Abstract:Information flow security ensures that the secret data manipulated by a program does not influence its observable output. Proving information flow security is especially challenging for concurrent programs, where operations on secret data may influence the execution time of a thread and, thereby, the interleaving between different threads. Such internal timing channels may affect the observable outcome of a program even if an attacker does not observe execution times. Existing verification techniques for information flow security in concurrent programs attempt to prove that secret data does not influence the relative timing of threads. However, these techniques are often restrictive (for instance because they disallow branching on secret data) and make strong assumptions about the execution platform (ignoring caching, processor instructions with data-dependent runtime, and other common features that affect execution time). In this paper, we present a novel verification technique for secure information flow in concurrent programs that lifts these restrictions and does not make any assumptions about timing behavior. The key idea is to prove that all mutating operations performed on shared data commute, such that different thread interleavings do not influence its final value. Crucially, commutativity is required only for an abstraction of the shared data that contains the information that will be leaked to a public output. Abstract commutativity is satisfied by many more operations than standard commutativity, which makes our technique widely applicable. We formalize our technique in CommCSL, a relational concurrent separation logic with support for commutativity-based reasoning, and prove its soundness in Isabelle/HOL. We implemented CommCSL in HyperViper, an automated verifier based on the Viper verification infrastructure, and demonstrate its ability to verify challenging examples.

A Thread Modularity Approach for Verification Concurrent Software Based on Abstract Interpretation

Flow-Sensitive Composition of Thread-Modular Abstract Interpretation

Thread-Modular Model Checking with Iterative Refinement

A Generic UVM Verification Framework Based on Two-Stage Comparison for Protocol-Agnostic Data Streams in Digital Designs

Automatic compositional reasoning for multi-thread programs

Satisfiability Modulo Ordering Consistency Theory for Multi-Threaded Program Verification.

Static analysis by abstract interpretation of embedded critical software

Industrial Strength Formal Using Abstractions

CommCSL: Proving Information Flow Security for Concurrent Programs using Abstract Commutativity

Constraint-based automatic verification of abstract models of multithreaded programs

Trace-Based Temporal Verification for Message-Passing Programs

Compositional Reasoning for Shared-variable Concurrent Programs.

Verification Framework for UML-Based Design of Embedded Systems.

Runtime Verification on Abstract Finite State Models

An approach for design and formal verification of safety-critical software

Constraint-based verification of abstract models of multitreaded programs

Combining Domain-Specific and Foundational Logics to Verify Complete Software Systems

Formal Verification for C Program

Modular Reasoning for Message-Passing Programs.

A Control Flow based Static Analysis of GRAFCET using Abstract Interpretation

Structural Invariants for Parametric Verification of Systems with Almost Linear Architectures