Verifying the Incorrectness of Programs and Automata

2012 IEEE Symposium on Security and Privacy, 2012

Over the last 15 years, many policy languages have been developed for specifying policies and credentials under the trust management paradigm. What has been missing is a formal semantics-in particular, one that would capture the inherently dynamic nature of trust management, where access decisions are based on the local policy in conjunction with varying sets of dynamically submitted credentials. The goal of this paper is to rest trust management on a solid formal foundation. To this end, we present a model theory that is based on Kripke structures for counterfactual logic. The semantics enjoys compositionality and full abstraction with respect to a natural notion of observational equivalence between trust management policies. Furthermore, we present a corresponding Hilbert-style axiomatization that is expressive enough for reasoning about a system's observables on the object level. We describe an implementation of a mechanization of the proof theory, which can be used to prove non-trivial metatheorems about trust management systems, as well as analyze probing attacks on such systems. Our benchmark results show that this logic-based approach performs significantly better than the only previously available, ad-hoc analysis method for probing attacks.

Computers & Mathematics with Applications, 2012

Security and trust represent two different perspectives on the problem of guaranteeing the correct interaction among software components. Gate automata have been proposed as a formalism for the specification of both security and trust policies in the scope of the Security-by-Contract-with-Trust (S×C×T) framework. Indeed, they watch the execution of a target program, possibly modifying its behaviour, and produce a feedback for the trust management system. The level of trust changes the environment settings by dynamically activating/deactivating some of the defined gate automata. The goal of this paper is to present gate automata and to show a gate automatadriven strategy for the run-time enforcement in the S×C×T.

IEEE Software, 2011

2006

We define a set of process algebra operators (controllers) that mimic the security automata introduced by Schneider in and by Ligatti and al. in [4], respectively. We also show how to automatically build these controllers for given security policies. Recently, several papers tackled the formal definition of mechanisms for enforcing security policies (e.g., see ). The focus of this paper is the study of the enforcement mechanisms introduced by Schneider in and security automata developed by Ligatti and al. in [4,. In , Schneider deals with the problem of enforcing security properties in a systematic way. He discusses whether a given security property is enforceable and at what cost. To study those issues, Schneider uses the class of enforcement mechanisms (EM) that work by monitoring execution steps of a target system, herein and terminating its execution if it is about to violate the security property being enforced. A security automaton defined in [18] is a triple (Q, q 0 , δ) where Q is a set of states, q 0 is the initial one and δ : Act × Q → Q, where Act is a set of security-relevant actions, is the transition function. A security automata processes a sequence a 1 a 2 . . . of actions. At each step only one action is considered and for each action we calculate the global state Q that is the set of the possible states for the current action, i.e. if the automaton is checking the action a i then Q = q∈Q δ(a i , q). If the automaton can make a transition on a given action, i.e. Q is not empty, then the target is allowed to perform that step. The state of the automaton changes according to the transition rules. Otherwise the target execution is terminated. A security property that can be enforced in this way corresponds to a safety property (according to [18], a property is a safety * Work partially supported by CNR project "Trusted e-services for dynamic coalitions" and by EU-funded project "Software Engineering for Service-Oriented Overlay Computers"(SENSORIA) and by EU-funded project "Secure Software and Services for Mobile Systems "(S3MS).

2011

Proceedings of the fifth ACM workshop on Scalable trusted computing - STC '10, 2010

Computer systems are routinely deployed in life-and missioncritical situations, yet in most cases their security, safety or dependability cannot be assured to the degree warranted by the application. In other words, trusted computer systems are rarely really trustworthy.

Fundamenta Informaticae, 2007

The paper presents a method of abstraction for timed systems. To extract an abstract model of a timed system we propose to use static analysis, namely a technique called path compression. The idea behind the path compression consists in identifying a path (or a set of paths) on which a process executes a sequence of transitions that do not influence a property being verified, and replacing this path with a single transition. The method is property driven since it depends on a formula in question. The abstraction is exact with respect to all the properties expressible in the temporal logic CTL * −X .

Security protocols are widely used in open modern networks to ensure safe communications. It is now recognized that formal analysis can provide the level of assurance required by both developers and users of the protocols. Unfortunately it is generally undecidable to certify whether a protocol is safe or not. However the automatic verification of security protocols can be attempted using abstraction-based approximation. For this purpose, tree automata approximations were introduced by Genet and Klay in 2000. In this paper, we propose an extension of their techniques making the approach efficiently automatic. Our contribution has been implementing in the TA4SP tool with a high level specification language as input format, providing positive practical results on industrial security protocols.

International Journal of Information Security, 2013

Edit automata have been introduced by J.Ligatti et al. as a model for security enforcement mechanisms which work at run time. In a distributed interacting system, they play a role of a monitor that runs in parallel with a target program and transforms its execution sequence into a sequence that obeys the security property. In this paper, we characterize security properties which are enforceable by finite edit automata (i.e. edit automata with a finite set of states) and deterministic context-free edit automata (i.e. finite edit automata extended with a stack). We prove that the properties enforceable by finite edit automata are a sub-class of regular sets. Moreover, given a regular set P, one can decide in time O(n 2), whether P is enforceable by a finite edit automaton (where n is the number of states of the finite automaton recognizing P) and we give an algorithm to synthesize the controller. Moreover, we prove that safety policies are always enforced by a deterministic context-free edit automaton. We also prove that it is possible to check if a policy is a safety policy in O(n 4). Finally, we give a topological condition on the deterministic automaton expressing a regular policy enforceable by a deterministic context-free edit automaton. Keywords Edit automata • Security policies • Enforcement mechanisms Preliminary results were presented in [1].

Future Generation Computer Systems, 2018

We present a new logic-based framework for modeling and automatically verifying trust in Multi-Agent Systems (MASs). We start by refining TCTL, a temporal logic of trust that extends the Computation Tree Logic (CTL) to enable reasoning about trust with preconditions. A new vector-based version of interpreted systems is defined to capture the trust relationship between the interacting parties. We introduce a set of reasoning postulates along with formal proofs to support our logic. Moreover, we present new symbolic model checking algorithms to formally and automatically verify the system under consideration against some desirable properties expressed using the proposed logic. We fully implemented our proposed algorithms as a model checker tool called MCMAS-T on top of the MCMAS model checker for MASs along with its new input language VISPL (Vector-extended ISPL). We evaluated the tool and reported experimental results using a real-life scenario in the healthcare field.