Non-Interference for a Typed Assembly Language

Non-interference is a desirable property of systems in a mul tilevel security architecture, stating that confidential information is not disclosed in public output. The c hallenge of studying information flow for assembly languages is that the control flow constructs that guide the a nalysis in high-level languages are not present. To address this problem, we define a typed assembly language t h t uses pseudo-instructions to impose a stack discipline on the control flow of programs. We develop a type s ystem for checking that assembly programs enjoy non-interference and its proof of soundness.

[1]  Karl Crary,et al.  From system F to typed assembly language , 1999, TOPL.

[2]  George C. Necula,et al.  Compiling with proofs , 1998 .

[3]  Gilles Barthe,et al.  Security types preserving compilation , 2004, Comput. Lang. Syst. Struct..

[4]  Robert Harper,et al.  A dependently typed assembly language , 2001, ICFP '01.

[5]  Andrew C. Myers,et al.  Language-based information-flow security , 2003, IEEE J. Sel. Areas Commun..

[6]  Lawrence Robinson,et al.  Software development and proofs of multi-level security , 1976, ICSE '76.

[7]  Frank Pfenning,et al.  A monadic analysis of information flow security with mutable state , 2005, J. Funct. Program..

[8]  Lawrence Robinson,et al.  Proving multilevel security of a system design , 1977, SOSP '77.

[9]  David Walker,et al.  Alias Types , 2000, ESOP.

[10]  Dorothy E. Denning,et al.  A lattice model of secure information flow , 1976, CACM.

[11]  K. J. Bma.  Integrity considerations for secure computer systems , 1977 .

[12]  Geoffrey Smith,et al.  A Type-Based Approach to Program Security , 1997, TAPSOFT.

[13]  J. Meseguer,et al.  Security Policies and Security Models , 1982, 1982 IEEE Symposium on Security and Privacy.

[14]  Peter J. Denning,et al.  Certification of programs for secure information flow , 1977, CACM.

[15]  Gilles Barthe,et al.  Security Types Preserving Compilation ? ( Extended abstract ) , 2022 .

[16]  Xavier Leroy.  Java Bytecode Verification: An Overview , 2001, CAV.

[17]  David A. Bell,et al.  Secure computer systems: mathematical foundations and model , 1973 .

[18]  Andrew C. Myers,et al.  Secure Information Flow via Linear Continuations , 2002, High. Order Symb. Comput..

[19]  Anindya Banerjee,et al.  Secure information flow and pointer con .nement in a java-like language , 2002, Proceedings 15th IEEE Computer Security Foundations Workshop. CSFW-15.

[20]  Ricardo Medel,et al.  A typed assembly language for secure information flow analysis , 2004 .

[21]  David Aspinall,et al.  Heap-Bounded Assembly Language , 2004, Journal of Automated Reasoning.

[22]  David Walker,et al.  Stack-based typed assembly language , 1998, Journal of Functional Programming.

[23]  David Sands,et al.  Timing Aware Information Flow Security for a JavaCard-like Bytecode , 2005, Electron. Notes Theor. Comput. Sci..