Proving full-system security properties under multiple attacker models on capability machines - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2022

Proving full-system security properties under multiple attacker models on capability machines

Abstract

Assembly-level protection mechanisms (virtual memory, trusted execution environments, virtualization) make it possible to guarantee security properties of a full system in the presence of arbitrary attacker provided code. However, they typically only support a single trust boundary: code is either trusted or untrusted, and protection cannot be nested. Capability machines provide protection mechanisms that are more fine-grained and that do support arbitrary nesting of protection. We show in this paper how this enables the formal verification of full-system security properties under multiple attacker models: different security objectives of the full system can be verified under a different choice of trust boundary (i.e. under a different attacker model). The verification approach we propose is modular, and is robust: code outside the trust boundary for a given security objective can be arbitrary, unverified attacker-provided code. It is based on the use of universal contracts for untrusted adversarial code: sound, conservative contracts which can be combined with manual verification of trusted components in a compositional program logic. Compositionality of the program logic also allows us to reuse common parts in the analyses for different attacker models. We instantiate the approach concretely by extending an existing capability machine model with support for memory-mapped I/O and we obtain full system, machine-verified security properties about external effect traces while limiting the manual verification effort to a small trusted computing base relevant for the specific property under study.
Fichier principal
Vignette du fichier
paper.pdf (532.06 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03826851 , version 1 (24-10-2022)

Identifiers

  • HAL Id : hal-03826851 , version 1

Cite

Thomas Van Strydonck, Aïna Linn Georges, Armaël Guéneau, Alix Trieu, Amin Timany, et al.. Proving full-system security properties under multiple attacker models on capability machines. CSF 2022 - 35th IEEE Computer Security Foundations Symposium, Aug 2022, Haifa, Israel. ⟨hal-03826851⟩
63 View
93 Download

Share

Gmail Facebook X LinkedIn More