Cerise: Program Verification on a Capability Machine in the Presence of Untrusted Code
Cerise: Program Verification on a Capability Machine in the Presence of Untrusted Code
复制标题
Cerise：存在不可信代码的能力机器上的程序验证
作者：
Aïna Linn Georges;Armaël Guéneau;Thomas Van Strydonck;Amin Timany;Alix Trieu;Dominique Devriese;L. Birkedal
功能机是一种CPU，允许使用能力和代表某些权威的机器单词进行细粒度的特权分离。我们提出了一种数学模型和随附的证明方法，该方法可用于正式验证能力机上运行程序的功能正确性，即使它们调用并被未知（可能是恶意）代码调用。我们使用称为CERISE的程序逻辑来推理已知代码以及相关的逻辑关系，以推理未知代码。逻辑关系正式捕获了功能机提供的能力安全保证。 CERISE计划的逻辑，逻辑关系和本文中考虑的所有示例已使用COQ证明助手中的IRIS程序逻辑框架进行了机械化。我们提出的方法基于作者在有关能力机器的正式推理方面的最新工作[Georges等。 2021; Skorstengaard等。 2019a; van Strydonck等。 2022]，但在这些出版物中有些隐含。在本文中，我们在简单的环境（无外来功能）中介绍了该方法的教学介绍，并且从最小的示例开始。我们致力于有关基于堆的呼叫惯例和实现先前研究的具有对象障碍的高级语言的复杂对象能力模式模式的新结果的新结果，这表明该方法论将这种推理扩展到了这种推理。
A capability machine is a type of CPU allowing fine-grained privilege separation using capabilities, machine words that represent certain kinds of authority. We present a mathematical model and accompanying proof methods that can be used for formal verification of functional correctness of programs running on a capability machine, even when they invoke and are invoked by unknown (and possibly malicious) code. We use a program logic called Cerise for reasoning about known code, and an associated logical relation, for reasoning about unknown code. The logical relation formally captures the capability safety guarantees provided by the capability machine. The Cerise program logic, logical relation, and all the examples considered in the paper have been mechanized using the Iris program logic framework in the Coq proof assistant. The methodology we present underlies recent work of the authors on formal reasoning about capability machines [Georges et al. 2021; Skorstengaard et al. 2019a; Van Strydonck et al. 2022], but was left somewhat implicit in those publications. In this paper we present a pedagogical introduction to the methodology, in a simpler setting (no exotic capabilities), and starting from minimal examples. We work our way up to new results about a heap-based calling convention and implementations of sophisticated object-capability patterns of the kind previously studied for high-level languages with object-capabilities, demonstrating that the methodology scales to such reasoning.
登录
查看更多内容
CHERI Concentrate：实用的压缩功能
影响因子：
3.7
作者：
Woodruff J
通讯作者：
Woodruff J
影响因子：
1.8
作者：
Armstrong, Alasdair;Bauereiss, Thomas;Sewell, Peter
通讯作者：
Sewell, Peter
影响因子：
--
作者：
Michael Sammler;D. Garg;Derek Dreyer;Tadeusz Litak
通讯作者：
Michael Sammler;D. Garg;Derek Dreyer;Tadeusz Litak
影响因子：
--
作者：
David Swasey;Deepak Garg;Derek Dreyer
通讯作者：
Derek Dreyer