Verifying persistent security properties

Abstract

We study bisimulation-based information flow security properties which are persistent, in the sense that if a system is secure then all of its reachable states are secure too. We show that such properties can be characterized in terms of bisimulation-like equivalence relations, between the full system and the system prevented from performing confidential actions. Moreover, we provide a characterization of such properties in terms of unwinding conditions which demand properties of individual actions. These two different characterizations naturally lead to efficient methods for the verification and construction of secure systems. We also prove several compositionality results, that allow us to check the security of a system by only verifying the security of its subcomponents.

Introduction

The protection of confidential data from undesired accesses is a typical security issue concerning both systems and networks. Inside a system, information is typically protected via some access control policy, limiting accesses of entities (such as users or processes) to data. There are different levels of flexibility of access control policies depending on the possibility for one entity to change the access rights of its own data. As an example, UNIX gives users complete control on the policy, i.e., every user may decide to make her own information either secret or public. On the other hand, there are mandatory policies in which entities have no control on the access rights. For example, Multilevel Security [2] imposes that entities and data are associated to (ordered) security levels and no access to data at higher levels is ever possible, even if the owner of the data is willing to reveal them. These strong mandatory security policies have been designed to avoid internal attacks performed by the so called Trojan Horse programs, i.e., malicious software that, once executed by a user, modifies the access rights of the data belonging to such a user. Unfortunately, even when direct access to data is forbidden by (strong) security policies, it might be the case that data are indirectly leaked by Trojan Horses which might exploit some observable system side-effects like, e.g., the CPU load or, more in general, the space/time availability of shared resources. (see, e.g., [3], [4]).

The necessity of controlling information flow as a whole (both direct and indirect) motivated Goguen and Meseguer in introducing the notion of Non-interference [5], [6]. Non-Interference formalizes the absence of information flow within deterministic systems. Given a system in which confidential (i.e., high level) and public (i.e., low level) information may coexist, non-interference requires that confidential inputs never affect the outputs on the public interface of the system, i.e., never interfere with the low level users. If such a property holds, one can conclude that no information flow is ever possible from high to low level.

A possibilistic security property can be regarded as an extension of non-interference to non-deterministic systems. Starting from Sutherland [7], various such extensions have been proposed, e.g., [8], [9], [10], [11], [12], [13], [14], [15], [16], [17], [18]. Most of these properties are based on traces, i.e., the behavior of systems is modelled through the set of their execution sequences. Examples are non-inference [15], generalized non-interference [11], restrictiveness [11], and the perfect security property [18].

In [8], Focardi and Gorrieri express the concept of non-interference in the Security Process Algebra (SPA) language, in terms of bisimulation semantics. In particular, inspired by [17], they introduce the notion of Bisimulation-based non Deducibility on Compositions (BNDC): a system E is BNDC if what a low level user sees of the system is not modified (in the sense of the bisimulation semantics) by composing any high level process Π with E. The main advantage of BNDC with respect to trace-based properties is that it is powerful enough to detect information flows due to the possibility, for a high level malicious process, to block or unblock a system. In particular, in [8], [19], it is shown that a malicious process may build a channel from high to low, by suitably blocking and unblocking some system services accessible by low level users. The system used to build this covert channel turns out to be secure for trace-based properties. This motivates the use of more discriminating equivalences such as bisimulation.

Non-interference properties, like BNDC, provide formal definitions of information flow security and, as a consequence, are useful in order to well understand and reason about system and network security. In this paper we also approach the problem of automatically checking BNDC-like properties, which is useful in many respects. First, as discussed in [20], having efficient automated checkers is useful to test a property against non-trivial system specifications. It is important to check on many examples that what is intuitively considered insecure is correctly rejected by the property. It is also crucial to verify that the property is not stronger than expected, and accepts as secure what is intuitively so. An automated tool is a good way for observing properties at work.

Moreover, there are some cases in which it is possible to analyze specifications that are strictly related to the “real world”. An interesting example is the analysis of security protocols, i.e., simple distributed algorithms based on cryptography. They are simple to specify using process calculi like SPA, since they are characterized by little local computation and some message exchanges. In [21] it is shown how to use BNDC-like properties to check many different network security properties like, e.g., secrecy and authentication. The main idea is that BNDC allows us to check whether or not a malicious enemy is able to interfere on the correct (expected) protocol execution. In this setting, the automated verification of BNDC allows to either discover flaws on protocol or validate (finite instances of) them.

Although Martinelli [22] has shown that a class of BNDC-like properties is decidable over finite state processes, the problem of efficiently verifying BNDC is still open. Indeed, decidability of BNDC is still an open problem. The main difficulty consists of getting rid of the universal quantification on high level processes Π. A way to overcome this problems is to adopt sufficient conditions for BNDC. We recall from [19], [23] two of them, named Strong BNDC (SBNDC, for short) and Persistent_BNDC (P_BNDC, for short)¹. Indeed, P_BNDC is interesting per se, since it has been proposed for analysing systems in dynamic contexts. Intuitively, P_BNDC is a persistent version of BNDC in which every reachable state is (BNDC) secure. In [23] it is shown that this property is suitable when some abstract form of mobility is considered. If a process moves to a different execution environment (e.g., a different host) in the middle of its computation, then we have to be guaranteed that such an intermediate state is still secure. Requiring, from the beginning, that every reachable state is secure trivially guarantees that every possible migration will be done in a secure state.

In the literature there are two different characterizations of security properties that do not require the universal quantification over high level processes Π. They allow us to exploit two different verification techniques:

• Bisimulation-based characterizations are based on a bisimulation-like equivalence relation between the system E to be analysed and the low level view of the system itself, denoted by E⧹H, i.e., the system E prevented from performing confidential actions. These characterizations allow us to exploit very efficient techniques for verifying the properties over finite-state processes, by using existing algorithms for the verification of strong bisimulation.

• Unwinding conditions demand properties of individual actions. They aim at “distilling” the local effect of performing high level actions and are useful to define both proof systems (see, e.g., [24]) and refinement operators that preserve security properties, as done in [25]. Proof systems allow to incrementally build systems which are secure by construction. Similarly, refinement operators are useful in a stepwise development process, since properties which have already been investigated in some phase need not be re-investigated in later phases.

In this paper, we start by considering the two characterizations above for P_BNDC, given in [24]. By studying the relation between two such characterizations, we generalize them to a parametric security property called s_BNDC, where parameter s specifies the way high level actions and internal actions are treated in the underlying bisimulation relation. We show that the SBNDC property, which was originally defined through unwinding conditions, is an instance of s_BNDC. This directly gives a new bisimulation-based characterization for SBNDC property. As a next step, we investigate the compositionality of P_BNDC and SBNDC. Compositionality is useful for both verification and synthesis: if a property is preserved when systems are composed, then the analysis may be performed on subsystems and, in case of success, the system as a whole can be proved to satisfy the desired property. We notice that both P_BNDC and SBNDC are compositional with respect to the parallel operator, but they are not fully compositional, since they are not preserved by the non-deterministic choice operator. In particular, when we build a system that may (non-deterministically) choose to behave as one of two secure subsystems, we could obtain an insecure system. As also observed in [26], this seems to be counterintuitive. We approach this issue by introducing a new security property, named Progressing P_BNDC (PP_BNDC), strictly stronger than P_BNDC, which is fully compositional, i.e., it is compositional also with respect to the non-deterministic choice. We show that PP_BNDC is an instance of the parametric property s_BNDC and can be thus expressed both in terms of a bisimulation-like equivalence and through unwinding conditions.

We also consider the specific problem of automatically checking our persistent security properties. In particular, we describe two methods for determining whether a system is P_BNDC, SBNDC or PP_BNDC. The first method is based on the derivation of Characteristic Formulae [27], [28] in the language of modal μ-calculus [29] (see Section 6.1). The characteristic formulae can be automatically verified using model checkers for μ-calculus, such as NCSU Concurrency Workbench [30]. Even if in the worst case this method has an exponential time complexity in the number of states of the process, it is still usable in many cases, and has the advantage of reducing the check of security properties to the standard problem of verifying a μ-calculus formula. The second method (see Section 6.2) is in the spirit of [28]: it is based on the computation of a sort of transitive closure (Closure up to high level actions) of the system and on the verification of a Strong Bisimulation. This allows us to use existing verification tools, since many different algorithms for computing the largest strong bisimulation between two processes (e.g, [31], [32], [33], [34]) have been integrated in model checkers, such as NCSU Concurrency Workbench, XEVE [35], FDR2 [36]. In particular, this second approach improves on the polynomial time complexity of the Compositional Security Checker (CoSeC) presented in [20], since only one bisimulation test is necessary.

The paper is organized as follows. In Section 2, we introduce some basic notions on the SPA language and the security properties BNDC and P_BNDC. We recall the two characterizations of P_BNDC in terms of a bisimulation-like equivalence relation and an unwinding condition. In Section 3 we introduce a parametric security property named s_BNDC in terms of bisimulation and we prove that it can be equivalently characterized in terms of a parametric unwinding condition. P_BNDC is just an instance of s_BNDC. In Section 4, we show that property SBNDC is an instance of s_BNDC and provide a bisimulation-based characterization of it. In Section 5, we introduce the class of PP_BNDC processes, which is again an instance of s_BNDC, and prove that it is fully compositional. In Section 6, we propose two methods to prove our persistent security properties and we demonstrate some complexity results. Finally, in Section 7 we discuss related works and draw some conclusions.