certificate translation for specification preserving advices · certificate translation for...

César Kunz (with Gilles Barthe)

Certificate Translation for Specification Preserving Advices

FOAL 2008


FOAL 2008

Gilles Barthe and César KunzINRIA Sophia Antipolis Méditerranée



FOAL 2008

MOTIVATION

SPECIFICATION PRESERVING ADVICES

PROVING SPECIFICATION PRESERVING ADVICES

REDUCING PROOF OBLIGATIONS

IMPROVING THE VERIFICATION POWER

CERTIFICATE TRANSLATION



FOAL 2008 3

Local reasoning on: Baseline Code (to understand main functionality)



FOAL 2008 4


Advice Code (to understand the implemented aspect

Incremental concerns: Contract enforcement Logging / Profiling Evolving Security Requirements



FOAL 2008 5


Advice Code (to understand the implemented aspect

Global analysis of pointcuts to understand interaction of aspects

Incremental concerns: Contract enforcement Logging / Profiling Evolving Security Requirements



FOAL 2008 6

Dantas & Walker [POPL06]:● characterize Harmless Advices that allow local reasoning● information flow analysis to check advice noninterference.

Producer vs Consumer Perspective

Obliviousness > Local Reasoning?

Syntactic Obliviousness vs. Semantic Obliviousness

Syntactic Obliviousness is not enough

baselinecode

Satisfies contract P

Advice code

baselinecode

Satisfies contract P

●functional properties (logic formulae)●Absence of null pointer access●Type Safety, etc.

PCC setting: contract enforcement

Contract preserv. vs semantic preserv

weaker requirement



FOAL 2008 7

MOTIVATION








FOAL 2008 8

Strong specification

Harmless Spec. preserving

NO NO

Specification Preserving Advices



FOAL 2008 9


NO YES




FOAL 2008 10


YES NO




FOAL 2008 11

A specification preserving advice may modify variables in the specification.

● Output value may differ

● is not invalidated.

● is ensured.


NO YES




FOAL 2008 12

MOTIVATION








FOAL 2008 13

Proving specpreservation

f

f

Verification of spec. preservation:wpbased Vcgen over modified advice code.

Baseline Code Verification: wpbased Vcgen



FOAL 2008 14

f

f

Proving specpreservation



FOAL 2008 15

MOTIVATION








FOAL 2008 16

Specification Harmless Advices



FOAL 2008 17




FOAL 2008 18




FOAL 2008 19

Does notmodify Vand res=x

Does notmodify V




FOAL 2008 20


Does notmodify V




FOAL 2008 21


Does notmodify V


Does notmodify V




FOAL 2008 22


Does notmodify V


Does notmodify V




FOAL 2008 23

MOTIVATION








FOAL 2008 24

ff




FOAL 2008 25

ff

gg




FOAL 2008 26

DrawbackMultiple advised procedures = multiple verification invariants.

ff

gg

Or you want to verify the advice locally without considering for the moment in which contexts it will be executed!IMPROVING THE VERIFICATION POWER



FOAL 2008 27

Drawback

(specification of proceed improves modularity)

Multiple advised procedures = multiple verification invariants.

ff

gg

Or you want to verify the advice locally without considering for the moment in which contexts it will be executed!IMPROVING THE VERIFICATION POWER



FOAL 2008 28

Some advices are be specpreserving when combined but not when analyzed in isolation

... ... ...

Interference is not always a bad thing.




FOAL 2008 29

Baseline proc. ...




FOAL 2008 30

Baseline proc.

Baseline proc. ...




FOAL 2008 31

Baseline proc.

Baseline proc. ...




FOAL 2008 32

Baseline proc.

Baseline proc. ...




FOAL 2008 33

Baseline proc.

.

.

.

...

Baseline proc. ...




FOAL 2008 34

Baseline proc.

.

.

.

...

Baseline proc. ...




FOAL 2008 35

Specification Refinement instead of Specification Preservation

Baseline proc.

.

.

.

...




FOAL 2008 36

MOTIVATION








FOAL 2008 37

Certificate Translation



FOAL 2008 38

.

.

.

.

.

.

Execution

OK

CodeCertificate

CodeCertificate

CodeCertificate

Baseline CodeProducer

Advice CodeProducer

Advice CodeProducer

Producer Side Consumer Side

Consider the situation:●Client verification and execution environment not AOPoriented●Code generated by multiple producers is weaved before execution

ProofChecker

Weaved CodeCode Weaving




FOAL 2008 39

.

.

.

CodeCertificate

CodeCertificate

CodeCertificate

.

.

.

Weaved Code

Execution

ProofChecker

OK

Baseline CodeProducer

Advice CodeProducer

Advice CodeProducer

Producer Side Consumer Side

Code Weaving

CertificateTranslation

Certificate

Consider the situation:●Client verification and execution environment not AOPoriented●Code generated by multiple producers is weaved before execution




FOAL 2008 40

BaselineSource Code

CompilerLow level

Code


High level/structured Low level/stack based



FOAL 2008 41

BaselineSource Code

CertificateTranslationCertificate

CompilerLow level

Code

Certificate





FOAL 2008 42

BaselineSource Code

Advice Source Code

Final Weaved Code


CompilerLow level

Code

Certificate

Compiler+

Weaving





FOAL 2008 43

BaselineSource Code

Advice Source Code

Final Weaved Code


CompilerLow level

Code

Certificate

Cert. Trans.for adv. weaving

Compiler+

Weaving

Certificate preserv.

Certificate





FOAL 2008 44

Conclusions

●A more flexible notion of noninterfering advices

●Stronger noninterference analyses reduce proof obligations

●Certificate translation targetting a typical backend

certificate translation for specification preserving advices · certificate translation for...

Documents