VERONICA: Expressive and Precise Concurrent Information Flow Security (Extended Version with Technical Appendices)

by   Daniel Schoepe, et al.

Methods for proving that concurrent software does not leak its secrets has remained an active topic of research for at least the past four decades. Despite an impressive array of work, the present situation remains highly unsatisfactory. With contemporary compositional proof methods one is forced to choose between expressiveness (the ability to reason about a wide variety of security policies), on the one hand, and precision (the ability to reason about complex thread interactions and program behaviours), on the other. Achieving both is essential and, we argue, requires a new style of compositional reasoning. We present VERONICA, the first program logic for proving concurrent programs information flow secure that supports compositional, high-precision reasoning about a wide range of security policies and program behaviours (e.g. expressive de-classification, value-dependent classification, secret-dependent branching). Just as importantly, VERONICA embodies a new approach for engineering such logics that can be re-used elsewhere, called decoupled functional correctness (DFC). DFC leads to a simple and clean logic, even while achieving this unprecedented combination of features. We demonstrate the virtues and versatility of VERONICA by verifying a range of example programs, beyond the reach of prior methods.


page 1

page 2

page 3

page 4


SecRSL: Security Separation Logic for C11 Release-Acquire Concurrency (Extended version with technical appendices)

We present Security Relaxed Separation Logic (SecRSL), a separation logi...

Assume but Verify: Deductive Verification of Leaked Information in Concurrent Applications (Extended Version)

We consider the problem of specifying and proving the security of non-tr...

CommCSL: Proving Information Flow Security for Concurrent Programs using Abstract Commutativity

Information flow security ensures that the secret data manipulated by a ...

Verifying that a compiler preserves concurrent value-dependent information-flow security

It is common to prove by reasoning over source code that programs do not...

A Concurrent Program Logic with a Future and History

Verifying fine-grained optimistic concurrent programs remains an open pr...

Hyper Hoare Logic: (Dis-)Proving Program Hyperproperties (extended version)

Hoare logics are proof systems that allow one to formally establish prop...

An Axiomatic Approach to Detect Information Leaks in Concurrent Programs

Realizing flow security in a concurrent environment is extremely challen...

Please sign up or login with your details

Forgot password? Click here to reset