Micro-Policies: Formally Verified, Tag-Based Security Monitors - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2015

Micro-Policies: Formally Verified, Tag-Based Security Monitors


Recent advances in hardware design have demonstrated mechanisms allowing a wide range of low-level security policies (or micro-policies) to be expressed using rules on metadata tags. We propose a methodology for defining and reasoning about such tag-based reference monitors in terms of a high-level "symbolic machine" and we use this methodology to define and formally verify micro-policies for dynamic sealing, compartmentalization, control-flow integrity, and memory safety, in addition, we show how to use the tagging mechanism to protect its own integrity. For each micro-policy, we prove by refinement that the symbolic machine instantiated with the policy's rules embodies a high-level specification characterizing a useful security property. Last, we show how the symbolic machine itself can be implemented in terms of a hardware rule cache and a software controller.
Fichier principal
Vignette du fichier
micro-policies.pdf (342.44 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-01265666 , version 1 (06-09-2018)



Arthur Azevedo de Amorim, Maxime Dénès, Nick Giannarakis, Cătălin Hriţcu, Benjamin C. Pierce, et al.. Micro-Policies: Formally Verified, Tag-Based Security Monitors. 2015 IEEE Symposium on Security and Privacy, May 2015, San Jose, United States. pp.813 - 830, ⟨10.1109/SP.2015.55⟩. ⟨hal-01265666⟩
175 View
206 Download



Gmail Facebook Twitter LinkedIn More