Upload
darren-palmer
View
215
Download
0
Embed Size (px)
DESCRIPTION
08/06/073/58 A Protection Mechanism Run-time program monitors Run-time program monitors –Ensure that software dynamically adheres to constraints specified by a security policy Untrusted Target Program Monitor Executing System Open(f,“w”) is OK Open(f,“w”)
Citation preview
08/06/0708/06/07 11/58/58
Runtime Software Runtime Software MonitoringMonitoring
Jay Ligatti, University of South FloridaJay Ligatti, University of South Florida
Joint work with:Joint work with:Lujo Bauer, CMU CyLabLujo Bauer, CMU CyLab
David Walker, Princeton UniversityDavid Walker, Princeton University
08/06/0708/06/07 22/58/58
ProblemProblem Software often behaves Software often behaves
unexpectedlyunexpectedly– BugsBugs– Malicious design (malware)Malicious design (malware)
0100020003000400050006000700080009000
# Vulner-abilities
Reported to CERT
1995 1997 1999 2001 2003 2005
Year [ http://www.cert.org/stats ]
08/06/0708/06/07 33/58/58
A Protection MechanismA Protection Mechanism Run-time program monitorsRun-time program monitors
– Ensure that software dynamically Ensure that software dynamically adheres to constraints specified by a adheres to constraints specified by a security policysecurity policy
UntrustedTarget
ProgramMonitor
ExecutingSystem
Open(f,“w”)is OK
Open(f,“w”) Open(f,“w”)
08/06/0708/06/07 44/58/58
Common Monitor Common Monitor ExamplesExamples
File access controlFile access control FirewallsFirewalls Resource monitorsResource monitors Stack inspectionStack inspection Applet sandboxingApplet sandboxing Bounds checks on input values Bounds checks on input values Security loggingSecurity logging Displaying security warningsDisplaying security warnings Operating systems and virtual Operating systems and virtual
machinesmachines ……
08/06/0708/06/07 55/58/58
Policies Become More Policies Become More Complex…Complex…
As software becomes more sophisticatedAs software becomes more sophisticated(i.e., enters new domains)(i.e., enters new domains)– Multi-user and networked systemsMulti-user and networked systems– Electronic commerceElectronic commerce– Medical databases (HIPAA, EU Data Protection Law)Medical databases (HIPAA, EU Data Protection Law)
08/06/0708/06/07 66/58/58
Policies Become More Policies Become More Complex…Complex…
As software becomes more sophisticatedAs software becomes more sophisticated(i.e., enters new domains)(i.e., enters new domains)– Multi-user and networked systemsMulti-user and networked systems– Electronic commerceElectronic commerce– Medical databases (HIPAA, EU Data Protection Medical databases (HIPAA, EU Data Protection
Law)Law) As we tighten overly relaxed policiesAs we tighten overly relaxed policies
– Insecure default configurations disallowedInsecure default configurations disallowed– Downloading .doc files requires warningDownloading .doc files requires warning
08/06/0708/06/07 77/58/58
Policies Become More Policies Become More Complex…Complex…
As software becomes more sophisticatedAs software becomes more sophisticated(i.e., enters new domains)(i.e., enters new domains)– Multi-user and networked systemsMulti-user and networked systems– Electronic commerceElectronic commerce– Medical databases (HIPAA, EU Data Protection Law)Medical databases (HIPAA, EU Data Protection Law)
As we tighten overly relaxed policiesAs we tighten overly relaxed policies– Insecure default configurations disallowedInsecure default configurations disallowed– Downloading .doc files requires warningDownloading .doc files requires warning
As we relax overly tight policiesAs we relax overly tight policies– All applets sandboxed (JDK 1.0) vs. All applets sandboxed (JDK 1.0) vs.
only only unsignedunsigned applets sandboxed (JDK 1.1) applets sandboxed (JDK 1.1)
08/06/0708/06/07 88/58/58
Research QuestionsResearch QuestionsGiven:Given:
• The prevalence and usefulness of monitorsThe prevalence and usefulness of monitors• The need to enforce increasingly complex policiesThe need to enforce increasingly complex policies
1.1. Which of the policies can monitors enforce?Which of the policies can monitors enforce?• Want to know when and when not to use monitorsWant to know when and when not to use monitors
2.2. How can we conveniently specify the complex How can we conveniently specify the complex policies that monitors can enforce?policies that monitors can enforce?
08/06/0708/06/07 99/58/58
OutlineOutline Motivation and GoalsMotivation and Goals
– Program monitors are useful, so…Program monitors are useful, so…– What are their enforcement powers?What are their enforcement powers?– How can we cope with their complexity?How can we cope with their complexity?
Delineating the enforceable policiesDelineating the enforceable policies Conveniently specifying policies in Conveniently specifying policies in
practicepractice ConclusionsConclusions
08/06/0708/06/07 1010/58/58
Delineating the Delineating the Enforceable PoliciesEnforceable Policies
2. Define monitors and how they enforce policies
1. Define policies on systems
3. Analyze which policies monitors can enforce
08/06/0708/06/07 1111/58/58
Systems and Systems and ExecutionsExecutions
SystemSystem = a state machine that transitions states = a state machine that transitions states by executing by executing actionsactions
We specify a system according to the possibly We specify a system according to the possibly countably infinite set of actions it can executecountably infinite set of actions it can execute AA = { logBegin( = { logBegin(nn), ), (log that ATM is about to dispense $(log that ATM is about to dispense $nn))
dispense( dispense(nn),), (dispense $(dispense $nn)) logEnd( logEnd(nn)) (log that ATM just dispensed $(log that ATM just dispensed $nn)) } }
ExecutionExecution = possibly infinite sequence of actions = possibly infinite sequence of actions logBegin(80); logEnd(80) logBegin(80); logEnd(80) dispense(100); dispense(100); dispense(100); …dispense(100); dispense(100); dispense(100); …
08/06/0708/06/07 1212/58/58
Execution NotationExecution Notation On a system with action set On a system with action set AA,,
AA** = set of all = set of all finitefinite executionsexecutionsAAωω = set of all = set of all infiniteinfinite executionsexecutionsAA∞∞ = set of = set of allall executionsexecutions
Prefix notation: Prefix notation: ss≤≤uu (or (or uu≥≥ss) ) – Means: Means: ss is a finite prefix of possibly is a finite prefix of possibly
infinite infinite uu– Read: Read: ss prefixesprefixes uu (or (or uu extendsextends ss))
08/06/0708/06/07 1313/58/58
PoliciesPolicies A A policypolicy PP is a predicate on executions is a predicate on executions
Execution Execution ss satisfies policy satisfies policy PP if and only if if and only if P P ((ss))– Termination: Termination: P P ((ss) ) ss is finite is finite– Transactional: Transactional: P P ((ss) ) s s is a sequence of valid is a sequence of valid
transactionstransactions
TerminologyTerminology– IfIf P P ((ss) then) then s s is valid, or “good” is valid, or “good”– IfIf P P ((ss) then) then s s is invalid, or “bad” is invalid, or “bad”
08/06/0708/06/07 1414/58/58
Safety and LivenessSafety and Liveness [Lamport ’77; Alpern, Schneider ’85][Lamport ’77; Alpern, Schneider ’85]
Two types of policies have been studied a lotTwo types of policies have been studied a lot
SafetySafety: “Bad executions cannot be made good”: “Bad executions cannot be made good”ssAA∞∞ : : P P ((ss) ) ss’≤’≤ss : : uu≥≥ss’ : ’ : P P ((uu))
– Access-control (cannot “undo” illegal accesses)Access-control (cannot “undo” illegal accesses)
LivenessLiveness: “Finite executions can be made : “Finite executions can be made good”good” ssAA* : * : uu≥≥ss : : P P ((uu))– Termination and nonterminationTermination and nontermination
08/06/0708/06/07 1515/58/58
Delineating the Delineating the Enforceable PoliciesEnforceable Policies
2. Define monitors and how they enforce policies
1. Define policies on systems
3. Analyze which policies monitors can enforce
08/06/0708/06/07 1616/58/58
Operation of Monitors: Operation of Monitors: Accepting an OK ActionAccepting an OK Action
UntrustedTarget
ProgramMonitor
ExecutingSystem
Open(f,“w”)is OK
Open(f,“w”) Open(f,“w”)
Monitor inputs actions from target andoutputs actions to the executing system
Here, input action is safe to execute, somonitor accepts it (makes it observable)
08/06/0708/06/07 1717/58/58
Operation of Monitors: Operation of Monitors: Suppressing an ActionSuppressing an Action
UntrustedTarget
ProgramMonitor
ExecutingSystem
Open(f,“w”)is not OK
Open(f,“w”)
Input action is not safe to execute, so monitor suppresses it and allows target to continue executing
08/06/0708/06/07 1818/58/58
Operation of Monitors: Operation of Monitors: Inserting an ActionInserting an Action
UntrustedTarget
ProgramMonitor
ExecutingSystem
Open(f,“w”)is not OK
Open(f,“w”) Close(f,“w”)
Input action is not safe to execute, so monitor inserts another action, then reconsiders the original action
08/06/0708/06/07 1919/58/58
Modeling MonitorsModeling Monitors[Ligatti, Bauer, Walker ’05][Ligatti, Bauer, Walker ’05]
Model a monitor that can Model a monitor that can accept, suppress, accept, suppress, andand insert insert actions as an actions as an edit automatonedit automaton ((QQ,,qq00,,tt))– QQ is finite or countably infinite set of states is finite or countably infinite set of states– qq00 is initial state is initial state– A complete, deterministic, and TM-decidable A complete, deterministic, and TM-decidable
functionfunctiont : Q x A Q x (A U {●})
currentstate
input(trigger)action
new state
actionto insert
suppresstriggeraction
08/06/0708/06/07 2020/58/58
Operational SemanticsOperational Semantics Transition functions define how monitors behave Transition functions define how monitors behave
on on individualindividual input actions input actions
For the definition of enforcement, we will For the definition of enforcement, we will generalize and consider how monitors transform generalize and consider how monitors transform entireentire input executions input executions
a1;a2;a2;a3;… a1;a2;a2;a4;…Untrusted input Valid output
Monitor
Monitors are execution transformers
08/06/0708/06/07 2121/58/58
Enforcing PoliciesEnforcing Policies[Ligatti, Bauer, Walker ’05][Ligatti, Bauer, Walker ’05]
A monitor A monitor enforcesenforces a policy a policy PP when it is when it is sound sound and and transparent transparent with respect to with respect to PP
SoundnessSoundness: : – Monitors’ outputs (observable executions) must be Monitors’ outputs (observable executions) must be
validvalid
TransparencyTransparency::– Monitors must not alter the semantics of valid inputsMonitors must not alter the semantics of valid inputs– Conservative definition: on any valid input execution Conservative definition: on any valid input execution ss
monitor must output monitor must output ss
08/06/0708/06/07 2222/58/58
Delineating the Delineating the Enforceable PoliciesEnforceable Policies
2. Define monitors and how they enforce policies
1. Define policies on systems
3. Analyze which policies monitors can enforce
08/06/0708/06/07 2323/58/58
Enforcement Powers Enforcement Powers Related WorkRelated Work
Previous work on monitors’ enforcement Previous work on monitors’ enforcement bounds only modeled monitors that accept bounds only modeled monitors that accept actions and halt target actions and halt target [Schneider ’00; Viswanathan [Schneider ’00; Viswanathan ’00; Hamlen, Morrisett, Schneider ’03; Fong ’04]’00; Hamlen, Morrisett, Schneider ’03; Fong ’04]
Enforcing policy meant Enforcing policy meant recognizingrecognizing rather rather than than transformingtransforming executionsexecutions
Result: monitors only enforce safety Result: monitors only enforce safety policiespolicies
08/06/0708/06/07 2424/58/58
Enforcing Properties with Enforcing Properties with Edit AutomataEdit Automata
Modeling realistic ability to Modeling realistic ability to insertinsert and and suppresssuppress actions enables a powerful actions enables a powerful enforcement techniqueenforcement technique– Suppress (feign execution of) potentially bad Suppress (feign execution of) potentially bad
actions, and later, if the suppressed actions are actions, and later, if the suppressed actions are found to be safe, re-insert themfound to be safe, re-insert them
Using this technique, Using this technique, monitors can monitors can sometimes enforce non-safety policiessometimes enforce non-safety policies, , contrary to earlier results and conjecturescontrary to earlier results and conjectures
08/06/0708/06/07 2525/58/58
Example: ATM PolicyExample: ATM Policy ATM must log before and after dispensing ATM must log before and after dispensing
cashcashand may only log before and after dispensing and may only log before and after dispensing cashcash
Valid executions = (logBegin(n); dispense(n); Valid executions = (logBegin(n); dispense(n); logEnd(n))logEnd(n))∞∞
Guarantees that the ATM software generates a proper log whenever it dispenses cash
08/06/0708/06/07 2626/58/58
Example: ATM PolicyExample: ATM Policy ATM must log before and after dispensing ATM must log before and after dispensing
cashcashand may only log before and after dispensing and may only log before and after dispensing cashcash
Valid executions = (logBegin(n); dispense(n); Valid executions = (logBegin(n); dispense(n); logEnd(n))logEnd(n))∞∞
init begun(n) dispensed(n)
logBegin(n) dispense(n)
logEnd(n)insert: logBegin(n);dispense(n);logEnd(n)
(suppress) (suppress)
08/06/0708/06/07 2727/58/58
Example: ATM PolicyExample: ATM Policy ATM must log before and after dispensing cashATM must log before and after dispensing cash
and may only log before and after dispensing cashand may only log before and after dispensing cash
Valid executions = (logBegin(n); dispense(n); logEnd(n))Valid executions = (logBegin(n); dispense(n); logEnd(n))∞∞
Is not a safety policy Is not a safety policy (safety=bad executions can’t be made good)(safety=bad executions can’t be made good):: logBegin(200) by itself is illegal but can be “made good”logBegin(200) by itself is illegal but can be “made good”
Is not a liveness policy Is not a liveness policy (liveness=finite executions can be made good)(liveness=finite executions can be made good):: dispense(200) cannot be “made good”dispense(200) cannot be “made good”
08/06/0708/06/07 2828/58/58
Enforceable Policies Enforceable Policies Renewal PoliciesRenewal Policies
Theorem: Theorem: Except for a technical corner case, edit Except for a technical corner case, edit automata enforce automata enforce exactlyexactly the set of the set of reasonable reasonable infinite renewalinfinite renewal policiespolicies
RenewalRenewal: “Infinite executions are good iff : “Infinite executions are good iff they are good infinitely often”they are good infinitely often”sAω : P(s) {u≤s | P(u)} is an infinite set
08/06/0708/06/07 2929/58/58
Example: ATM PolicyExample: ATM Policy ATM must log before and after dispensing cashATM must log before and after dispensing cash
and may only log before and after dispensing cashand may only log before and after dispensing cash Valid executions = (logBegin(n); dispense(n); logEnd(n))Valid executions = (logBegin(n); dispense(n); logEnd(n))∞∞
This is a renewal policy:This is a renewal policy:– Valid infinite executions have infinitely many valid Valid infinite executions have infinitely many valid
prefixesprefixes– Invalid infinite executions have finitely many valid Invalid infinite executions have finitely many valid
prefixesprefixes Some prefix with multiple of 3 actions ends with a bad Some prefix with multiple of 3 actions ends with a bad
transaction; all successive prefixes are invalidtransaction; all successive prefixes are invalid
08/06/0708/06/07 3030/58/58
Safety, Liveness, Safety, Liveness, RenewalRenewal
Safety Liveness
Renewal
All Policies
1 2
4
3 5
6
1 File access control2 Trivial3 Eventually audits4 ATM transactions5 Termination6 Termination + File access control
08/06/0708/06/07 3131/58/58
OutlineOutline Motivation and GoalsMotivation and Goals
– Program monitors are useful, so…Program monitors are useful, so…– What are their enforcement powers?What are their enforcement powers?– How can we cope with their complexity?How can we cope with their complexity?
Delineating the enforceable policiesDelineating the enforceable policies Conveniently specifying policies in Conveniently specifying policies in
practicepractice ConclusionsConclusions
08/06/0708/06/07 3232/58/58
Managing Policy Managing Policy Complexity via Complexity via CentralizationCentralization
Application with policyscattered throughout
Scattered policy is hard to find and reason about
Application with centralized policy
Centralized policy is easier to find and reason about
Policy contains: - Security code - When to run the security code
08/06/0708/06/07 3333/58/58
Related Work: Managing Related Work: Managing Policy Complexity via Policy Complexity via
CentralizationCentralization General monitoring systemsGeneral monitoring systems
– Java-MaC Java-MaC [Lee, Kannan, Kim, Sokolsky, Viswanathan ’99][Lee, Kannan, Kim, Sokolsky, Viswanathan ’99]– Naccio Naccio [Evans, Twyman ’99][Evans, Twyman ’99]– Diana Diana [Sen, Vardhan, Agha, Rosu ’04][Sen, Vardhan, Agha, Rosu ’04]– Policy Enforcement Toolkit Policy Enforcement Toolkit [Erlingsson, Schneider ’00; [Erlingsson, Schneider ’00;
Erlingsson ’03]Erlingsson ’03]– Aspect-oriented software systems Aspect-oriented software systems [Kiczales, Hilsdale, [Kiczales, Hilsdale,
Hugunin, Kersten, Palm, Griswold ’01; …]Hugunin, Kersten, Palm, Griswold ’01; …]– ……
Language theoryLanguage theory– Semantics for AOPLs Semantics for AOPLs [Tucker, Krishnamurthi ’03; [Tucker, Krishnamurthi ’03;
Walker, Zdancewic, Ligatti ’03; Wand, Kiczales, Dutchyn ’04; Walker, Zdancewic, Ligatti ’03; Wand, Kiczales, Dutchyn ’04; …]…]
Automata theoryAutomata theory– Security automata Security automata [Schneider ’00; Ligatti, Bauer, [Schneider ’00; Ligatti, Bauer,
Walker ’05]Walker ’05]
08/06/0708/06/07 3434/58/58
Beyond Centralization: Beyond Centralization: CompositionComposition
Policy centralization is not enoughPolicy centralization is not enough– Need methodology for organizing a Need methodology for organizing a
complex centralized policycomplex centralized policy
All of the cited efforts lack a flexible All of the cited efforts lack a flexible methodology for decomposing methodology for decomposing complex policies into simpler complex policies into simpler modulesmodules
08/06/0708/06/07 3535/58/58
Polymer ContributionsPolymer Contributions[Bauer, Ligatti, Walker ’05][Bauer, Ligatti, Walker ’05]
PolymerPolymer– Is a fully implemented language (with formal Is a fully implemented language (with formal
semantics) for specifying run-time policies on Java codesemantics) for specifying run-time policies on Java code– Provides a methodology for conveniently specifying Provides a methodology for conveniently specifying
and generating complex monitors from simpler and generating complex monitors from simpler modulesmodules
StrategyStrategy– MakeMake all all policies first-class and composeable policies first-class and composeable– So higher-order policies (So higher-order policies (superpoliciessuperpolicies) can compose ) can compose
simpler policies (simpler policies (subpoliciessubpolicies))
08/06/0708/06/07 3636/58/58
Overview: Polymer System Overview: Polymer System ToolsTools
Policy compilerPolicy compiler – Converts monitor policies written in the Polymer Converts monitor policies written in the Polymer
language into Java source codelanguage into Java source code– Then runs javac to compile the Java sourceThen runs javac to compile the Java source
Bytecode instrumenterBytecode instrumenter– Inserts calls to the monitor at the right places in: Inserts calls to the monitor at the right places in:
The core Java librariesThe core Java libraries The untrusted (The untrusted (targettarget) application) application
08/06/0708/06/07 3737/58/58
Securing Targets in Securing Targets in PolymerPolymer
1.1. Create a listing of all security-relevant Create a listing of all security-relevant methods (methods (trigger actionstrigger actions))
2.2. Instrument trigger actions in core Java Instrument trigger actions in core Java librarieslibraries
3.3. Write and compile security policyWrite and compile security policy4.4. Run target using instrumented Run target using instrumented
libraries, libraries, instrumenting target classes as they instrumenting target classes as they load (with a custom class loader)load (with a custom class loader)
08/06/0708/06/07 3838/58/58
Securing Targets in Securing Targets in PolymerPolymer
Target Libraries… …
Original application
Instrumented target
Instrumentedlibraries
Compiled policy
… …
Secured application
08/06/0708/06/07 3939/58/58
Overview: Polymer Overview: Polymer LanguageLanguage
Syntactically almost identical to Java Syntactically almost identical to Java sourcesource
Primary additions to JavaPrimary additions to Java– Key abstractions for first-class Key abstractions for first-class actionsactions, ,
suggestionssuggestions, and , and policiespolicies– Programming disciplineProgramming discipline– Composeable policy organizationComposeable policy organization
08/06/0708/06/07 4040/58/58
First-class ActionsFirst-class Actions ActionAction objects contain information objects contain information
about a method invocationabout a method invocation– Static method signatureStatic method signature– Dynamic calling object Dynamic calling object – Dynamic parametersDynamic parameters
Policies can analyze trigger actionsPolicies can analyze trigger actions Policies can synthesize actions to insertPolicies can synthesize actions to insert
08/06/0708/06/07 4141/58/58
Action PatternsAction Patterns For convenient analysis, action objects For convenient analysis, action objects
can be matched to patterns in aswitch can be matched to patterns in aswitch statementsstatements
Wildcards can appear in action patternsWildcards can appear in action patterns
aswitch(a) { case <void ex.ATM.logBegin(int amt)>: E; …}
<public void *.*.logBegin(..)>
08/06/0708/06/07 4242/58/58
First-class SuggestionsFirst-class Suggestions Policies return Policies return SuggestionSuggestion objects to objects to
indicate how to handle trigger actionsindicate how to handle trigger actions– IrrSugIrrSug: action is irrelevant: action is irrelevant– OKSugOKSug: action is relevant but safe: action is relevant but safe– InsSugInsSug: defer judgment until after running and : defer judgment until after running and
evaluating some auxiliary codeevaluating some auxiliary code– ReplSugReplSug: replace action (which computes a : replace action (which computes a
return value) with another return valuereturn value) with another return value– ExnSugExnSug: raise an exception to notify target that : raise an exception to notify target that
it is not allowed to execute this actionit is not allowed to execute this action– HaltSugHaltSug: disallow action and halt execution: disallow action and halt execution
08/06/0708/06/07 4343/58/58
First-class SuggestionsFirst-class Suggestions SuggestionsSuggestions implement the implement the
theoretical capabilities of monitorstheoretical capabilities of monitors
– IrrSugIrrSug– OKSugOKSug– InsSugInsSug– ReplSugReplSug– ExnSugExnSug– HaltSugHaltSug
Different ways to accept
Insert
Different ways to suppress
08/06/0708/06/07 4444/58/58
First-class PoliciesFirst-class Policies PoliciesPolicies include state and several methods: include state and several methods:
– query()query() suggests how to deal with trigger actionssuggests how to deal with trigger actions– accept()accept() performs bookkeeping before a performs bookkeeping before a
suggestion is followedsuggestion is followed– result()result() performs bookkeeping after an OK’d or performs bookkeeping after an OK’d or
inserted action returns a resultinserted action returns a result
public abstract class Policy { public abstract Sug query(Action a); public void accept(Sug s) { }; public void result(Sug s, Object result, boolean wasExnThn) { };}
08/06/0708/06/07 4545/58/58
Compositional Policy Compositional Policy DesignDesign
query()query() methods should be effect-free methods should be effect-free– Superpolicies test reactions of subpolicies Superpolicies test reactions of subpolicies
by calling their query() methodsby calling their query() methods– Superpolicies combine reactions in Superpolicies combine reactions in
meaningful waysmeaningful ways– Policies cannot assume suggestions will Policies cannot assume suggestions will
be followedbe followed Effects postponed for Effects postponed for accept()accept() and and
result()result()
08/06/0708/06/07 4646/58/58
A Simple Policy That A Simple Policy That Forbids Runtime.exec(..) Forbids Runtime.exec(..)
methodsmethodspublic class DisSysCalls extends Policy { public Sug query(Action a) { aswitch(a) { case <* java.lang.Runtime.exec(..)>: return new HaltSug(this, a); } return new IrrSug(this); } public void accept(Sug s) { if(s.isHalt()) { System.err.println(“Illegal method called”); System.err.println(“About to halt target.”); } } }
08/06/0708/06/07 4747/58/58
Another Example:Another Example:public class ATMPolicy extends Policypublic class ATMPolicy extends Policy
public Suggestion query(Action a) { if(isInsert) return new IrrSug( ); aswitch(a) { case <void ex.ATM.logBegin(int n)>: if(transState==0) return new ReplSug(null, a); else return new HaltSug(a); case <void ex.ATM.dispense(int n)>: if(transState==1 && amt==n) return new ReplSug(null, a); else return new HaltSug(a); case <void ex.ATM.logEnd(int n)>: if(transState==2 && amt==n) return new OKSug(a); else return new HaltSug(a); default: if(transState>0) return new HaltSug(a); else return new IrrSug( ); } }
private boolean isInsert = false;private int transState = 0;private int amt = 0;public void accept(Sug s) { aswitch(s.getTrigger( )) { case <void ex.ATM.dispense(int n)>: transState = 2; break; case <void ex.ATM.logBegin(int n)>: transState = 1; amt = n; } if(s.isOK( )) { isInsert = true; ex.ATM.logBegin(amt); ex.ATM.dispense(amt); isInsert = false; transState = 0; amt = 0; }}
08/06/0708/06/07 4848/58/58
Policy CombinatorsPolicy Combinators Polymer provides library of generic Polymer provides library of generic
superpolicies (superpolicies (combinatorscombinators)) Policy writers are free to create new Policy writers are free to create new
combinatorscombinators Standard form:Standard form:
public class Conjunction extends Policy { private Policy p1, p2; public Conjunction(Policy p1, Policy p2) { this.p1 = p1; this.p2 = p2; } public Sug query(Action a) { Sug s1 = p1.query(a), s2 = p2.query(a); //return the conjunction of s1 and s2 …
08/06/0708/06/07 4949/58/58
Conjunctive CombinatorConjunctive Combinator Apply several policies at once, first making Apply several policies at once, first making
any insertions suggested by subpoliciesany insertions suggested by subpolicies When no subpolicy suggests an insertion, When no subpolicy suggests an insertion,
obey most restrictive subpolicy suggestion obey most restrictive subpolicy suggestion
Irrelevant OK
Replace(v1)Replace(v2)
…Replace(v3)
Exception Halt
Least restrictive Most restrictive
Policy netPoly = new Conjunction(new FirewallPoly(), new LogSocketsPoly(), new WarnB4DownloadPoly());
08/06/0708/06/07 5050/58/58
Selector CombinatorsSelector Combinators Make some initial choice about which Make some initial choice about which
subpolicy to enforce and forget about subpolicy to enforce and forget about the other subpoliciesthe other subpolicies
IsClientSignedIsClientSigned: Enforce first subpolicy : Enforce first subpolicy if and only if target is if and only if target is cryptographically signedcryptographically signed
Policy sandboxUnsigned = new IsClientSigned( new TrivialPolicy(), new SandboxPolicy());
08/06/0708/06/07 5151/58/58
Unary CombinatorsUnary Combinators
Perform some extra operations while Perform some extra operations while enforcing a single subpolicyenforcing a single subpolicy
AutoUpdateAutoUpdate: Obey sole subpolicy but : Obey sole subpolicy but also intermittently check for also intermittently check for subpolicy updatessubpolicy updates
08/06/0708/06/07 5252/58/58
Case StudyCase Study Polymer policy for email clients that use the Polymer policy for email clients that use the
JavaMail APIJavaMail API– 1539 lines of Polymer code, available at1539 lines of Polymer code, available at
http://www.cs.princeton.edu/sip/projects/polymerhttp://www.cs.princeton.edu/sip/projects/polymer
Tested on Pooka Tested on Pooka [http://www.suberic.net/pooka][http://www.suberic.net/pooka]– Approx. 50K lines of Java code + librariesApprox. 50K lines of Java code + libraries (Java standard libraries, JavaMail, JavaBeans (Java standard libraries, JavaMail, JavaBeans
Activation Framework, JavaHelp, The Knife mbox Activation Framework, JavaHelp, The Knife mbox provider, Kunststoff Look and Feel, and ICE JNI provider, Kunststoff Look and Feel, and ICE JNI library)library)
08/06/0708/06/07 5353/58/58
Email Policy HierarchyEmail Policy HierarchyRelated policyRelated policyconcerns areconcerns aremodularizedmodularized => =>1) Easier to 1) Easier to
create the create the policypolicy- Modules are - Modules are reusablereusable
- Modules can - Modules can be written in be written in isolationisolation
2) Easier to 2) Easier to understand the understand the policypolicy
3) Easier to 3) Easier to update the update the policypolicy
08/06/0708/06/07 5454/58/58
OutlineOutline Motivation and GoalsMotivation and Goals
– Program monitors are useful, so…Program monitors are useful, so…– What are their enforcement powers?What are their enforcement powers?– How can we cope with their complexity?How can we cope with their complexity?
Delineating the enforceable policiesDelineating the enforceable policies Conveniently specifying policies in Conveniently specifying policies in
practicepractice ConclusionsConclusions
08/06/0708/06/07 5555/58/58
SummarySummary Long-term research goal:Long-term research goal:
Whenever possible, generate efficient and Whenever possible, generate efficient and provably effective mechanisms to enforce provably effective mechanisms to enforce conveniently specified policiesconveniently specified policies
Results:Results:– Defined what it means for a monitor to enforce a policyDefined what it means for a monitor to enforce a policy– Analyzed which of the increasingly complex policies Analyzed which of the increasingly complex policies
that need to be enforced can be with monitorsthat need to be enforced can be with monitors– Made it easier to specify and generate complex Made it easier to specify and generate complex
monitorsmonitors
08/06/0708/06/07 5656/58/58
Future Research Future Research Directions Directions (Specification (Specification
Technologies)Technologies) Develop languages for safely and Develop languages for safely and
easily specifying many types of easily specifying many types of policiespolicies– Transactional policiesTransactional policies– Fault-tolerance policiesFault-tolerance policies
Create GUIs for visualizing and Create GUIs for visualizing and specifying policy compositions and specifying policy compositions and dynamic policy updatesdynamic policy updates
08/06/0708/06/07 5757/58/58
Future Research DirectionsFuture Research Directions(Policy Analysis and Enforcement)(Policy Analysis and Enforcement)
Generalize formal models for:Generalize formal models for:– Real-time policiesReal-time policies– ConcurrencyConcurrency– More “active” monitorsMore “active” monitors
(monitor triggers application, not vice versa)(monitor triggers application, not vice versa) Place resource bounds on mechanismsPlace resource bounds on mechanisms Decompose general policies into Decompose general policies into
practically enforceable static and practically enforceable static and dynamic policiesdynamic policies
08/06/0708/06/07 5858/58/58
EndEnd
Thanks / Questions?
08/06/0708/06/07 5959/58/58
Extra SlidesExtra Slides
08/06/0708/06/07 6060/58/58
Implementation NumbersImplementation Numbers Polymer sizePolymer size
– 30 core classes (approx. 2500 lines of Java) + 30 core classes (approx. 2500 lines of Java) + JavaCC + Apache BCELJavaCC + Apache BCEL
(Unoptimized) Performance (Unoptimized) Performance – Instrument all Java core libraries = 107s = 3.7 ms Instrument all Java core libraries = 107s = 3.7 ms
per methodper method– Typical class loading time = 12 ms Typical class loading time = 12 ms
(vs. 6 ms with default class loader) (vs. 6 ms with default class loader) – Monitored method call = 0.6 ms overheadMonitored method call = 0.6 ms overhead– Policy code’s performance typically dominates costPolicy code’s performance typically dominates cost
08/06/0708/06/07 6161/58/58
Case-study constraintsCase-study constraints OutgoingMail OutgoingMail
– logs all mail being sentlogs all mail being sent– pops up a window confirming email recipientspops up a window confirming email recipients– back up messages by BCCing everything to back up messages by BCCing everything to
[email protected]@cs.princeton.edu– Appends contact info to all mailAppends contact info to all mail
IncomingMailIncomingMail– Logs all incoming mailLogs all incoming mail– Runs a spam filterRuns a spam filter– Truncates long subject linesTruncates long subject lines– Warns before opening a message with an Warns before opening a message with an
attachmentattachment
08/06/0708/06/07 6262/58/58
Edit Automata Edit Automata EnforcementEnforcement
(Lower Bound)(Lower Bound) Theorem: Theorem: policies P such that policies P such that
1. P is a renewal policy, 1. P is a renewal policy, 2. P( 2. P(●●), and ), and 3. 3. ssA* A* :: P(s) is decidable, P(s) is decidable, an edit automaton that enforces P. an edit automaton that enforces P.
Edit automata can enforce any reasonable renewal policy
08/06/0708/06/07 6363/58/58
Edit Automata Edit Automata EnforcementEnforcement
(Lower Bound)(Lower Bound) Proof idea: Technique of suppressing actions Proof idea: Technique of suppressing actions
until they are known to be safe causes every until they are known to be safe causes every valid prefix, and only valid prefixes, of the valid prefix, and only valid prefixes, of the input to be outputinput to be output– Given a renewal policy Given a renewal policy PP, construct an edit , construct an edit
automaton automaton XX that uses this technique that uses this technique– In all cases, In all cases, XX correctly enforces correctly enforces PP
If input If input ss has finite length, has finite length, XX outputs longest valid prefix outputs longest valid prefix of of ss
Else if Else if PP((ss), ), XX outputs the longest valid (finite) prefix of outputs the longest valid (finite) prefix of ss Else if Else if PP((ss), ), XX outputs every prefix of outputs every prefix of ss and only prefixes and only prefixes
of of ss
08/06/0708/06/07 6464/58/58
““Transforms” DefinitionTransforms” Definition Definition: Definition: Automaton X = ( Q,qAutomaton X = ( Q,q00,t ) ,t ) transformstransforms
input sinput sAA∞∞ into output u into output uAA∞∞ iff iff
1. 1. q’q’Q Q s’s’AA∞∞ u’u’AA* :* : if (qif (q00,s) ,s) XX u’u’ (q’,s’) then u’ ≤ u (q’,s’) then u’ ≤ u
(On input (On input ss, , XX outputs outputs onlyonly prefixes of prefixes of u)u)
2. 2. u’≤uu’≤uq’q’QQ s’s’AA∞∞ : : (q (q00,s) ,s) XX u’u’ (q’,s’) (q’,s’)(On input (On input ss, , XX outputs outputs everyevery prefix of prefix of uu))
((qq00,,ss) ) X X uu
08/06/0708/06/07 6565/58/58
Edit Automata Edit Automata EnforcementEnforcement
Edit automata enforce Edit automata enforce exactlyexactly the set of the set of reasonable renewal policies, except for a reasonable renewal policies, except for a corner case that allows some valid infinite corner case that allows some valid infinite executions to have finitely many valid prefixesexecutions to have finitely many valid prefixes
ExampleExample– PP((ss) iff ) iff ss==aa11;;aa11;;aa11;…;…– PP is not a renewal policy is not a renewal policy– Monitor enforces Monitor enforces PP by always entering an by always entering an
infinite loop to insert infinite loop to insert aa11;;aa11;;aa11;…;…
08/06/0708/06/07 6666/58/58
Edit Automata Edit Automata EnforcementEnforcement
Enforcing an “almost renewal” policy Enforcing an “almost renewal” policy requires automaton having input requires automaton having input sequence sequence ss’ to decide:’ to decide:– only one extension only one extension ss of of ss’ is valid’ is valid– ss has infinite length has infinite length– how to compute the actions in how to compute the actions in ss
Aside from this situation, edit Aside from this situation, edit automata enforce automata enforce exactlyexactly the set of the set of renewal policiesrenewal policies
08/06/0708/06/07 6767/58/58
Precedence CombinatorsPrecedence Combinators
Give one subpolicy precedence over Give one subpolicy precedence over anotheranother
DominatesDominates: Obey first subpolicy if it : Obey first subpolicy if it considers the action relevant; otherwise considers the action relevant; otherwise obey whatever second subpolicy obey whatever second subpolicy suggestssuggests
TryWithTryWith: Obey first subpolicy if and only : Obey first subpolicy if and only if it returns an Irrelevant, OK, or if it returns an Irrelevant, OK, or Insertion suggestionInsertion suggestion
08/06/0708/06/07 6868/58/58
Design of Media-Player Design of Media-Player PolicyPolicy
08/06/0708/06/07 6969/58/58
Decomposing the Example Decomposing the Example into Safety and Livenessinto Safety and Liveness
ATM must log before and after dispensing cashATM must log before and after dispensing cashand may only log before and after dispensing cash:and may only log before and after dispensing cash:Valid executions = (logBegin(n); dispense(n); logEnd(n))Valid executions = (logBegin(n); dispense(n); logEnd(n))∞∞
PPSS((ss) ) ss matches one of: matches one of:– (logBegin(n);dispense(n);logEnd(n))*;logBegin(n)(logBegin(n);dispense(n);logEnd(n))*;logBegin(n)– (logBegin(n);dispense(n);logEnd(n))*;logBegin(n);dispense(n)(logBegin(n);dispense(n);logEnd(n))*;logBegin(n);dispense(n)– (logBegin(n);dispense(n);logEnd(n))(logBegin(n);dispense(n);logEnd(n))∞∞
PPLL((ss) ) ss≠≠ss’;logBegin(n) and ’;logBegin(n) and ss≠≠ss’logBegin(n);dispense(n)’logBegin(n);dispense(n)