-structured data. The key dfference s the herarchc nature of lattce elements, whch algns to our purpose of preventng nformaton leakage n tree-manpulatng programs. Moreover, we gan precson by only consderng a modfcaton of a subtree nsde a secret-dependent branch as potentally secret, f t does not occur n the other alternatve as well, and thus must be excluded from the publc vew. In summary, ths chapter provdes the followng nnovatons: A runtme montor s ntroduced to support the specfcaton of nformaton flow polces n terms of tree-lke data and ther enforcement. The enforcement mechansm apples a generalzed varant of constant propagaton n order to compute the publc vew of the state at the end of branchng nstructons. Ths chapter s organzed as follows. In Secton 2.1 we ntroduce the programmng language, and dscuss how nformaton flow polces are composed. In Secton 2.2 we llustrate the ntuton behnd our soluton through an example, a fragment of a hypothetcal paper submsson system. We formalze the approach n Secton 2.3, and n Secton 2.4 we dscuss the guarantees the montor provdes us. Fnally, n Secton 2.5 we relate our work to others. 7

14 8 CHAPTER 2. RUNTIME MONITOR 2.1 Prelmnares Ths secton presents the necessary formalsms, languages and notatons that are the bass of ths work Bnary Trees In order to foster semantc clarty and smplcty, the technques of ths work are elaborated usng a small but powerful assembly language for tree manpulaton. The language s constructed to work wth bnary trees only. Ths s no restrcton n general, snce bnary trees are n one-to-one correspondence wth unranked trees. Unranked trees n turn can be consdered as the natural nternal representaton of XML documents. root submsson d 123 acceptance accepted # # submsson d # 42 acceptance pendng # Fgure 2.1: The bnary representaton of the database n Fgure 1.2. Defnton 1 (Bnary Trees). The set of bnary trees B Σ2,Σ 0 over the fnte set of bnary alphabet elements Σ 2 and the set of nullary alphabet elements Σ 0 s defned by the language: τ ::= σ 0 σ 2 (τ 1, τ 2 ) where σ 0 Σ 0, σ 2 Σ 2 and τ 1, τ 2 B Σ2,Σ 0. The set of nullary alphabet elements Σ 0 does not necessarly need to be fnte. Fgure 2.1 llustrates the bnary representaton of the data structure of Fgure 1.2 constructed usng the frst-chld/next-sblng (FCNS) encodng 22. The bnary tree σ 2 (τ 1, τ 2 ) s nterpreted as an unranked forest, where the root of the leftmost tree s labeled σ 2. Its content s the unranked varant of τ 1, whle the forest on ts rght hand sde s the unranked varant of τ 2. The nullary node labeled # Σ 0 represents the empty forest. Nullary nodes can also be labeled wth basc values lke 42, whch are always between sgns n order to emphasze that they belong to Σ 0. The FCNS encodng maps nullary nodes representng basc values to themselves Assembly Language for Tree Manpulaton The grammar of the assembly language for tree manpulaton s shown n Fgure 2.2. The value of a tree expresson generated by the nontermnal e s ether the content of a varable x, the nullary node #, or a bnary tree composed of a new root labeled σ 2 havng the contents of varables x 1 and x 2 as subtrees. The

15 2.1. PRELIMINARIES 9 (tree expressons) e ::= x # σ 2 (x 1,x 2 ) x/1 x/2 λ t (x 1, x 2,...) (Boolean expressons) b ::= top(x)=σ λ b (x 1, x 2,...) (commands) c ::= skp x:=e f b then {p 1 } else {p 2 } whle b do {p} (program) p ::= ε c;p Fgure 2.2: The grammar of the assembly language for tree manpulaton, where σ 2 Σ 2 and σ Σ 2 {#}. expressons x/1 and x/2 refer to the frst and second subtrees of the tree stored n varable x. In case the chldren of leaves are addressed by x/1 or x/2 an error occurs. It s also possble to carry out an arbtrary computaton based on the values of an arbtrary set of varables usng nterpreted functons λ t (x 1,x 2,...). The only constrant aganst these nterpreted functons s that they must return a nullary node. Boolean expressons generated by the nontermnal b may test the label of the root of the tree stored n a varable, and carry out an arbtrary computaton usng the nterpreted functon λ b (x 1,x 2,...) returnng a Boolean value. Interpreted functons λ t (x 1,x 2,...) and λ b (x 1,x 2,...) are determnstc, they do not have sde effects, and the executon of λ t can also result n the error state. In our examples we wll use nfx operators lke less or equal to =< or equvalence = as nstances for nterpreted functon symbols wth the ntutve semantcs. top(x)=σ s = s f σ Σ 2 {#} and s(x) has root labeled wth σ top(x)=σ s = s f σ Σ 2 {#} and s(x) has root labeled wth some σ σ λ b (x 1,x 2,...) s = s f λ b (s(x 1 ), s(x 2 ),...) holds x:=y s = sx s(y) x:=# s = sx # skp s = s x:=σ 2 (x 1,x 2 ) s = sx σ 2 (s(x 1 ), s(x 2 )) where σ 2 Σ 2 sx τ 1 f s(y) = σ 2 (τ 1,τ 2 ) for some x:=y/1 s = label σ 2, and trees τ 1 and τ 2 otherwse sx τ 2 f s(y) = σ 2 (τ 1,τ 2 ) for some x:=y/2 s = label σ 2, and trees τ 1 and τ 2 otherwse x:=λ t (x 1,x 2,...) s = sx λ t (s(x 1 ), s(x 2 ),...) or f = for assgnments and expressons f Fgure 2.3: State transformers of assgnments and Boolean expressons. States of the form sx τ stand for states, where we have sx τ(y) = s(y) for all y x, and sx τ(x) = τ. A structured program generated by the nontermnal p s a possbly empty

16 10 CHAPTER 2. RUNTIME MONITOR sequence of commands. A command can be ether the empty command skp, an assgnment x:=e, whch updates the value of the varable x wth the value of the tree expresson e, a condtonal executon of alternatve programs f, or an teraton whle. In ths chapter the semantcs of the language s defned by the transton relaton cfg ρ cfg between confguratons of the form p, s, where p s the program to be executed on the state s. In case of fnal confguratons, where p = ε we smply wrte s nstead of ε, s. The state s : (X B Σ2,Σ 0 ) { } s a mappng from the set of varables X of the program to bnary trees B Σ2,Σ 0, or the error state, denoted by, symbolzng that a runtme error has occurred durng the executon. The functonalty of basc state transformers correspondng to assgnments and Boolean expressons s defned n Fgure 2.3. Note that even though the negaton operator ( ) s not avalable for programmers accordng to the grammar, t occurs n the semantcs. The transformers n Fgure 2.3 are also gong to be used n later sectons, where the semantcs of the programmng language s defned usng control flow graphs. There, the applcaton of the negaton operator s necessary. On the other hand, the absence of the negaton operator does not decrease the expressveness of the programmng language and smplfes the notaton. E: s = c, s ρ A: s x:=e, s ρ x:=e s S: c, s ρ s c;p, s ρ p, s WT: s b s = s p, s ρ s whle b do {p}, s ρ whle b do {p}, s IT: IF: WF: s b s = s whle b do {p}, s ρ s s b s = s p tt, s ρ s f b then {p tt } else {p ff }, s ρ s s b s = s p ff, s ρ s f b then {p tt } else {p ff }, s ρ s Fgure 2.4: The semantcs of the programmng language. The semantcs of the programmng language s shown n Fgure 2.4. In the condton parts of the rules we use the relaton ρ, whch denotes the reflexve and transtve closure of ρ. A central rule of the semantcs s S, whch s responsble for executng a program, n other words a sequence of commands. The remanng rules defne the effects of ndvdual commands. Due to rule E, the error state s not modfed by any command. Instead, t s passed over to the next command n the sequence, or to the fnal confguraton. In case the state s not erroneous, the executon of an assgnment s specfed by rule A. The rules WT and WF execute teratons, IT and IF execute condtonal selectons of alternatve programs as t s usual n other structured programmng languages. Because here we are concerned wth end-to-end nformaton flow polces, we assume that nput values of computatons are gven n the ntal confguraton,

17 2.1. PRELIMINARIES 11 and the result s presented n the fnal confguraton. We assume furthermore, that each varable carres a value n the ntal state, therefore, no error can be trggered by a varable access. 1 // 1. Selectng the phase: 2 f top(phase)=notfy then { 3 toauthors := subdb; 4 } 5 else { 6 7 // 2. Intalzaton: 8 empty := #; 9 submssonsrev := #; 10 submssons := subdb/1; // 3. Branchng based on condtonal value: 13 f averagescore < 1.5 then { // 4/tt. Searchng the elements to be modfed: 16 found := false(empty,empty); 17 whle top(found)=false do { 18 d := submssons/1; 19 dval := d/1; 20 f dval = paperid then { 21 found := true(empty,empty); 22 } else { 23 submssonsrev := submsson(d,submssonsrev); 24 submssons := submssons/2; 25 }; 26 }; // 5/tt. Modfyng the acceptance value dependng on 29 // averagescore: 30 acceptanceval := rejected ; // 6/tt. Reconstructng the data structure of the submsson: 33 acceptance := acceptance(acceptanceval,empty); 34 d := d(dval,acceptance); 35 submssons := submssons/2; 36 submssons := submsson(d,submssons); // 7/tt. Reconstructng the data structure of the database: 39 stop := false(empty,empty); 40 whle top(stop)=false do { 41 f top(submssonsrev)=submsson then { 42 d := submssonsrev/1; 43 submssons := submsson(d,submssons); 44 submssonsrev := submssons/2; 45 } else { 46 stop := true(empty,empty); 47 }; 48 }; } else {

18 12 CHAPTER 2. RUNTIME MONITOR // 4/ff. Searchng the elements to be modfed: 53 found := false(empty,empty); 54 whle top(found)=false do { 55 d := submssons/1; 56 dval := d/1; 57 f dval = paperid then { 58 found := true(empty,empty); 59 } else { 60 submssonsrev := submsson(d,submssonsrev); 61 submssons := submssons/2; 62 }; 63 }; // 5/ff. Modfyng the acceptance value dependng on 66 // averagescore: 67 acceptanceval := accepted ; // 6/ff. Reconstructng the data structure of the submsson: 70 acceptance := acceptance(acceptanceval,empty); 71 d := d(dval,acceptance); 72 submssons := submssons/2; 73 submssons := submsson(d,submssons); // 7/ff. Reconstructng the data structure of the database: 76 stop := false(empty,empty); 77 whle top(stop)=false do { 78 f top(submssonsrev)=submsson then { 79 d := submssonsrev/1; 80 submssons := submsson(d,submssons); 81 submssonsrev := submssons/2; 82 } else { 83 stop := true(empty,empty); 84 }; 85 }; 86 }; // 8. Presentng the result. 89 subdb := root(submssons,empty); 90 subdb_output := subdb; 91 }; Lstng 2.1: The mplementaton of the functonalty of the pseudo code of Lstng 1.1 n the assembly language for tree manpulaton. Lstng 2.1 shows the mplementaton of the functonalty of the pseudo code of Lstng 1.1 n the assembly language for tree manpulaton. The program assumes that the bnary representaton of a database lke that n Fgure 2.1 s gven n the varable subdb, and the modfed database at the end of the computaton s stored n varable subdb Output. The dentfer of the paper, the acceptance value of whch s to be updated s stored n varable paperid, the average of the scores already submtted for the paper s stored n varable averagescore. Each tme the program s executed, frst the actual phase of the revew process s determned based on the value of phase. In case we are n the revew phase,

19 2.1. PRELIMINARIES 13 the program modfes the database based on the average score correspondng to the specfed paper. In the phase notfy, the program assgns the database to the varable toauthors, whch s vsble by the authors. The code tself s dvded nto 12 separate sectons. In the frst secton the actual phase s determned. The second secton ntalzes some varables that wll be necessary later on durng the computaton. In partcular, the varable submssons s ntalzed wth the frst chld of the tree stored n varable subdb. The thrd secton s a branchng decson based on the value of averagescore. The correspondng Boolean expresson averagescore < 1.5 at lne 13 s an example of an nterpreted Boolean functon λ b. The functonaltes of the branches are very smlar, because they mplement a tree manpulaton specfed by dentcal XPath expressons at lnes 15 and 22 n Lstng 1.1. We tred to emphasze the correspondence of some fragments of code n the two branches. Therefore, for example, the secton responsble for queryng the submsson dentfed by paperid s numbered 4/tt n the postve branch and 4/ff n the negatve branch. Accordngly, the fourth secton s the query n both of the branches, whch selects the submsson wth dentfer as t s stored n varable paperid. In each teraton of the loops at lnes 17 and 54, the head of the lst of submssons s examned, whether t corresponds to the document wth the rght dentfer. If not, then the head s appended to the lst submssonsrev. Accordngly, submssonsrev contans a prefx of the ntal value of submssons n reverse order. The examnaton of dentfers s carred out by the branchng constructs at lnes 20 and 57, where the Boolean expresson s dval = paperid. Ths expresson s an other example of an nterpreted Boolean expresson λ b. The ffth secton assgns a value to the varable acceptanceval dependng on the average of scores gven. Next, the data structure for the actual paper s reassembled n both of the branches and appended to submssons. The seventh secton reconstructs the orgnal order of papers n the database submssons usng submssonsrev. By ths last teraton the database s reconstructed so that only the acceptance value of the approprate submsson s modfed. Note that the lst of trees as t s stored n varable submssons at the end of secton 7 corresponds to a bnary forest. The second chld of the root of the bnary representaton of an unranked tree s always #. Therefore, by the frst lne of secton 8 the bnary representaton of the unranked database s restored, and the second lne assgns t to the output varable Informaton Flow Polces In the semnal paper 26 Dennng made the observaton, that nformaton flow polces must be necessarly composable n terms of lattces. Our nformaton flow polces consderng trees adhere to ths observaton. The smplest nformaton flow lattce s low hgh specfyng that peces of nformaton classfed hgh must not be observed by prncpals classfed low. In ths work we group the peces of nformaton and the prncpals partcpatng n the actvtes of workflows nto these two groups as well. In ths work we consder programs manpulatng tree-shaped data, therefore, nformaton flow polces classfy nodes n trees. Our technques can enforce nformaton flow polces, where the secrecy level of nodes does not decrease on the paths from the root to the leaves. A polcy s defned n terms of publc vews correspondng to the elements of the nformaton flow lattce. The publc vew

20 14 CHAPTER 2. RUNTIME MONITOR correspondng to a lattce element ξ can be obtaned by replacng the greatest subtrees, the roots of whch have secrecy level hgher than ξ wth a leaf labeled. In our case, where the nformaton flow lattce conssts of two elements, the nformaton flow polcy s defned by a sngle publc vew correspondng to the element low. The vew correspondng to hgh s not necessary because that s dentcal to the entre document wthout nodes labeled. root 123 submsson d acceptance # # submsson d # 42 acceptance # Fgure 2.5: The polcy specfyng that the acceptance values of the submssons n the data structure of Fgure 2.1 are secret. As an example, let us compose an nformaton flow polcy specfyng that the acceptance values of submssons n the database of Fgure 2.1 are secret. Ths s done by the polcy n Fgure 2.5, where the leaves labeled wth the acceptance values are replaced wth nullary nodes labeled. Informaton flow polces for programs realzng a functon from the ntal state to the fnal state are frequently defned n terms of these states. We call these polces end-to-end nformaton flow polces, n order to emphasze ther dfference to temporal nformaton flow polces characterzng the sequence of values exchanged between a system and ts envronment durng the executon. 2.2 The Runtme Montor through an Example Smlarly to other runtme montors, e.g., 77, 38, 66, 64, n order to enforce nformaton flow propertes, we extend the confguraton of the semantcs of the language wth an addtonal member. The new member D : (X B Σ2,Σ 0 { }) {,, }, referred to as the montor state, assgns to every varable ether a bnary tree havng the extra nullary alphabet element, or s one of the symbols, and. Intutvely, D(x) stores the publc vew of the value of the varable x n the correspondng real state s. The montor recalculates D n parallel to each transton of the operatonal semantcs, and at the end the fnal montor state s presented as the result of the computaton for prncpals belongng to the securty lattce element low. 1 empty:=#; 2 f top(author)=a_mustermann then { 3 f top(topc)=databases then { 4 rev2:=conflct(empty,rev2); 5 rev1:=lstelem(doc,rev1); 6 } 7 else { 8 rev2:=conflct(empty,rev2);

21 2.2. THE RUNTIME MONITOR THROUGH AN EXAMPLE 15 9 rev3:=lstelem(doc,rev3); 10 }; 11 } 12 else { 13 skp; 14 }; Lstng 2.2: Branchng on a secret value. In the next paragraphs, we nformally llustrate the functonalty of the runtme montor by an example. The code fragment n Lstng 2.2 could be part of a paper submsson system dstrbutng the papers to revewers. Let us suppose that revewer 2 declared a conflct of nterest wth the author A. Mustermann, and therefore the dstrbuton system s not allowed to send nformaton to hm about the content. Therefore, from the pont of vew of revewer 2, the topc of the paper of A. Mustermann s secret too. Let us suppose that the runtme montor reaches lne 3 of the code n Lstng 2.2 wth montor state: D 0 = {..., topc, rev1 #, rev2 lstelem(document(...), #),...} Because the condtonal expresson depends on the secret, constant propagaton s carred out on ths branchng command. We can dentfy the value wth the top element of constant propagaton expressng that the value s not constant and therefore, may leak nformaton about the secret. After executng the branches we get: D then = {..., rev1 lstelem(document(...), #), rev2 conflct(#, lstelem(document(...), #)),...} D else = {..., rev1 #, rev2 conflct(#, lstelem(document(...), #)),...} After the jon computaton we have: D = {..., rev1, rev2 conflct(#, lstelem(document(...), #)),...} Computng the jon of two states can be done by replacng the values of varables at postons where they dffer, wth the symbol. In ths way, t s guaranteed that the montor state s ndependent of the secret after the branchng construct. For the jon computaton, therefore, t s not necessary to replace author author = author M. Smth author M. Smth author M. Smth author J. Doe author R. Mles author author R. Mles J. Doe Fgure 2.6: The jon on document trees, where the leaves labeled # are omtted for the sake of smplcty. the entre value of a varable wth f the two values dffer only for certan subtrees. Fgure 2.6 llustrates the jon computaton for the values of varable authors n montor states D then and D else n a stuaton lke that. The varable contans a lst of authors and ther documents that they submtted. Let us suppose that the order of two authors has been exchanged n one of the two

22 16 CHAPTER 2. RUNTIME MONITOR secret-dependent condtonal branches n order to leak nformaton. By computng the jon, we only need to replace those members of the lst whch were exchanged, but we can leave the others as they are. In ths way, we take the sem-structured nature of data nto account and gan addtonal precson. Another advantage of our approach s the followng. Because n the code fragment of Lstng 2.2 the varable rev2 s assgned n a secret branch, many nformaton flow analyzers would consder ts value secret. The solutons motvated by the type system of Volpano et al. 78 lke Jf 56, 4, SIF 19 and Paralocks 17 do so because the varable rev2 has been assgned n an envronment, where the program counter depends on the secret and therefore s hgh. Smlarly behave runtme montors 77, 38, 66, 64 for the same reason. The program slcng 43 based solutons lke Joana 41 do so, because of the control dependence edges from the condtonal expressons to assgnments. Our dea s based on the observaton that n the fnal confguraton the value of the varable rev2 s ndependent of the value of topc. Ths could happen, perhaps, because the program notced by the embeddng branchng decson, that the content of the paper s secret and behaved correctly. Accordngly, the observaton of rev2 does not gve us nformaton on the secret value. Our runtme montor would consder the value of rev2 as publc, because t determnes the confdental parts of values by means of the jon computaton after extng from branchng commands dependng on secret values. There are approaches based on bsmulaton, e.g. 51, 47, allowng publc assgnments n secret branches, f the equvalence of the publc effects of these branches s proved. Because program equvalence s n general undecdable, these solutons rely on syntactc approxmatons. In our soluton f programs p and q are equvalent, they do not read confdental varables, and they termnate, then the result of f secret=0 then {p} else {q} s recognzed publc regardless of the syntactc representaton of p and q. In the next secton we formally elaborate the deas ntroduced here. 2.3 Formal Treatment of the Montor In order to descrbe the runtme montor formally, we need some more defntons. In the followng, we regard a tree τ as a mappng from ts postons Pos(τ) to the alphabet Σ = Σ 2 Σ 0 { }, where the doman s a prefx closed subset of {1, 2}. Accordngly, we use the notaton τ(π) to refer to the alphabet element at poston π of the tree τ. If a node π of τ has successors, then τ(π) Σ 2, otherwse τ(π) Σ 0 { }. We denote the subtrees rooted at the frst and the second chld of the root of τ wth τ/1 and τ/2 respectvely. Defnton 2 (Preorder of Trees). If τ 1, τ 2 B Σ2,Σ 0 { } then τ 1 τ 2 holds f one of the followng s true: τ 2 (ε) =. τ 2 (ε) and τ 1 (ε) = τ 2 (ε), furthermore, f τ 1 (ε) Σ 2 then τ 1 /1 τ 2 /1 and τ 1 /2 τ 2 /2. In Defnton 2 the symbol occurs as an addtonal nullary element, whch represents a secret subtree n the publc vew. Smlarly to the state, the montor state can also be erroneous, denoted by, meanng that the executon reached an nconsstent stuaton. It s also possble that the error state tself depends

23 2.3. FORMAL TREATMENT OF THE MONITOR 17 D f D(x)(ε) = σ M top(x)=σ Dx σ(, ) f D(x) = and σ Σ D = 2 Dx σ f D(x) = and σ Σ 0 otherwse M top(x)=σ D = { D f D(x)(ε) σ f D(x)(ε) = σ (2.1) (2.2) M x:=y D = Dx D(y) M x:=# D = Dx # M x:=σ 2 (x 1,x 2 ) D = Dx σ 2 (D(x 1 ), D(x 2 )) where σ 2 Σ 2 M skp D = D (2.3) M x:=y/1 D = M x:=y/2 D = Dx τ 1 f D(y) = σ 2 (τ 1,τ 2 ) for some σ 2 f D(y) = otherwse Dx τ 2 f D(y) = σ 2 (τ 1,τ 2 ) for some σ 2 f D(y) = otherwse (2.4) M λ b (x 1,x 2,...) D = D where D = {D s D : λ b (x 1,x 2,...) s D } M x:=λ t (x 1,x 2,...) D = D where D = {D s D : x:=λ t (x 1,x 2,...) s D } M f D = D f D {,, } for all assgnments and Boolean expressons f (2.5) (2.6) (2.7) Fgure 2.7: Montor state transformers of assgnments and Boolean expressons.

24 18 CHAPTER 2. RUNTIME MONITOR on the secret. Ths happens for nstance, f one condtonal branch of a decson dependng on the secret exhbts an error, whle the other does not. We have ntroduced the top element to represent ths case. For the montor state, a data flow analyss wll be performed to approxmate the publc vew after a secretdependent branchng construct. For ths analyss, a bottom element (denotng unreachablty) comes n handy to obtan a complete lattce (see Defnton 3). Defnton 3 (Complete Lattce of Montor States). The complete lattce of montor states s D = (X B Σ2,Σ 0 { }) {,, }. For any D 1, D 2 D the relaton D 1 D 2 holds f one of the followng s true: D 1 = D 2 = D 1 = and D 2 = If D 1, D 2 {,, } then for all varables x t holds that D 1 (x) D 2 (x) accordng to Defnton 2. The dea of the montored executon s to carry out the state transformatons on the real state and on the montor state n parallel. For each assgnment or Boolean expresson f the functon f s carred out on the real state s, and the functon M f s carred out on the montor state D. The functon M f s defned so that whenever s D then f s M f D holds too. The ntutve meanng of the relaton between the real state and the montor state s that they agree on publc values, and ths s the property our montor guarantees along the run. The state transformers for montor states are shown n Fgure 2.7, where the effects of Boolean expressons are dsplayed by formulae (2.1) and (2.2). Boolean expressons are transformatons on the montor state just as tree expressons are. Bascally, a Boolean expresson b holds on the montor state D (.e., M b D = D) f there s potentally a state s where s D and b s = s. In the other case the result s, whch represents unreachablty. In (2.1) however, addtonal modfcatons are carred out on the montor state. The content of the varable x s transformed to the greatest tree that does not equal to, for whch the Boolean expresson holds. The purpose of the transformaton s to enhance precson whle preservng soundness. 1 f top(x)=σ 2 then { 2 y:=x/2; } else {... }; Consder the lstng above havng an assgnment y:=x/2 n the postve branch of a branchng construct. Snce the condton tests the label of the root of the tree n x for the symbol σ 2 Σ 2, t s mpossble that the root of the value n x at lne 2 s labeled wth an element of Σ 0. Therefore, the montor state after the assgnment does not need to represent the error state, whch cannot happen for any real state anyway. On the other hand, soundness s preserved by the fact that the montor state of the negatve branch s not modfed by the Boolean expresson (2.2). Therefore, the fnal montor states of both branches are n the desrable relaton wth all possble real states, gven that the relaton was also present ntally.

25 2.3. FORMAL TREATMENT OF THE MONITOR 19 The montor state transformers correspondng to assgnments as shown by (2.3) and (2.4) are almost dentcal to the real state transformers n Fgure 2.3. The only dfference s n (2.4), where there s an addtonal case for the stuaton, when the chldren of a leaf wth label are addressed. Dependng on the secret, the result of the expresson on the correspondng real state may possbly be but t s not necessary. Therefore, the montor state must be swtched to, n order to ndcate that the occurrence of the error state may depend on confdental nformaton. CA: D {, } x:=e, n, (s, D) γ ( x:=e s, M x:=e D) CCE: D {, } c, s ρ s c, n, (s, D) γ (s, D) CS: c, n, (s, D) γ (s, D ) c;p, n, (s, D) γ p, n, (s, D ) CIT: CIF: D {, } M b D = p tt, n, (s, D) γ (s, D ) f b then {p tt } else {p ff }, n, (s, D) γ (s, D ) D {, } M b D = p ff, n, (s, D) γ (s, D ) f b then {p tt } else {p ff }, n, (s, D) γ (s, D ) CWT: D {, } M b D M b D f b then {p tt } else {p ff }, s ρ s (f b then {p tt } else {p ff }), s, D µ D CIH: f b then {p tt } else {p ff }, n, (s, D) γ (s, D ) D {, } M b D = p, n, (s, D) γ (s, D ) whle b do {p}, n, (s, D) γ whle b do {p}, n, (s, D ) CWF: D {, } M b D = whle b do {p}, n, (s, D) γ (s, D) CWH: D {, } M b D M b D whle b do {p}, s ρ s (whle b do {p})(n), D µ D whle b do {p}, n, (s, D) γ (s, D ) Fgure 2.8: The montored semantcs. The transformers correspondng to nterpreted functons λ b and λ t are specfed by (2.5) and (2.6). Snce the real semantcs of these functons are unknown, the equatons only specfy the condtons that need to be fulflled by all possble sound runtme montors. Accordngly, the resultng montor state D needs to be greater or equal to all possble resultng real states. An addtonal requrement aganst D s that t needs to be the least among those that fulfll the prevous requrement. Ths way, the resultng montor state s the smallest among those that are sound wth respect to the concrete state transformer. The semantcs of the montored executon s defned n the form of relatons cfg γ cfg between confguratons of the form p, n, (s, D), where p s a pro-

26 20 CHAPTER 2. RUNTIME MONITOR States n synchrony. 4 s D Montored executon usng rules γ. Generalzed constant propagaton usng rules µ. Jon computaton. Fgure 2.9: A montored executon of the example program at Lstng 2.2, where the numbers of edges dentfy the lne n the code they stand for. In partcular, the meanng of 3 s that the negated verson of the Boolean expresson of lne 3 s executed. gram to be executed and s s the state of the executon. The member D s the publc vew of the state s, whch we call the montor state, s s called the real state. The member n s a natural number nfluencng the precson of the montor when computng the publc effect of branchng constructs. Larger values correspond to enhanced precson and longer computaton tme. In the ntal confguraton p 0, n, (s 0, D 0 ) t holds that s 0 D 0. Furthermore, there are no trees wth nodes labeled n the contents of s 0. The transton rules of the montored semantcs are shown n Fgure 2.8, and a montored executon of the program n Lstng 2.2 s llustrated n Fgure 2.9. As long as the montored semantcs does not execute a branchng construct, the condton of whch depends on the secret, the montored executon carres out the transformatons on s and D smultaneously. Accordngly, assgnments are executed n parallel on s and on D as t s defned by rule CA. If the montor state D {,, }, then t s smply propagated to the next command n the sequence usng rule CCE. The truth values of Boolean expressons are determned based on the montor state. If M b D =, then we assume b to be true. Accordngly, snce the content of the varable author does not depend on the secret, lne 2 of Lstng 2.2 s executed on the montor and the real state usng rule CIT n Fgure 2.8. In case M b D and M b D smultaneously, we execute a branchng construct, the condton of whch may depend on the secret. In ths case, accordng to rules CIH and CWH, the result of the branchng command on the real state s computed usng the orgnal semantcs of Fgure 2.4, the resultng montor state s computed usng a generalzed constant propagaton algorthm. Ths s vsualzed n Fgure 2.9, where multple branches of a branchng construct are executed on the montor state usng rules µ. At the common fnal node of the branches the results of the branches are joned n order to compute the result of the whole branchng construct. The parameter n n the confguraton of the montored executon s used by the generalzed constant propagaton algorthm. Assume that the command c n the confguraton c;p, n, (s, D) s a branchng construct, the condton of whch depends on the secret. In ths case we apply the generalzed constant

27 2.3. FORMAL TREATMENT OF THE MONITOR 21 propagaton on the command c(n), whch we construct based on c by replacng all occurrences of the command whle b do {p} n the program text of c by whle(n) b do {p}. MCE: D {,, } c, D µ D MA: D {,, } x:=e, D µ M x:=e D MS: c, D µ D c;p, D µ p, D MI: p tt, M b D µ D tt p ff, M b D µ D ff D {,, } D = D tt D ff f b then {p tt } else {p ff }, D µ D MWT: D {,, } M b D = n > 0 p, M b D µ D whle(n) b do {p}, D µ whle(n 1) b do {p}, D MWF: D {,, } M b D = whle(n) b do {p}, D µ D MWH: MWX: (M b D M b D ) n 0 D {,, } p, M b D µ D 1 D = D 1 D D D whle(n) b do {p}, D µ whle(n 1) b do {p}, D (M b D M b D ) n 0 D {,, } p, M b D µ D 1 D = D 1 D D D whle(n) b do {p}, D µ D Fgure 2.10: Generalzed constant propagaton. The generalzed constant propagaton algorthm s defned n Fgure 2.10, whch s bascally the rule-based formalzaton of a syntax-drected fxed-pont computaton algorthm on the program text as t s presented n 15. The lattce s the set of possble montor states accordng to Defnton 3. The rules defnng the functonalty of assgnment (MA), sequental executon of commands (MS), and the propagaton of the states, and (MCE) are very smlar to rules A, S and E of the orgnal semantcs. The only dfference s at rule MCE, whch propagates the states and unmodfed as well. The rule MI s responsble for computng the montor state transformaton correspondng to an f command. It evaluates both branches wth ntal states M b D and M b D and then jons the results. The rules MWT, MWF, MWH and MWX are used to compute the publc effect of teratons. If the parameter n s less or equal to zero, or the condton b s secret-dependent, then a fxed pont s computed by rules MWH and MWX. If, however, the condton s ndependent of the secret, and n s greater than zero, the montor executes the body of the loop teratvely by applyng rules MWT and MWF. At the same tme ths mght not termnate. So the purpose of n s

28 22 CHAPTER 2. RUNTIME MONITOR to allow the user to specfy how many tmes the montor should apply the rule MWT before swtchng to the fxed pont computaton. In partcular, settng the parameter n to zero n the ntal confguraton of the montored executon p, n, (s, D) amounts to choosng to omt the applcaton of rules MWT and MWF, and use only the fxed pont computaton offered by rules MWH and MWX. At the same tme ths mght result n an unnecessarly naccurate montor state. Because the complete lattce of Defnton 3 has the ascendng chan condton, as Theorem 1 states below, the fxed pont computaton always termnates. Theorem 1. If there s an s so that s D and p, s ρ s, then there s a D so that p, n, (s, D) γ (s, D ). Proof. The dea behnd the proof s the followng: If there s no branchng construct executed havng a secret-dependent condton along the montored executon, then the state transtons are carred out smultaneously on the real state and on the montor state. In the case of a branchng construct havng a secret-dependent condton, the publc effect s computed by the algorthm n Fgure The only rule, whch could be appled an unbounded number of tmes s MWH, but because the lattce of Defnton 3 has the ascendng chan condton, the fxed pont computaton termnates. For the detaled proof of ths case please refer to Lemma 3 n Secton Guarantees In ths secton we formally dscuss the guarantees provded by the runtme montor. Smlarly to other language-based nformaton flow controllng solutons 27, 56, 4, 65, 64, 41, 38, 77, our approach enforces a varant of termnatonnsenstve nonnterference 7 talored for our computatonal model. Accordngly, we do not consder covert channels lke the tmng channel, the heat channel, or the memory consumpton channel, or any other channel that could result from the propertes of a specfc mplementaton or runtme envronment. Defnton 4 (Termnaton-Insenstve Nonnterference 1 ). Program p satsfes termnaton-nsenstve nonnterference relatve to the ntal and fnal publc vews D and D f and only f for all s 1, s 2 D t s true that f p, s 1 ρ s 1 and p, s 2 ρ s 2 then s 1 D and s 2 D hold too. In ths case we say that D s an approprate fnal publc vew correspondng to the program p and the ntal publc vew D. The montored executon p, n, (s, D) γ (s, D ) computes a par (s, D ) based on (s, D), where D s an approprate fnal publc vew correspondng to p and D. We may consder the publc vew D as an ndstngushablty relaton between 1 There s an algebracally equvalent and smpler formulaton to ths defnton: Program p satsfes termnaton-nsenstve nonnterference relatve to D and D, f for all s D from p, s ρ s t follows that s D.