Layout Randomization and Nondeterminism

In security, layout randomization is a popular, effective attack mitigation technique. Recent work has aimed to explain it rigorously, focusing on deterministic systems. In this paper, we study layout randomization in the presence of nondeterministic choice. We develop a semantic approach based on denotational models and simulation relations. This approach abstracts from language details, and helps manage the delicate interaction between probabilities and nondeterminism.

[1]  Fred B. Schneider,et al.  Proving Nondeterministically Specified Safety Properties Using Progress Measures , 1993, Inf. Comput..

[2]  Martín Abadi,et al.  The Existence of Refinement Mappings , 1988, LICS.

[3]  Julian Rathke,et al.  Local Memory via Layout Randomization , 2011, 2011 IEEE 24th Computer Security Foundations Symposium.

[4]  David Sands,et al.  Probabilistic noninterference for multi-threaded programs , 2000, Proceedings 13th IEEE Computer Security Foundations Workshop. CSFW-13.

[5]  Willem-Paul de Roever,et al.  Data Refinement by Willem-Paul de Roever , 1998 .

[6]  Silvio Micali,et al.  Probabilistic Encryption , 1984, J. Comput. Syst. Sci..

[7]  John C. Mitchell,et al.  A probabilistic poly-time framework for protocol analysis , 1998, CCS '98.

[8]  Michael W. Mislove.  On Combining Probability and Nondeterminism , 2006, Electron. Notes Theor. Comput. Sci..

[9]  Fred B. Schneider,et al.  Independence from obfuscation: A semantic framework for diversity , 2010, J. Comput. Secur..

[10]  Jean Goubault-Larrecq.  Prevision Domains and Convex Powercones , 2008, FoSSaCS.

[11]  Martín Abadi,et al.  On Protection by Layout Randomization , 2010, 2010 23rd IEEE Computer Security Foundations Symposium.

[12]  Klaus Keimel,et al.  Semantic Domains for Combining Probability and Non-Determinism , 2005, Electronic Notes in Theoretical Computer Science.

[13]  Willem-Paul de Roever,et al.  Data Refinement: Theory , 1998 .

[14]  Klaus Keimel,et al.  Continuous Lattices and Domains: The Scott Topology , 2003 .

[15]  John C. Mitchell,et al.  A probabilistic polynomial-time process calculus for the analysis of cryptographic protocols , 2005, Theor. Comput. Sci..

[16]  Nancy A. Lynch,et al.  Analyzing Security Protocols Using Time-Bounded Task-PIOAs , 2008, Discret. Event Dyn. Syst..

[17]  David H. Ackley,et al.  Building diverse computer systems , 1997, Proceedings. The Sixth Workshop on Hot Topics in Operating Systems (Cat. No.97TB100133).

[18]  Úlfar Erlingsson,et al.  Low-Level Software Security: Attacks and Defenses , 2007, FOSAD.

[19]  K. Hofmann,et al.  Continuous Lattices and Domains , 2003 .

[20]  Matthew Tobias Jackson,et al.  A SHEAF THEORETIC APPROACH TO MEASURE THEORY , 2006 .

[21]  Martín Abadi,et al.  On Layout Randomization for Arrays and Functions , 2013, POST.

[22]  Willem P. de Roever,et al.  Data Refinement: Model-oriented Proof Theories and their Comparison , 1998, Cambridge Tracts in Theoretical Computer Science.