Collection of works about
References: Liu, Shen, Dongrui Zeng, Yongzhe Huang, Frank Capobianco, Stephen McCamant, Trent Jaeger, and Gang Tan. “Program-mandering: Quantitative privilege separation.” In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 1023-1040. 2019. Input: a) source code + user annoations on sensitive functions/globals; b) metircs budgets and the optimization goal. Output: A set of functions and globals that should be included in the sensitive domain.
Security-Oriented Analysis of Application Programs (SOAAP)[^c1]. LLVM-based tool; uses source code annotations for compartmentalization hypotheses. Able to help with: creating new compartmentalizations for complex applications; discover design faults in existing compartmentalized applications. Challenges Reasoning about the compartmentalization tradeoffs is difficult: Information about past vulnerabilities is not easily accessible; Call graphs of compartmentalized applications are extremely complex; Simple control-flow analysis cannot follow manually encoded cross-domain actions – such as those via IPC; reasoning about information flow; failures caused by compartmentalization are hard to debug and testing; performance impacts are difficult to predict and control.
Reference: 2019 PrivAnalyzer1 PrivAnalyzer: Measuring the Efficacy of Linux Privilege Use. DSN, 2019 ↩
Reference: Secure web @ 2007SOSP1. Secure web applications via automatic partitioning. SOSP, 2007. ↩
References: Privtrans @ 2004SP1; Privilege separation in OpenSSH2; Partition a single program into two parts: a monitor, relegated all trust an privileges; a small TCB; a slave. Q & A What kind of static analysis techniques are used? LLM: user annotation for privileged variables and functions; then inter-procedural static analysis to propagate attributes; “meet-over-all-path” data-flow analysis to find proper place to insert calls to the monitor.
If you could revise
the fundmental principles of
computer system design
to improve security...
... what would you change?