Towards an SMT-based approach for Quantitative Information Flow

INTRODUCTION
THE APPROACH
CONCLUSION
Towards an SMT-based approach for Quantitative
Information Flow
Quoc-Sang Phan Pasquale Malacaria
Queen Mary, University of London
November 29, 2012
1 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
Outline
1 INTRODUCTION
2 THE APPROACH
QIF as a #SMT problem
A #DPLL(T ) for QIF
Symbolic Execution as #DPLL(T )
Soundness and Completeness
Experiment
3 CONCLUSION
2 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
Contributions
1 Introduction of a new research problem: #SMT, and its
applications to QIF and Symbolic Execution.
2 A framework, called #DPLL(T ), to build a solver for
#SMT-based QIF.
3 We show that Symbolic Execution analysis can be view as
#SMT solver.
4 Two prototyping tools for QIF: sqifc employs CBMC and
jpf-qif is built on top of Symbolic Pathﬁnder.
5 Experiment of the tools on non-trivial case studies, with
dramatic improvement of performance compared with
existing tools.
3 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
Quantitative Information Flow Analysis
Channel Capacity
∆F (H) = F(H) − F(H|L) ≤ log2(N)
Lagrange multipliers and maximum information leakage
in diﬀerent observational models. Malacaria and Chen
(PLAS 2008)
On the Foundations of Quantitative Information Flow.
Smith (FOSSACS 2009).
4 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
Challenge
f : D → Do
N = 0
for all v in Do do
if (assert O != v is violated) then
N ← N + 1
end if
end for
return N
Figure: Exhaustive counting of outputs of a program f
5 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
STATE OF THE ART
Existing techniques:
DisQuant: Backes et al. S&P 2009.
Employ model checking to compute an equivalence relation R.
If R is in linear integer inequalities A¯x ¯b (bounded integer
polytope), then use Barvinok algorithm to count.
selfcomp: Heusser and Malacaria. ACSAC 2010.
Exploit assume-guarantee reasoning to extend self-composition.
Applied to programs in Linux kernel.
6 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
The #SMT problem
The SMT problem
Satisﬁability Modulo Theories (SMT) is a decision problem for
logical formulas w.r.t. combinations of background theories T
expressed in classical ﬁrst-order logic with equality.
Boolean abstraction BA(ϕ): a bijective function that
maps Boolean atoms into themselves.
maps non-Boolean T -atoms into fresh Boolean atoms.
7 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
The #SMT problem
ϕ := {¬(x + y > 1) ∨ A1}
∧ {(x + y > 1) ∨ ¬A2}
∧ {¬A3 ∨ (y − z < 7)}
BA(ϕ) := {¬B1 ∨ A1}
∧ {B1 ∨ ¬A2}
∧ {¬A3 ∨ B2}
The #SMT problem
Propositional abstract model counting or #SMT is the problem of
computing the number of boolean abstraction of models for a
given logical formula.
- The number of boolean abstraction of the models is always ﬁnite.
- #SMT solver: #SAT solver + T -solvers.
8 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
The #SMT problem
ϕ := {¬(x + y > 1) ∨ A1}
∧ {(x + y > 1) ∨ ¬A2}
∧ {¬A3 ∨ (y − z < 7)}
BA(ϕ) := {¬B1 ∨ A1}
∧ {B1 ∨ ¬A2}
∧ {¬A3 ∨ B2}
The #SMT problem
Propositional abstract model counting or #SMT is the problem of
computing the number of boolean abstraction of models for a
given logical formula.
- The number of boolean abstraction of the models is always ﬁnite.
- #SMT solver: #SAT solver + T -solvers.
9 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
A set of boolean variables Φ := {p1, p2, .., pM}, in which each pi
corresponds to a bit bi of the output O.
Without any constraints: Φ represents 2M possible values.
With the constraints from program P: Φ represents N
possible values (possible outputs of the program).
10 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
P can be encoded into a logical formula ϕ w.r.t. theories T .
Each pi is a boolean abstraction of the T -atom expressing the
constraints on bit bi → QIF is a #SMT problem.
Program ←→ Logical formula
Model checker ←→ T -solver
11 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
An example
base = 8;
if (H < 16) then
O = base + H
else
O = base
end if
Figure: Data sanitization program
H is in [0..15].
O is in [8..23].
12 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
Symbolic Quantitative Information Flow
UNSAT
p1
p1 ∧ p2
p1 ∧ p2 ∧ p3
p1 ∧ p2 ∧ p3 ∧ p4
p1 ∧ p2 ∧ p3 ∧ p4 ∧ p5p1 ∧ p2 ∧ p3 ∧ p4 ∧ ¬p5
p1
p2
p3
p4
p5
assert !(p1 && p2 && p3 && p4 && p5);
13 / 32

A #DPLL(T ) for QIF
1: function SymCount(Φ, Ψ, N, pc, i)
2: Extract pi from Φ
3: pc1 ← pc ∧ pi
4: if (T -solver(pc1)) then
5: if (i == M) then
6: Ψ ← Ψ ∪ {pc1}
7: N ← N + 1
8: else
9: SymCount(Φ, Ψ, N, pc1, i + 1)
10: end if
11: end if
12: pc2 ← pc ∧ ¬pi
13: . . .
14: end function
Figure: Symbolic counting for QIF

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
Symbolic Execution as a #SMT solver
If a program is encoded as a logical formula, e.g. Static Single
Assignment form, then a Symbolic Execution tool is a #SMT
solver for this formula.
15 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
if (x > 1) y = x < 5 ? x + 10 : x ; else y = 0 ;
C1 as (x > 1).
C2 as (x < 5).
A1 as (y1 = x + 10).
A2 as (y2 = x).
A3 as (y3 = 0).
C1 ∧ (C2 ∧ A1 ∨ ¬C2 ∧ A2) ∨ ¬C1 ∧ A3
There are 4 models
{C1 ∧ C2, C1 ∧ ¬C2, ¬C1 ∧ C2, ¬C1 ∧ ¬C2}
16 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
O =



f1(i1, i2.., iM) if pc1
f2(i1, i2.., iM) if pc2
. . . . . .
fN(i1, i2.., iM) if pcN



Where:
∀i, j ∈ [1, N] ∧ i = j, pci ∧ pcj = ⊥
17 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
pc c : execute then path
→ unit propagation
pc ¬c : execute else path
→ unit propagation
(pc c) ∧ (pc ¬c)
then path: pc1 = pc ∧ c
else path: pc2 = pc ∧ ¬c
→ branching
18 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
SQIF-SE: SQIF by Symbolic Execution
base = 8;
if (H < 16) then
O = base + H
else
O = base
end if
for all element bi in vector bvo do
if (bi == 1) then
pi = True
else
pi = False
end if
end for
Figure: Additional conditions
19 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
base = 8;
if (H < 16) then
O = base + H
else
O = base
end if
for all element bi in vector bvo do
if (bi == 1) then
pi = True
else
pi = False
end if
end for
Figure: Additional conditions
20 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
s1
s2 s3
p1
p1
p2 p2
H ≥ 16
pc := (H 16)
H < 16
pc := (H ≥ 16)<
pc ∧ p1 pc ∧ p1
pc ∧ p1 ∧ p2
pc ∧ p1 ∧ ¬p2
(H ≥ 16) and (H < 16): program conditions.
p1, p2, ..: additional conditions.
21 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
Theoretically, the SQIF approach is both sound and complete.
1 In reality, SQIF is sound and complete with small leaks.
2 SQIF-SE is sound and complete with bounded model of
program.
Does it leak more than k?
Quantifying information leaks in software. ACSAC 2010.
Heusser and Malacaria.
With user policy k, SQIF may not be complete but the result of
secure/insecure is always sound.
22 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
Theoretically, the SQIF approach is both sound and complete.
1 In reality, SQIF is sound and complete with small leaks.
2 SQIF-SE is sound and complete with bounded model of
program.
Does it leak more than k?
Quantifying information leaks in software. ACSAC 2010.
Heusser and Malacaria.
With user policy k, SQIF may not be complete but the result of
secure/insecure is always sound.
23 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
Experiment
Two prototyping tools:
jpf-qif
tool for Java and also developed in Java.
built on top of Symbolic Pathﬁnder (Symbolic Execution
extension of Java Pathﬁnder).
sqifc
tool for C and also develped in C.
built on top of CBMC (Bounded Model Checking tool for C).
Compare with selfcomp (Heusser and Malacaria, ACSAC 2010).
24 / 32

CVE-2011-2208
1 int osf_getdomainname (char __user *name , int namelen)
2 {
3 unsigned len;
4 int i, error;
5
6 error = verify_area(VERIFY_WRITE , name , namelen );
7 if (error)
8 goto out;
9
10 len = namelen;
11 if (namelen > 32)
12 len = 32;
13
14 down_read (& uts_sem );
15 for (i = 0; i < len; ++i) {
16 __put_user( system_utsname .domainname[i], name + i);
17 if ( system_utsname .domainname[i] == ’0’)
18 break;
19 }
20 up_read (& uts_sem );
21 out:
22 return error;
23 }
Figure: arch/alpha/kernel/osf sys.c

CVE-2011-1078
1 static int sco_sock_getsockopt_old (struct socket *sock , int optname ,
2 char __user *optval , int __user *optlen)
3 {
4 struct sock *sk = sock ->sk;
5 struct sco_conninfo cinfo;
6 int len , err = 0;
7 ...
8
9 lock_sock(sk);
10
11 switch (optname) {
12 case SCO_OPTIONS :
13 ...
14
15 case SCO_CONNINFO :
16 ...
17
18 cinfo.hci_handle = sco_pi(sk)->conn ->hcon ->handle;
19 memcpy(cinfo.dev_class , sco_pi(sk)->conn ->hcon ->dev_class , 3);
20
21 len = min_t(unsigned int , len , sizeof(cinfo ));
22 if ( copy_to_user (optval , (char *)& cinfo , len ))
23 err = -EFAULT;
24 break;
25 ...
26 }
27
28 release_sock (sk);
29 return err;
30 }
Figure: net/bluetooth/sco.c

Cyclic Redundancy Check
1 unsigned char GetCRC8( unsigned char check ,
2 unsigned char ch)
3 {
4 int i, sft ;
5 for ( i = 0 ; i < 8 ; i++ ) {
6 if ( check & 0x80 ) {
7 check < <=1;
8 if ( ch & 0x80 ) {
9 check = check | 0x01;
10 } else {
11 check =check & 0xfe;
12 }
13 check = check ^ 0x85;
14 } else {
15 check <<=1;
16 if ( ch & 0x80 ) {
17 check = check | 0x01;
18 } else {
19 check = check & 0xfe;
20 }
21 }
22 ch < <=1;
23 }
24 check >>= sft;
25 return check;
26 }
Figure: Cyclic Redundancy Check

Tax Record
taxPayer1
taxRecord1
*
checker1
1
server1
1*
taxRecords
TaxRecord
<<interface>>
TaxRecord4taxPayer
getTaxes(): int
getAmountPayed(): int
payTaxes(don:int, amnt:int)
<<interface>>
TaxRecord4taxChecker
verifyPayment(): int
freeze(): int
TaxPayer
TaxChecker
checkTaxes(tr:TaxRecord4taxChecker): int
Charity
<<interface>>
TaxServer4charity
getCharity(): int
TaxServer
Figure: The tax program
taxChecker1: income × F% + donation > payment
taxChecker2: income × F% + donation − payment
jpf-qif: chanel capacity of 4.86 bits

INTRODUCTION
THE APPROACH
CONCLUSION
A #DPLL(T ) for QIF
Experiment
DEMO
29 / 32

Case Study LoC Language sqifc jpf-qif selfcomp
Data
Sanitization
< 10 C/Java 28.179 20.695 timed
out
CVE-2011-2208
(64)
> 200 C 22.759 × 119.117
CVE-2011-2208
(256)
C 88.196 × timed
out
CVE-2011-1078
(8)
> 200 C 10.380 × 13.853
CVE-2011-1078
(64)
C 37.899 × timed
out
CRC (8) < 30 C/Java 1.209 8.386 0.498
CRC (32) C/Java 8.657 9.357 timed
out
Tax Record 267 Java × 24.988s ×
Figure: Times in seconds for all case studies, timeout is 30 minutes

INTRODUCTION
THE APPROACH
CONCLUSION
Conclusions
1 Introduction of a new research problem: #SMT, and its
applications to QIF and Symbolic Execution.
2 A framework, called #DPLL(T ), to build a solver for
#SMT-based QIF.
3 The methodology of Symbolic Execution re-casted as
#DPLL(T ).
4 Two prototyping tools for QIF: sqifc and jpf-qif.
5 Experiment of the tools on non-trivial case studies.
31 / 32

INTRODUCTION
THE APPROACH
CONCLUSION
THANK YOU FOR YOUR ATTENTION!
32 / 32

Towards an SMT-based approach for Quantitative Information Flow

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (18)

Similar to Towards an SMT-based approach for Quantitative Information Flow

Similar to Towards an SMT-based approach for Quantitative Information Flow (20)

Recently uploaded

Recently uploaded (20)

Towards an SMT-based approach for Quantitative Information Flow