Static Security Policy Verification via Type Propagation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for verifying the implementation of security policies in computer programs are incomplete, time-consuming, and require advanced knowledge, leading to potential undetected security violations and errors in software development.
Innovation Solution
A method that annotates computer programs with a dedicated type-system to automatically verify the implementation of security policies by propagating security types through expressions, providing strong guarantees and debugging information for compliance with security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If runtime analysis is used to verify security policy implementation, then security violations can be detected during execution, but the analysis is incomplete and cannot cover all possible executions
Solution Approach 1:
The patent applies preliminary action by performing static analysis on the source code before execution to verify security policy compliance. The type system and propagation rules are established in advance, allowing the analyzer to check all possible data flows without actually running the program multiple times with different inputs.
Solution Approach 2:
The patent replaces the mechanical execution-based verification (runtime analysis) with a symbolic analysis approach using type propagation. Instead of executing the program with concrete inputs and observing behavior, the system uses abstract type symbols and propagation rules to statically determine security compliance, substituting physical execution with symbolic reasoning.
2Reliability
If static analysis is used to inspect source code for security issues, then analysis can be performed early in development without executable code, but an absence of alarm does not ensure the code is secure
Solution Approach 1:
The patent changes the parameter of security verification from binary (secure/not secure) to a typed system with multiple security levels (trusted, untrusted, secret, public). This allows the analyzer to provide stronger guarantees by tracking how data flows between different security types, making the verification more reliable while maintaining manageable complexity through systematic type propagation rules.
3Reliability
If security-typed languages with manual type declarations are used, then security properties can be verified, but the process is time-consuming and error-prone
Solution Approach 1:
The patent applies self-service by enabling the compiler or analyzer to automatically infer and assign security types to variables based on propagation rules, rather than requiring manual declarations by developers. The system automatically tracks how security types flow through the program, reducing both the time required and the potential for human error in type specification.
Solution Approach 2:
The security type propagation rules are established preliminarily during compilation or static analysis, before runtime. This allows the verification to be performed automatically as part of the build process, significantly improving productivity compared to runtime verification methods while maintaining strong security guarantees.
4Measurement precision
If a large number of input samples are tested during runtime analysis, then more security violations may be detected, but the testing becomes time-consuming
Solution Approach 1:
The patent substitutes the mechanical process of executing the program with multiple input samples with a symbolic analysis process. The type propagation mechanism analyzes all possible data flows through the program structure itself, achieving complete coverage of security violations without the need for multiple executions, thereby eliminating the time-cost trade-off inherent in runtime sampling methods.
Data Source
AI summary
The disclosure relates to a method for verifying an implementation of a security policy by a computer program. The method comprises obtaining (S3) the computer program. The method further comprises, based on obtaining (S2) a security policy correspondence table, annotating (S4) the computer program with at least one annotation comprising an expected security type associated to a variable output by a critical instruction of the computer program. The method further comprises, based on obtaining (S1) propagation rule sets, analyzing the instructions of the annotated computer program to associate (S5) a propagated security type to each variable output by an instruction of the annotated computer program. The method further comprises verifying the implementation of the security policy by comparing (S6) the propagated and expected security types. The disclosure further relates to a corresponding computer program, a corresponding computer-readable storage medium and a corresponding processing circuit.