Technology Category
Constraint Satisfaction and Optimization: Satisfiability Modulo TheoriesMultiagent Systems: Mechanism DesignKnowledge Representation and Reasoning: Computational Complexity of Reasoning
Generalized Security-Preserving Refinement for Concurrent Systems
🤖 AI Summary
Verifying compliance of concurrent systems—particularly multicore OS kernels—with complex information-flow security (IFS) policies remains challenging due to the difficulty of establishing rigorous, compositional security guarantees under concurrency.
Method: This paper proposes a generalized security-preserving refinement method that introduces *gait mapping*, a mechanism establishing fine-grained stepwise correspondence between concrete and abstract executions. For the first time, it extends security refinement to concurrent settings supporting higher-order, compositional security properties—including nontransitive noninterference. A formal framework is built in Isabelle/HOL, unifying the modeling of refinement relations and IFS policies to enable fully mechanized reasoning.
Contribution/Results: The approach is validated on two nontrivial case studies: (i) it formally reproduces and verifies the previously overlooked single-core covert channel flaw in the ARINC 653 multicore standard; and (ii) it rigorously proves the correctness of the proposed mitigation mechanism.
Technology Category
Application Category
📝 Abstract
Ensuring compliance with Information Flow Security (IFS) is known to be challenging, especially for concurrent systems with large codebases such as multicore operating system (OS) kernels. Refinement, which verifies that an implementation preserves certain properties of a more abstract specification, is promising for tackling such challenges. However, in terms of refinement-based verification of security properties, existing techniques are still restricted to sequential systems or lack the expressiveness needed to capture complex security policies for concurrent systems. In this work, we present a generalized security-preserving refinement technique, particularly for verifying the IFS of concurrent systems governed by potentially complex security policies. We formalize the IFS properties for concurrent systems and present a refinement-based compositional approach to prove that the generalized security properties (e.g., intransitive noninterference) are preserved between implementation and abstraction. The key intuition enabling such reasoning, compared to previous refinement work, is to establish a step-mapping relation between the implementation and the abstraction, which is sufficient to ensure that every paired step (in the abstraction and the implementation, respectively) is either permitted or prohibited by the security policy. We apply our approach to verify two non-trivial case studies against a collection of security policies. Our proofs are fully mechanized in Isabelle/HOL, during which we identified that two covert channels previously reported in the ARINC 653 single-core standard also exist in the ARINC 653 multicore standard. We subsequently proved the correctness of the revised mechanism, showcasing the effectiveness of our approach.
Problem
Research questions and friction points this paper is trying to address.
Verifying Information Flow Security in concurrent systems with complex policies
Developing refinement techniques for security preservation in concurrent implementations
Addressing limitations of existing methods restricted to sequential systems
Innovation
Methods, ideas, or system contributions that make the work stand out.
Generalized refinement technique for concurrent systems
Step-mapping relation between implementation and abstraction
Mechanized proofs in Isabelle/HOL for security verification
🔎 Similar Papers
No similar papers found.
