Approximation and randomization for quantitative information-FLOW analysis

Proceedings - IEEE Computer Security Foundations Symposium

Volumn , Issue , 2010, Pages 3-14

  Köpf, Boris ^a   Rybalchenko, Andrey ^b  

^a MAX PLANCK INSTITUTE FOR SOFTWARE SYSTEMS   (Germany)

^b TUM ^*  (United States)

Author keywords

[No Author keywords available]

Indexed keywords

AUTOMATED TECHNIQUES; PROGRAM EXECUTION; PROGRAM SECURITY; QUANTITATIVE INFORMATION; RANDOMIZATION TECHNIQUES; SAMPLING METHOD; STATIC AND DYNAMIC;

DATA STRUCTURES; INFORMATION THEORY; SECURITY SYSTEMS; STRUCTURED PROGRAMMING;

DYNAMIC ANALYSIS;

EID: 77957604761     PISSN: 19401434     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CSF.2010.8     Document Type: Conference Paper

References (46)

1. M. Backes, B. Köpf, and A. Rybalchenko. Automatic Discovery and Quantification of Information Leaks. In Proc. IEEE Symp. on Security and Privacy (S&P '09), pages 141-153. IEEE, 2009.
2. R. Bagnara, P. M. Hill, and E. Zaffanella. The Parma Polyhedra Library: Toward a complete set of numerical abstractions for the analysis and verification of hardware and software systems. Science of Computer Programming, 72(1-2), 2008.
3. T. Ball, R. Majumdar, T. Millstein, and S. Rajamani. Automatic predicate abstraction of C programs. In Proc. ACM Conf. on Programming Language Design and Implementation (PLDI '01), pages 203-213. ACM, 2001.
4. T. Ball, T. D. Millstein, and S. K. Rajamani. Polymorphic predicate abstraction. ACM Trans. Program. Lang. Syst., 27(2), 2005.
5. A. Banerjee, D. A. Naumann, and S. Rosenberg. Expressive declassification policies and modular static enforcement. In Proc. IEEE Symp. on Security and Privacy (S&P '08), pages 339-353. IEEE, 2008.
6. G. Barthe, P. D'Argenio, and T. Rezk. Secure information flow by self-composition. In Proc. IEEE Computer Security Foundations Workshop (CSFW '04), pages 100-114. IEEE, 2004.
7. A. Barvinok. A Polynomial Time Algorithm for Counting Integral Points in Polyhedra when the Dimension is Fixed. Mathematics of Operations Research, 19:189-202, 1994.
8. T. Batu, S. Dasgupta, R. Kumar, and R. Rubinfeld. The complexity of approximating entropy. In Proc. ACM Symp. on Theory of Computing (STOC '02), pages 678-687. ACM, 2002.
9. B. Blanchet, P. Cousot, R. Cousot, J. Feret, L. Mauborgne, A. Miné, D. Monniaux, and X. Rival. A static analyzer for large safety-critical software. In Proc. ACM Conf. on Programming Language Design and Implementation (PLDI'03), pages 196-207. ACM, 2003.
10. D. Brumley, C. Hartwig, M. G. Kang, Z. Liang, J. Newsome, P. Poosankam, and D. Song. BitScope: Automatically dissecting malicious binaries. Technical Report CS-07-133, School of Computer Science, Carnegie Mellon University, 2007.
11. D. Brumley, J. Newsome, D. Song, H. Wang, and S. Jha. Theory and techniques for automatic generation of vulnerabilitybased signatures. IEEE Trans. Dependable Sec. Comput., 5(4):224-241, 2008.
12. C. Cachin. Entropy Measures and Unconditional Security in Cryptography. PhD thesis, ETH Zürich, 1997.
13. C. Cadar, D. Dunbar, and D. R. Engler. KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In Proc. USENIX Symp. on Operating Systems Design and Implementation (OSDI '08), pages 209- 224. USENIX, 2008.
14. D. Clark, S. Hunt, and P. Malacaria. Quantitative Information Flow, Relations and Polymorphic Types. J. Log. Comput., 18(2):181-199, 2005.
15. D. Clark, S. Hunt, and P. Malacaria. A static analysis for quantifying information flow in a simple imperative language. Journal of Computer Security, 15(3):321-371, 2007.
16. M. R. Clarkson, A. C. Myers, and F. B. Schneider. Belief in Information Flow. In Proc. IEEE Computer Security Foundations Workshop (CSFW '05), pages 31-45. IEEE, 2005.
17. E. Cohen. Information Transmission in Sequential Programs. In Foundations of Secure Computation, pages 297-335. Academic Press, 1978.
18. B. Cook, A. Gupta, S. Magill, A. Rybalchenko, J. Simsa, and V. Vafeiadis. Finding heap-bounds for hardware synthesis. In Proc. Intl. Conf. on Formal Methods in Computer-Aided Design (FMCAD '09), pages 205-212. IEEE, 2009.
19. P. Cousot and R. Cousot. Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints. In Proc. ACM Symp. on Principles of Programming Languages (POPL '77), pages 238-252. ACM, 1977.
20. P. Cousot and N. Halbwachs. Automatic discovery of linear restraints among variables of a program. In Proc. ACM Symp. on Principles of Programming Languages (POPL '78), pages 84-96. ACM, 1978.
21. D. E. Denning. Cryptography and Data Security. Addison-Wesley, 1982.
22. R. Giacobazzi and I. Mastroeni. Abstract Non-Interference: Parameterizing Non-Interference by Abstract Interpretation. In Proc. ACM Symp. on Principles of Programming Languages (POPL '04), pages 186-197. ACM, 2004.
23. P. Godefroid. Software model checking: The VeriSoft approach. Formal Methods in System Design, 26(2):77-101, 2005.
24. P. Godefroid, N. Klarlund, and K. Sen. DART: directed automated random testing. In Proc. ACM Conf. on Programming Language Design and Implementation (PLDI '05), pages 213-223. ACM, 2005.
25. J. W. Gray. Toward a Mathematical Foundation for Information Flow Security. Journal of Computer Security, 1(3- 4):255-294, 1992.
26. S. Gulwani, S. Jain, and E. Koskinen. Control-flow refinement and progress invariants for bound analysis. In Proc. ACM Conf. on Programming Language Design and Implementation (PLDI '09), pages 375-385. ACM, 2009.
27. T. A. Henzinger, R. Jhala, R. Majumdar, and K. L. McMillan. Abstractions from proofs. In Proc. ACM Symp. on Principles of Programming Languages (POPL '04), pages 232-244. ACM, 2004.
28. B. Jeannet and A. Miné. Apron: A library of numerical abstract domains for static analysis. In Proc. Intl. Conf. on Computer Aided Verification (CAV '09), LNCS 5643, pages 661-667. Springer, 2009.
29. P. Kocher. Timing Attacks on Implementations of Diffie- Hellman, RSA, DSS, and Other Systems. In Proc. Annual Intl. Cryptology Conference (CRYPTO '96), LNCS 1109, pages 104-113. Springer, 1996.
30. B. Köpf and D. Basin. An Information-Theoretic Model for Adaptive Side-Channel Attacks. In Proc. ACM Conf. on Computer and Communications Security (CCS '07), pages 286-296. ACM, 2007.
31. B. Köpf and M. Dürmuth. A Provably Secure and Efficient Countermeasure against Timing Attacks. In Proc. IEEE Computer Security Foundations Symposium (CSF '09), pages 324-335. IEEE, 2009.
32. G. Lalire, M. Argoud, and B. Jeannet. The interproc analyzer. http://pop-art.inrialpes.fr/people/bjeannet/bjeannet-forge/interproc/index.html.
33. V. Laviron and F. Logozzo. Subpolyhedra: A (more) scalable approach to infer linear inequalities. In Intl. Conf. on Verification, Model Checking, and Abstract Interpretation (VMCAI '09), LNCS 5403, pages 229-244. Springer, 2009.
34. J. A. D. Loera, D. Haws, R. Hemmecke, P. Huggins, J. Tauzer, and R. Yoshida. LattE. http://www.math.ucdavis.edu/̃latte/[Online; accessed 08-Nov-2008].
35. G. Lowe. Quantifying Information Flow. In Proc. IEEE Computer Security Foundations Workshop (CSFW '02), pages 18-31. IEEE, 2002.
36. P. Malacaria. Assessing security threats of looping constructs. In Proc. Symp. on Principles of Programming Languages (POPL '07), pages 225-235. ACM, 2007.
37. J. L. Massey. Guessing and Entropy. In Proc. IEEE Intl. Symp. on Information Theory (ISIT '94), page 204. IEEE Computer Society, 1994.
38. S. McCamant and M. D. Ernst. Quantitative information flow as network flow capacity. In Proc. ACM Conf. on Programming Language Design and Implementation (PLDI '08), pages 193-205. ACM, 2008.
39. J. K. Millen. Covert Channel Capacity. In Proc. IEEE Symp. on Security and Privacy (S&P '87), pages 60-66. IEEE, 1987.
40. A. Miné. The Octagon abstract domain. Higher-Order and Symbolic Computation, 19(1):31-100, 2006.
41. J. Newsome, S. McCamant, and D. Song. Measuring channel capacity to distinguish undue influence. In Proc. ACM Workshop on Programming Languages and Analysis for Security (PLAS '09), pages 73-85. ACM, 2009.
42. A. Sabelfeld and A. C. Myers. Language-based Information- Flow Security. IEEE J. Selected Areas in Communication, 21(1):5-19, 2003.
43. A. Sabelfeld and A. C. Myers. A model for delimited information release. In Proc. Intl. Symp. on Software Security (ISSS '03), LNCS 3233, pages 174-191. Springer, 2004.
44. C. E. Shannon. A Mathematical Theory of Communication. Bell System Technical Journal, 27:379-423 and 623-656, July and October 1948.
45. G. Smith. On the foundations of quantitative information flow. In Proc. Intl. Conf. of Foundations of Software Science and Computation Structures (FoSSaCS '09), LNCS 5504, pages 288-302. Springer, 2009.
46. S. Zdancewic and A. C. Myers. Robust declassification. In Proc. IEEE Computer Security Foundations Workshop (CSFW '01), pages 15-23. IEEE, 2001.