Steve Zdancewic ESOP011 Secure Information Flow and CPS Steve Zdancewic Joint work with Andrew Myers Cornell University

Steve Zdancewic ESOP012 Valuable Data On-line Internet and Connectivity –banks/brokerage firms – services –applets, plugins, etc. –… Creates problem of protection

Steve Zdancewic ESOP013 Protect It! Confidentiality –Data doesn't escape –Does my accounting software transmit my private information? Integrity –Trustworthiness of data –Does my accounting software use “bad” information to compute taxes?

Steve Zdancewic ESOP014 Information Flow Policies on information End-to-End –Once data is released to a program, must ensure that policy is obeyed. Need static analysis

Steve Zdancewic ESOP015 Security-Typed Languages Statically enforce security policies in an extended type system –Smith & Volpano [SVI96, SV98,...] –Heintze & Riecke [HR98, ABHR99] –Myers [ML97,My99,...] –Sabelfeld & Sands [SS99, SS00] –Pottier & Conchon [PC00,...]

Steve Zdancewic ESOP016 Noninterference "Low-security behavior of the program is not affected by any high-security data." Goguen & Messeguer 1982 H1L1 L2H2 H3L1 L2H4 LL

Steve Zdancewic ESOP017 Our Goal Study information flow in rich language –Higher-order functions –State Noninterference proof

Steve Zdancewic ESOP018 Continuation Passing Style Useful representation of low-level code – verify output of the compiler. Main complication: explicit control and interaction with effects

Steve Zdancewic ESOP019 Outline Motivating Example Problem with Naïve CPS translation Ordered Linear Continuations Wrap up

Steve Zdancewic ESOP0110 Security Types A lattice L of labels –order  L  H –join  L  H = H Types have labels: int H or bool L

Steve Zdancewic ESOP0111 Example if0 (x:int H ){ y := 1; } else { y := 2; } z := 3;

Steve Zdancewic ESOP0112 Example if0 (x:int H ){ y := 1; } else { y := 2; } z := 3; pc:L

Steve Zdancewic ESOP0113 Example if0 (x:int H ){ y := 1; } else { y := 2; } z := 3; pc:H pc:L

Steve Zdancewic ESOP0114 if0 (x:int H ){ y := 1; // y:int H } else { y := 2; } z := 3; Example pc:L pc:H

Steve Zdancewic ESOP0115 Example if0 (x:int H ){ y := 1; // y:int H } else { y := 2; } z := 3; pc:L pc:H

Steve Zdancewic ESOP0116 Example if0 (x:int H ){ y := 1; // y:int H } else { y := 2; } z := 3; pc:L pc:H

Steve Zdancewic ESOP0117 Example if0 (x:int H ){ y := 1; // y:int H } else { y := 2; } z := 3; // z:int L pc:L pc:H pc:L

Steve Zdancewic ESOP0118 PC Label Side-effects are bounded by PC label. x := e x:  s refe:  r (p  r)  spc:p

Steve Zdancewic ESOP0119 What about functions? Effects inside a function must also be bounded by PC label. f(e) f:  r p  rpc:p e: 

Steve Zdancewic ESOP0120 Naive CPS let k = (). z := 3; if0 (x:int H ){ y := 1; k(); } else { y := 2; k(); }

Steve Zdancewic ESOP0121 Naive CPS let k = (). z := 3; if0 (x:int H ){ y := 1; k(); } else { y := 2; k(); } pc:H

Steve Zdancewic ESOP0122 Naive CPS let k = (). z := 3; //z:int H if0 (x:int H ){ y := 1; k(); } else { y := 2; k(); } pc:H

Steve Zdancewic ESOP0123 Linear Continuations let k = (). z := 3; //z:int H if0 (x:int H ){ y := 1; k(); } else { y := 2; k(); } k is used linearly!

Steve Zdancewic ESOP0124 Main Idea Use linear continuations to express the control-flow properties of the source language via types But...not quite enough

Steve Zdancewic ESOP0125 Order of Evaluation Order the continuations are invoked is also important! Can observe the order via side effects So...ordered linear continuations

Steve Zdancewic ESOP0126 What Are They? Linear continuations: First-class postdominators of control flow graph Ordered linear continuations: Encode the control stack

Steve Zdancewic ESOP0127 Target CPS Language Includes regular continuations and ordered linear continuations Careful manipulation of context:  | k n,…,k 1 [pc]  e Ordered list encodes stack

Steve Zdancewic ESOP0128 Noninterference If x:  H |[L]  e : int L  v 1,v 2 :  H (M,e{v 1 /x})  * (M 1,n 1 ) (M,e{v 2 /x})  * (M 2,n 2 ) Then M 1  L M 2 and n 1 = n 2

Steve Zdancewic ESOP0129 Results Formalize ordered linear continuations in the type system Prove that the CPS language enjoys noninterference –Proof hinges on ordering property –First proof for such a rich language Expressive enough as a target

Steve Zdancewic ESOP0131 Other Connections Linearity of control also plays a role in security typed versions of -calculus. [Honda et. al.] Linear control is interesting in its own right