Analysing the Security Properties of Object-Capability Patterns

Analysing the Security Properties of Object-Capability Patterns Toby Murray Hertford College Oxford University Computing Laboratory A thesis submitted for the degree of Doctor of Philosophy Hilary Term, 2010 This thesis is dedicated to Bel, who has taught me more than anyone else. Acknowledgements Thanks firstly to my supervisor, Gavin Lowe, whose conscientious and dedicated supervision of this work improved it, and its presentation, more than I can say, and whose wisdom and guidance were invaluable throughout this entire process. I couldn't have asked for a better supervisor. Gavin also contributed directly to the development of valuable parts of this work, as explained in the statement of authorship that follows. Thanks to Fred Spiessens and Bill Roscoe for examining this thesis. Thanks to Andrew Simpson and Bill Roscoe for their advice and feedback on this work as it progressed during my transfer and confirmation of status. Thanks to Bill Roscoe for valuable discussions about CSP and to Fred Spiessens for the same regarding Scoll and authority. Thanks to the anonymous reviewers of [ML09b] and [ML09a], and those at NICTA, whose feedback helped to improve the presentation in Chapter5. Thanks to David Wagner for useful discussions about authority and causation that ultimately influenced the work in Chapter7, and for indirectly bringing to my attention the need to consider vulnerabilities due to recursive invocation. Thanks to Bill Frantz, David-Sarah Hopwood, Matej Koˇs´ık, Charles Landau, Alex Murray, Mark Seaborn and David Wagner, who helped me assemble Table 2.1. Thanks to all of the people on cap-talk and e-lang, including Mark Miller and Jonathan Shapiro, and all of my old workmates from DSTO's Annex project. You have greatly influenced my thinking about capability systems and have undoubtedly influenced the work contained in this thesis. My greatest thanks to Duncan Grove and Chris North, and also to Dave Munro, Rob Esser, Ed Lowrey and Ken Yiu, for encouraging and facilitating me to undertake this doctorate. Thanks so much to my family and friends, both in Oxford and back home, for their love and support. Thanks especially to Mark Larsen, whose friendship helped make Oxford home. Thanks finally to my wife, Bel, for her unwavering support during times of crisis, and her sacrifice throughout this adventure. She knew from the beginning that Oxford was the place to be. This work was supported by a John Crampton Travelling Scholarship, for which I am extremely grateful. Statement of Authorship The following parts of this thesis contain work carried out jointly with my supervisor, Gavin Lowe. • The use and form of the PosConjEqT safe abstraction of the Trade- marks guard object, which appears in Section 4.1.3, was conceived by Gavin Lowe. • Gavin Lowe also conceived the technique used to model and analyse the Membrane in the concurrent context, which appears in Section 4.3.4. • The proofs of Lemmas 5.3.6 and 5.3.7 were adapted from a proof that was co-written with Gavin Lowe and appears in [ML07]. • The basic structure of the refinement check for testing weakened refinement-closed noninterference properties, which appears in Sec- tion 5.3.3, was conceived by Gavin Lowe. This work also appears in [ML09b]. • The proof of Theorem 5.5.3 is a simple generalisation of a proof that was conceived by Gavin Lowe. This work also appears in [ML09a]. • The proof of Lemma A.0.6 is a simple extension of a proof that was co-written with Gavin Lowe and appears in [ML07]. Analysing the Security Properties of Object-Capability Patterns Toby Murray Hertford College University of Oxford A thesis submitted for the degree of Doctor of Philosophy Hilary Term, 2010 The object-capability model is an increasingly popular architecture for build- ing secure software systems. This model promotes the construction of reusable patterns for enforcing security properties within object-capability systems. In this thesis, we apply the process algebra CSP, and its automatic refinement-checker FDR, to analyse object-capability patterns and prove whether they uphold the security properties they are designed to en- force. We show how CSP can accurately model object-capability systems and patterns, and express their wide variety of features. We show that complex safety properties of object-capability patterns can be reasoned about by encoding them as CSP refinement checks for FDR. This enables one to detect vulnerabilities automatically in patterns due to concurrent and recursive invocation. We show that CSP's theory of data-independence can be applied to al- low one to generalise the results obtained from analysing small fixed-sized systems, to systems of arbitrary size. We show how to reason about the information flow properties of object- capability patterns. We argue that in order to do so sensibly, one must make the assumption that objects can directly influence each other only through their overt interactions together. We show how traditional noninterference properties can be adapted to take this assumption into account, and how they can then be tested with FDR. We consider how to reason about liveness properties of object-capability patterns under necessary fairness assumptions. We prove that such properties cannot always be expressed as CSP refinement checks for FDR, making them impossible for FDR to test precisely, but how FDR can be applied to reason about them by testing sufficient conditions for them instead. To reason about authority, we develop a framework for expressing gen- eral non-causation properties and show how it can capture various kinds of authority, as well as the notions of defensive correctness and defensive con- sistency. We show that, for deterministic systems, non-causation of safety effects can be expressed as refinement checks in CSP models that FDR can support. However, for nondeterministic systems, we prove that even certain simple non-causation properties cannot be precisely captured this way. Engineers in established fields use applied mathematics to predict the behavior and properties of their designs with great accuracy. Software engineers, despite the fact that their cre- ations exhibit far more complexity than physical systems, do not generally do this and the practice of the discipline is still at the pre-scientific or craft stage. [T]he applied mathematics of software is formal logic, and calculating the behavior of software is an exercise in theorem proving. Just as engineers in other dis- ciplines need the speed and accuracy of computers to help them perform their engineering calculations, so software engineers can use the speed and accuracy of computers to help them prove the . theorems required to predict the behavior of software. John Rushby [Rus89]. Contents 1 Introduction1 1.1 The Problem...........................1 1.2 Our Approach...........................2 1.3 Contribution and Thesis Organisation.............3 2 Preliminaries6 2.1 CSP................................6 2.1.1 Syntax...........................6 2.1.2 Notation..........................8 2.1.3 Semantics.........................9 2.1.4 Verifying Properties of CSP Processes......... 12 2.2 The Object-Capability Model.................. 13 2.2.1 Current Object-Capability Systems........... 14 2.3 Modelling Object-Capability Systems in CSP......... 17 2.3.1 System Model....................... 17 2.3.2 An Example System................... 20 2.3.3 Modelling Trusted Objects............... 21 2.3.4 Non-Blocking Communication.............. 23 2.3.5 Single-Threaded Systems................ 24 2.3.6 Data Independence.................... 26 3 Safety 30 3.1 Safe Authenticating Trademarks................ 30 3.1.1 Deriving a Safe Implementation............. 31 3.1.2 Summary......................... 39 3.2 Safe Coercing Sealer-Unsealers................. 39 3.2.1 Deriving a Safe Implementation............. 40 3.3 Related Work........................... 50 3.4 Conclusion............................ 52 4 Analysing Systems of Arbitrary Size 54 4.1 Generalising Previous Results.................. 54 4.1.1 Safe Abstraction and Aggregation........... 56 4.1.2 Aggregation via Untrusted Objects........... 58 4.1.3 Data-Independence on Aggregated Identities..... 62 4.1.4 Concluding the Trademarks Safety Analysis...... 67 4.1.5 Generalising the Sealer-Unsealer Safety Analysis... 69 4.1.6 Summary......................... 70 4.2 Handling Object Creation.................... 71 4.2.1 Implicit Object Creation via Aggregation....... 71 4.3 Safe Revocable Membranes................... 72 4.3.1 The Membrane Pattern................. 72 4.3.2 Revocable Membranes.................. 74 4.3.3 The Single-Threaded Case................ 76 4.3.4 The Concurrent Case.................. 79 4.3.5 Summary......................... 86 4.4 Related Work........................... 86 4.5 Conclusion............................ 90 5 Information Flow 92 5.1 Introduction............................ 92 5.2 Defining Information Flow for Object-Capability Patterns.. 94 5.2.1 Refinement........................ 94 5.2.2 A Necessary Assumption................ 96 5.2.3 A Definition........................ 96 5.3 Testing Information Flow for Object-Capability Patterns... 97 5.3.1 Choosing an Appropriate Property........... 98 5.3.2 Deriving a Testable Characterisation.......... 103 5.3.3 Deriving an Automatic Test............... 110 5.4 Applying the Test........................ 114 5.4.1 Modelling the Data-Diode Implementation...... 115 5.4.2 Analysing the Data-Diode Implementation...... 116 5.4.3 Fixing the Data-Diode Implementation.......

Load more