Timed Automata for Security of Real-Time Systems
Total Page:16
File Type:pdf, Size:1020Kb
Downloaded from orbit.dtu.dk on: Sep 25, 2021 Timed Automata for Security of Real-Time Systems Vasilikos, Panagiotis Publication date: 2019 Document Version Publisher's PDF, also known as Version of record Link back to DTU Orbit Citation (APA): Vasilikos, P. (2019). Timed Automata for Security of Real-Time Systems. Technical University of Denmark. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. Users may download and print one copy of any publication from the public portal for the purpose of private study or research. You may not further distribute the material or use it for any profit-making activity or commercial gain You may freely distribute the URL identifying the publication in the public portal If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. Timed Automata for Security of Real-Time Systems Panagiotis Vasilikos Kongens Lyngby 2019 ISSN 0909-3192 Technical University of Denmark Department of Applied Mathematics and Computer Science Matematiktorvet, building 303B, 2800 Kongens Lyngby, Denmark Phone +45 4525 3351 [email protected] www.compute.dtu.dk Summary (English) Ensuring information security is a fundamental problem in computing environments of modern society. Information flow theory provides key techniques for guaranteeing that certain information security goals are met by a computing system. However, the fo- cus of the researchers has been mainly around the security of programming languages, whereas, little effort has been put in the security analysis of cyber-physical systems (CPS) and internet of things (IoT) devices. CPS and IoT involve computations which have unstructured control flow and can be both data- and continuous time-dependent, making the programming language approaches inadequate. This thesis makes a break- through to the problem of information security in such systems. To this end, we model systems using timed automata, a formalism that has established itself for analyzing safety properties of CPS and IoT devices. We then leverage ap- proaches from the theory of information flow, and we develop novel techniques for both the qualitative, and the quantitative security analysis of our models. Our main contributions include • the development of a language, whose semantics is given using timed automata, and a sound type system, which enforces a non-interference security condition on programs written in our language. • a sound algorithm which traverses a timed automaton and enforces a non-interference condition, which permits locality-based information release. • a logic for the specification of time- and data-dependent access control policies for networks of timed automata, and techniques for translating policies in our ii logic to a logic which can be handled by standard model-checkers for timed au- tomata such as UPPAAL. We also provide an implementation of our translation. • the first principled information-flow analysis of information leakage on systems that implement the countermeasure clocks with reduced resolution. Our analysis relies on a novel translation of timed automata to information-theoretic channels, which we then use to derive insights into the effectiveness of this countermeasure and the existing attacks that can bypass it. Summary (Danish) At sikre informationssikkerhed er et grundlæggende problem i computermiljøer i det moderne samfund. Informationsteorien indeholder nøgleteknikker til at garantere, at visse informationssikkerhedsmål opfyldes af et computersystem. Forskernes fokus har dog primært været omkring sikkerheden ved programmeringssprog, hvorimod der er gjort en lille indsats i sikkerhedsanalysen af cyber-fysiske systemer (CPS) og inter- net of things- (IoT) enheder. CPS og IoT involverer beregninger, der har ustruktureret kontrolstruktur og kan være både afhængig af data og kontinuerlig tid, hvilket gør pro- grammeringssprogtilgangene utilstrækkelige. Denne afhandling gør et gennembrud i problemet med informationssikkerhed i sådanne systemer. Med henblik herpå modellerer vi systemer ved hjælp af tidsautomater, en formalisme, der er etableret til at analysere sikkerhedsegenskaber for CPS og IoT-enheder. Vi ud- nytter derefter tilgange fra informationsteorien, og vi udvikler nye teknikker til både den kvalitative og den kvantitative sikkerhedsanalyse af vores modeller. Vores vigtigste bidrag inkluderer • udviklingen af et sprog, hvis semantik er givet ved hjælp af tidsautomater, og et korrekt typesystem, der håndhæver en ikke-interferens-sikkerhedsbetingelse på programmer skrevet i vores sprog. • en korrekt algoritme, der gennemløber en tidsautomat og håndhæver en ikke- interferensbetingelse, som tillader lokalitetsbaseret informationsfrigivelse. • en logik til specifikation af tids- og datafhængige adgangskontrolpolitikker for netværk med tidsautomater, og teknikker til at oversætte politikker i vores logik iv til en logik, der kan håndteres af standardmodeltjekkere for tidsautomater som UPPAAL. Vi leverer også en implementering af vores oversættelse. • den første systematiske information flow-analyse af informationslækage på sy- stemer, der implementerer modforanstaltningsurene med reduceret opløsning. Vores analyse er afhængig af en ny oversættelse af tidsautomater til informa- tionsteoretiske kanaler, som vi derefter bruger til at udlede indsigt i effektiviteten af denne modforanstaltning og de eksisterende angreb, der kan omgå den. Preface This thesis was prepared at the department of Applied Mathematics and Computer Science at the Technical University of Denmark in fulfillment of the requirements for acquiring a PhD degree in Computer Science. The research has been performed under the supervision of Professor Hanne Riis Niel- son and Professor Flemming Nielson in the period from September 2016 to August 2019. The core of the developments presented in this thesis are based on four published pa- pers. In particular, Chapter 3, Chapter 4, Chapter 5 and Chapter 6 are based on the publications of [NNV17], [VNN18], [VNN17] and [VNNK] respectively. Lyngby, 31-August-2019 Panagiotis Vasilikos vi Acknowledgements I am especially grateful to my supervisors Hanne Riis Nielson and Flemming Nielson for their constant support, guidance and teaching through those years. Thanks to them, I am the researcher who I am today, and without them, this thesis would have not been possible. I would also like to thank Boris Köpf for being my supervisor during my external research stay at IMDEA Software. His work on quantitative information flow has been really inspiring, and our collaboration has been beneficial for my career. I would also like to thank my assessment committee Michael Reichhardt Hansen, Luca Vigano and Luca Aceto for their valuable comments on this work. Being part of the formal methods section at DTU has been a rewarding and fun experi- ence. I am thankful to all the people who shared the office, had lunches and discussions with me. My special thanks go to Alberto Lluch Lafuente for his priceless support. On a personal note, I want to thank all of my friends in Copenhagen, and especially my girlfriend Sonia for our special moments, which made me forget and overcome my research frustrations. Most importantly, I want to thank my sister Sofia and my parents Pantazis and Kariofyllia, for their love, constant support and always believing in me. viii Contents Summary (English) i Summary (Danish) iii Preface v Acknowledgements vii 1 Introduction 1 2 Information Flow Theory 5 2.1 Access Control ............................. 6 2.2 Non-Interference ............................ 9 2.3 Declassification ............................. 13 2.4 Quantitative Information Flow ..................... 15 3 A Type System for Non-Interference 19 3.1 Timed Automata ............................ 20 3.1.1 Timed Automata Semantics .................. 23 3.2 Non-Interference in Timed Automata .................. 25 3.3 Timed Commands ............................ 27 3.4 Type System ............................... 30 3.5 Adequacy ................................ 36 3.6 Related Work .............................. 37 3.7 Conclusions ............................... 38 4 Secure Locality-Based Declassification 39 4.1 Modelling the Smart Grid System ................... 40 4.2 Y -Bisimulation Security ........................ 43 x CONTENTS 4.3 Post-Dominators ............................ 46 4.4 Algorithm for Secure Declassification ................. 48 4.5 Related Work .............................. 54 4.6 Conclusions ............................... 55 5 Data- and Time- Dependent Policy-Based Access Control 57 5.1 Networks of Timed Automata ..................... 59 5.2 Information Flow Instrumented Semantics ............... 61 5.2.1 Behaviours ........................... 61 5.2.2 Operational Semantics ..................... 62 5.3 Access Control in BTCTL ....................... 64 5.3.1 The Syntax ........................... 65 5.3.2 Semantics of the BTCTL Formulas .............. 66 5.4 Reduction of BTCTL to TCTL+ ................... 68 5.4.1 Behaviour Automata ...................... 70 5.4.2 Trace Equivalence ....................... 71 5.4.3 TCTL+ ............................. 74 5.4.4 Reduction Complexity ..................... 76 5.5 The Translator .............................