Hardest Attackers

Most interesting properties of computer systems are inherently undecidable yet static analysis allows to automatically validate systems against such properties by making sure to always “err on the safe side”. We take this idea one step further by identifying “hardest attackers” in such a way that if the static analysis is able to demonstrate protection against the “hardest attacker” then the system is manifestly protected against all of the infintely many attackers. The overall approach. Consider a computer system that is to be protected against hostile elements in its execution environment. This may be done by restricting access to key components to agents knowing a set of agreed passwords or to agents knowing a set of secret keys (assuming classical symmetric cryptography). Determining whether or not the system fulfills its intentions is usually an undecidable property — intuitively because (i) there is an infinity of attackers that do not know the passwords or secret keys, and (ii) even in the presence of a single attacker the success of penetration somehow involves the halting problem and therefore is likely to be undecidable. Concerning (ii), the only way to “by-pass” undecidability is to settle for an approximative answer that always “errs on the safe side” and that can be computed effectively. This is the avenue successfully taken by a number of approaches to the static analysis of programs: type systems, data flow analysis, constraint based analysis etc. Semantic soundness ensures that when a certain behaviour is guarded against according to the analysis then indeed it is guarded against according to the semantics. It goes without saying that there is no notion of semantic completeness; but as demonstrated by the widespread use of type systems and data flow analysis in compilers this 1 On leave from Aarhus University, Denmark. Visiting Universität des Saarlandes, FR 6.2 Informatik, Im Stadtwald, Bau 45 (Zimmer 417), Postfach 15 11 50, D-66041 Saarbrücken, Germany. E-mail: hrn@daimi.au. dk. 2 On leave from Aarhus University, Denmark. Visiting Max-Planck-Institut für Informatik, Stuhlsatzenhausweg 85 (Zimmer 605), D-66123 Saarbrcken, Germany. Email: fn@daimi.au. dk. needs not be a hindrance if the static analyses offer “good” results on “well-behaved” programs. Concerning (i), to overcome the problem of the infinity of attackers we propose a novel use of the intrinsic operation of the static analysis so as to identify a “hardest attacker” that is as hard to protect against (from the point of view of the analysis) as any of the infinity of attackers. Thus if the analysis is able to demonstrate that the “hardest attacker” cannot penetrate then it is guaranteed that none of the infinitely many attackers will be able to penetrate either. This approach is in analogy with identifying problems that are hard for a given complexity class; indeed the term “hardest attacker” is more appropriate than “complete attacker” because the “hardest attacker” is identified with respect to the static analysis rather than the semantics and thus might not be a successful attacker with respect to the semantics; this is just another facet of static analysis always “erring on the safe side”. A worked example. To illustrate the viability of the approach suggested above we have validated the protectiveness of a firewall expressed using the communication-free fragment of the mobile ambients calculus [4]. The ambient calculus is based on the π-calculus [7] but allows more directly to model the mobility of computation; as in the spi-calculus [1] it allows to model passwords and secret keys that cannot be guessed by brute force attack (modelled using the restriction operator, ν). As an example, a message M , encrypted under the key K, is represented simply as the ambient K [M ] and the attempt at decrypting such a message is represented by the ambient openK. If K is a secret only known to the principals P1, · · · , Pn the entire system is represented as (ν K)(P1 | · · · | Pn) where each Pi may contain K [M ] as well as openK. The firewall introduced in [4] is a system intended only to allow agents knowing a set of agreed passwords to enter. Indeed, it is shown in [4] that all agents using the passwords in a specific manner will indeed succeed in entering. Our aims in [10] were complementary: to validate the “protectiveness” of the firewall against all attackers not knowing any of the required passwords.