Xun Li
ABSTRACT
Hardware designers need to precisely analyze high-level descriptions for illegal information flows. Language-based information flow analyses can be applied to hardware description languages, but a straight-forward application either conservatively rules out many secure hardware designs, or constrains the designers to work at impractically low levels of abstraction. We demonstrate that choosing the right level of abstraction for the analysis, by working on Finite State Machines instead of the hardware code, allows both precise information flow analysis and high-level programmability.
- OpenSPARC project. http://www.opensparc.net.Google Scholar
- James Newsome and Dawn Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In 12th Annual Network and Distributed System Security Symposium (NDSS), 2005.Google Scholar
- J. R. Crandall and F. T. Chong. Minos: Control Data Attack Prevention Orthogonal to Memory Model. In Proceedings of the 37th annual IEEE/ACM International Symposium on Microarchitecture (Micro), pages 221--232, 2004. Google ScholarDigital Library
- M. Dalton, H. Kannan, and C. Kozyrakis. Raksha: A Flexible Information Flow Architecture for Software Security. In Proceedings of the 34th annual international symposium on Computer architecture (ISCA), June 2007. Google ScholarDigital Library
- D. E. Denning and P. J. Denning. Certification of programs for secure information flow. Communications of the ACM, 20(7):504--513, 1977. Google ScholarDigital Library
- E. M. Clarke, O. Grumberg, and D. Peled. Model Checking. MIT Press, 2000.Google ScholarDigital Library
- G. E. Suh, J. W. Lee, D. Zhang, and S. Devadas. Secure program execution via dynamic information flow tracking. In Proceedings of the 11th international conference on Architectural support for programming languages and operating systems, 2004. Google ScholarDigital Library
- J. A. Goguen and J. Meseguer. Security policies and security models. In Proceedings of IEEE Symposium on Security and Privacy, 1982.Google ScholarCross Ref
- C. Hankin. Program analysis tools. International Journal on Software Tools for Technology Transfer, 2(1), 1998.Google ScholarCross Ref
- D. Harel. Statecharts: A visual formalism for complex systems. Science of Computer Programming 8, 1987. Google ScholarDigital Library
- C. Hymans. Checking safety properties of behavioral vhdl descriptions by abstract interpretation. In 9th International Static Analysis Symposium (SAS'02) (2002, pages 444--460. Springer. Google ScholarDigital Library
- C. Hymans. Design and implementation of an abstract interpreter for vhdl. D. Geist and E. Tronci, editors, CHARME, 2860 of LNCS, 2003.Google Scholar
- M. Krohn, A. Yip, M. Brodsky, N. Cliffer, M. Frans, K. Eddie, and K. R. Morris. Information flow control for standard os abstractions. In In SOSP, 2007. Google ScholarDigital Library
- J. McHugh and D. I. Good. An information flow tool for gypsy. In IEEE Symposium on Security and Privacy, pages 46--48, Apr. 1985.Google ScholarCross Ref
- A. C. Myers, N. Nystrom, L. Zheng, and S. Zdancewic. Jif: Java information flow. Software release. http://www.cs.cornell.edu/jif, July 2001.Google Scholar
- O. Ruwase, P. B. Gibbons, T. C. Mowry, V. Ramachandran, S. Chen, M. Kozuch, and M. Ryan. Parallelizing dynamic information flow tracking. In SPAA'08: Proceedings of the twentieth annual symposium on Parallelism in algorithms and architectures, pages 35--45. ACM, 2008. Google ScholarDigital Library
- A. Sabelfeld and A. C. Myers. Language-based information-flow security. IEEE Journal on Selected Areas in Communications, 21(1), Jan. 2003. Google ScholarDigital Library
- M. Schlickling and M. Pister. A framework for static analysis of vhdl code. 7th International Workshop on Worst-Case Execution Time (WCET) Analysis, 2007.Google Scholar
- E. Technologies. The Esterel v7 Reference Manual, version v7.30 - initial IEEE standardization proposal edition. 2005.Google Scholar
- M. Tiwari, X. Li, H. Wassel, F. Chong, and T. Sherwood. Execution leases: A hardware-supported mechanism for enforcing strong non-interference. In Proceedings of the International Symposium on Microarchitecture (MICRO), 2009. Google ScholarDigital Library
- M. Tiwari, H. Wassel, B. Mazloom, S. Mysore, F. Chong, and T. Sherwood. Complete information flow tracking from the gates up. In Proceedings of the 14th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), 2009. Google ScholarDigital Library
- T. K. Tolstrup. Language-based Security for VHDL. PhD thesis, Technical University of Denmark, 2006.Google Scholar
- T. K. Tolstrup, F. Nielson, and H. R. Nielson. Information flow analysis for vhdl. volume 3606 of LNCS, 2005. Google ScholarDigital Library
- N. Vachharajani, M. J. Bridges, J. Chang, R. Rangan, G. Ottoni, J. A. Blome, G. A. Reis, M. Vachharajani, and D. I. August. Rifle: An architectural framework for user-centric information-flow security. In In MICRO 37: Proceedings of the 37th annual IEEE/ACM International Symposium on Microarchitecture, pages 243--254. IEEE Computer Society, 2004. Google ScholarDigital Library
- G. Venkataramani, I. Doudalis, Y. Solihin, and M. Prvulovic. Flexitaint: A programmable accelerator for dynamic taint propagation. In Fourteenth International Symposium on High Performance Computer Architecture (HPCA), pages 196--206, New York, NY, USA, 2008. ACM.Google ScholarCross Ref
- D. Volpano and G. Smith. A type-based approach to pro-gram security. In In Proceedings of the 7th International Joint Conference on the Theory and Practice of Software Devel-opment, pages 607--621. Springer, 1997. Google ScholarDigital Library
- S. Wilhelm. Efficient analysis of pipeline models for WCET computation. In Proceedings of the 5th Intl Workshop on Worst-Case Execution Time (WCET) Analysis, 2005.Google Scholar
- N. Zeldovich, S. Boyd-Wickizer, and D. Mazieres. Security distributed systems with information flow control. In Proceedings of the 5th USENIX Symposium on Networked Systems Design and Implementation (NSDI), pages 293--308, Apr. 2008. Google ScholarDigital Library
- N. Zeldovich, S. Boyd-Wickizer, E. Kohler, and D. Mazières. Making information flow explicit in histar. In USENIX'06: Proceedings of the 7th conference on USENIX Symposium on Operating Systems Design and Implementation, 2006. Google ScholarDigital Library
- N. Zeldovich, H. Kannan, M. Dalton, and C. Kozyrakis. Hardware enforcement of application security policies using tagged memory. In 8th USENIX Sumposium on Operating Systems Design and Implementation (OSDI), Dec. 2008. Google ScholarDigital Library
Index Terms
- Secure information flow analysis for hardware design: using the right abstraction for the job
Recommendations
Hardware Information Flow Tracking
Information flow tracking (IFT) is a fundamental computer security technique used to understand how information moves through a computing system. Hardware IFT techniques specifically target security vulnerabilities related to the design, verification, ...
Verification of a Practical Hardware Security Architecture Through Static Information Flow Analysis
ASPLOS '17: Proceedings of the Twenty-Second International Conference on Architectural Support for Programming Languages and Operating SystemsHardware-based mechanisms for software isolation are becoming increasingly popular, but implementing these mechanisms correctly has proved difficult, undermining the root of security. This work introduces an effective way to formally verify important ...
Designing secure systems on reconfigurable hardware
The extremely high cost of custom ASIC fabrication makes FPGAs an attractive alternative for deployment of custom hardware. Embedded systems based on reconfigurable hardware integrate many functions onto a single device. Since embedded designers often ...
Comments