Filters








55,033 Hits in 7.3 sec

Model checking security properties of control flow graphs

Frédéric Besson, Thomas Jensen, Daniel Le Métayer, Tommy Thorn
2001 Journal of Computer Security  
This article introduces a formalism based on a linear-time temporal logic for specifying global security properties pertaining to the control flow of the program, and illustrates its expressive power with  ...  security checks satisfies a global security property.  ...  Acknowledgements: Thanks are due to Thomas Colcombet for numerous discussions about automata-based model checking.  ... 
doi:10.3233/jcs-2001-9303 fatcat:ijcvjib3nvb6zn5k7o5p7arn4u

A Formal Property Verification For Aspect-Oriented Programs In Software Development

Moustapha Bande, Hakima Ould-Slimane, Hanifa Boucheneb
2018 Zenodo  
The approach is based on the control flow graph (CFG) of the woven program, and the use of a satisfiability modulo theories (SMT) solver to check whether each property (represented par one aspect) is satisfied  ...  Software development for complex systems requires efficient and automatic tools that can be used to verify the satisfiability of some critical properties such as security ones.  ...  Unlike the aforementioned work, our approach combines control flow graph generation and a SMT solver to check the satisfiability of properties by deriving a Z3 SMT model from the CFG. V.  ... 
doi:10.5281/zenodo.1474658 fatcat:zgaazelbyjfcbipgcnd5hxxepq

Modeling and Discovering Vulnerabilities with Code Property Graphs

Fabian Yamaguchi, Nico Golde, Daniel Arp, Konrad Rieck
2014 2014 IEEE Symposium on Security and Privacy  
To this end, we introduce a novel representation of source code called a code property graph that merges concepts of classic program analysis, namely abstract syntax trees, control flow graphs and program  ...  The vast majority of security breaches encountered today are a direct result of insecure code.  ...  Control-Flow Vulnerability Descriptions By using the control flow edges of the code property graph, a wider range of vulnerabilities becomes accessible as we can model statement execution order.  ... 
doi:10.1109/sp.2014.44 dblp:conf/sp/YamaguchiGAR14 fatcat:dsdkc6ehdzf25o3ml7pghrnvwi

ProMoVer: Modular Verification of Temporal Safety Properties [chapter]

Siavash Soleimanifard, Dilian Gurov, Marieke Huisman
2011 Lecture Notes in Computer Science  
ProMoVer automates a typical verification scenario for a previously developed tool set for compositional verification of control flow safety properties, and provides appropriate pre-and post-processing  ...  on their implementations, and is based here on the construction of maximal models for a program model that abstracts away from program data.  ...  , and to Stefan Schwoon for adapting the input language of Moped to our needs.  ... 
doi:10.1007/978-3-642-24690-6_25 fatcat:7h3ee6xc6zcz3f44hbwihj5r7u

Procedure-modular verification of control flow safety properties

Siavash Soleimanifard, Dilian Gurov, Marieke Huisman
2010 Proceedings of the 12th Workshop on Formal Techniques for Java-Like Programs - FTFJP '10  
Tool support is provided by means of ProMoVer, a tool that is essentially a wrapper around a previously developed tool set for compositional verification of control flow safety properties, where program  ...  models.  ...  We are indebted to Wojciech Mostowski and Erik Poll for their help in finding a suitable case study, and to Stefan Schwoon for adapting the input language of the PDS model checker Moped to our needs.  ... 
doi:10.1145/1924520.1924525 dblp:conf/ecoop/SoleimanifardGH10 fatcat:5xepdvldjjc4dpmcttvhffi6e4

Procedure-modular specification and verification of temporal safety properties

Siavash Soleimanifard, Dilian Gurov, Marieke Huisman
2013 Journal of Software and Systems Modeling  
ProMoVer automates a typical verification scenario for a previously developed tool set for compositional verification of control flow safety properties, and provides appropriate pre-and post-processing  ...  Here it is based on the construction of maximal models for a program model that abstracts away from program data.  ...  cvpp and ProMoVer, and to Stefan Schwoon for adapting the input language of Moped to our needs.  ... 
doi:10.1007/s10270-013-0321-0 fatcat:lmko3khlnvgh3o6el2pcz26h7y

Formal Methods Research at SICS and KTH

Mads Dam, Lars-Åke Fredlund, Dillian Gurov
2003 Electronical Notes in Theoretical Computer Science  
Finally, local properties are checked by translating control-flow graphs to push-down automata, and using standard tools for temporal logic model-checking of pushdown automata like Moped [7] .  ...  using call-graph abstractions and compositional techniques; (iii) Formalisation and analysis of security properties, in the areas of information flow control, authorisation, and verification of security  ... 
doi:10.1016/s1571-0661(04)80824-7 fatcat:3rhsokuaw5haxa32nhwne63h7q

Checking Absence of Illicit Applet Interactions: A Case Study [chapter]

Marieke Huisman, Dilian Gurov, Christoph Sprenger, Gennady Chugunov
2004 Lecture Notes in Computer Science  
The method is compositional, thus supporting post-issuance loading of applets. The correctness of a global system property can algorithmically be inferred from local applet properties.  ...  Later, when loading applets on a card, the implementations are matched against these local properties, in order to guarantee the global property.  ...  The approach is compositional in that it allows global control flow properties of the whole system to be inferred from local control flow properties of the individual applets.  ... 
doi:10.1007/978-3-540-24721-0_6 fatcat:try4mxpj2nftlj4dilcqqxpjsi

An End-to-End Security Model for Adaptive Service-Oriented Applications [chapter]

Takoua Abdellatif, Marius Bozga
2018 Lecture Notes in Computer Science  
In this paper, we present E2SM, an End-to-End Security Model and a set of algorithms to protect data confidentiality in complex adaptive Serviceoriented applications SOA.  ...  Starting from initial and intuitive business security constraints' settings, E2SM synthesizes a complete security configuration that is formally verified.  ...  checking its non-interference property.  ... 
doi:10.1007/978-3-319-91764-1_4 fatcat:35jg2ek7yfgcfp773jb4jp6s5q

The PACAP Prototype: A Tool for Detecting Java Card Illegal Flow [chapter]

P. Bieber, J. Cazin, V. Wiels, G. Zanon, El Marouan, P. Girard, J.-L. Lanet
2001 Lecture Notes in Computer Science  
We propose a technique based on model checking to verify that actual information flows between applets are authorized.  ...  A security policy has been defined that associates levels to applet attributes and methods and defines authorized flows between levels.  ...  an invariant that is a sufficient condition of the security property; -model checking: we verify this invariant by model checking.  ... 
doi:10.1007/3-540-45165-x_3 fatcat:j7zar3qfgvd6borpaq5tvh6odq

Static Analysis for Stack Inspection

Massimo Bartoletti, Pierpaolo Degano, GianLuigi Ferrari
2001 Electronical Notes in Theoretical Computer Science  
We propose two control flow analyses for the Java bytecode. They safely approximate the set of permissions granted/denied to code at run-time.  ...  This static information helps optimizing the implementation of the stack inspection algorithm. c 2001 Published by Elsevier Science B. V. Open access under CC BY-NC-ND license.  ...  Acknowledgments The last two authors are partially supported by the MURST project TOSCA, and the second author also by the MURST project Interpretazione Astratta, Sistemi di Tipo e Analisi Control Flow  ... 
doi:10.1016/s1571-0661(04)00236-1 fatcat:vas2yq7kxvbvxofax4rr64qowe

Detecting security leaks in hybrid systems with information flow analysis

Luan Viet Nguyen, Gautam Mohan, James Weimer, Oleg Sokolsky, Insup Lee, Rajeev Alur
2019 Proceedings of the 17th ACM-IEEE International Conference on Formal Methods and Models for System Design - MEMOCODE '19  
Information flow analysis is an effective way to check useful security properties, such as whether secret information can leak to adversaries.  ...  Abstract-Information flow analysis is an effective way to check useful security properties, such as whether secret information can leak to adversaries.  ...  Whalen et al. proposed a model checking approach that formalizes non-interference property through a notion of trace equivalence and then utilizes model checking tools to analyze non-interference property  ... 
doi:10.1145/3359986.3361212 dblp:conf/memocode/NguyenMWSLA19 fatcat:snt4iygmevcw7bhjjaejvmuweq

Runtime Verification of Linux Kernel Security Module [article]

Denis Efremov, Ilya Shchepetkov
2020 arXiv   pre-print
As a basis for it, we use an additional Event-B specification of the Linux system call interface that is formally proved to satisfy all the requirements of the security policy model.  ...  It is installed on billions of devices all over the world, which process various sensitive, confidential or simply private data. It is crucial to establish and prove its security properties.  ...  The analysis statically checks the control flow graphs of kernel functions, which are obtained by a compiler plugin during the kernel build, for existence of feasible paths without mediation of the LSM  ... 
arXiv:2001.01442v1 fatcat:girkvbtg75huhfzo7imblfimmi

CVPP: A Tool Set for Compositional Verification of Control–Flow Safety Properties [chapter]

Marieke Huisman, Dilian Gurov
2011 Lecture Notes in Computer Science  
This paper describes CVPP, a tool set for compositional verification of control-flow safety properties for programs with procedures.  ...  models.  ...  We are also indebted to Stefan Schwoon, who extended the input language of Moped to serve our needs.  ... 
doi:10.1007/978-3-642-18070-5_8 fatcat:r57hbpfr3ncqnpe7f3ihfio5zm

Framework for the Formal Specification and Verification of Security Guidelines

Zeineb Zhioua, Rabea Ameur-Boulifa, Yves Roudier
2018 Advances in Science, Technology and Engineering Systems  
checking analysis together with information flow analysis.  ...  In this paper, we present our approach that aims at integrating the formal specification and verification of security guidelines in early stages of the development lifecycle by combining both the model  ...  The security properties are specified in temporal logics, and are model checked over the built LTS.  ... 
doi:10.25046/aj030106 fatcat:p6hdgic4nzak5mfbyhyhchfudi
« Previous Showing results 1 — 15 out of 55,033 results