08/06/071/58 Runtime Software Monitoring Jay Ligatti, University of South Florida Joint work with: Lujo Bauer, CMU CyLab David Walker, Princeton University

08/06/0708/06/07 11/58/58

Runtime Software Runtime Software MonitoringMonitoring

Jay Ligatti, University of South FloridaJay Ligatti, University of South Florida

Joint work with:Joint work with:Lujo Bauer, CMU CyLabLujo Bauer, CMU CyLab

David Walker, Princeton UniversityDavid Walker, Princeton University

08/06/0708/06/07 22/58/58

ProblemProblem Software often behaves Software often behaves

unexpectedlyunexpectedly– BugsBugs– Malicious design (malware)Malicious design (malware)

0100020003000400050006000700080009000

# Vulner-abilities

Reported to CERT

1995 1997 1999 2001 2003 2005

Year [ http://www.cert.org/stats ]

08/06/0708/06/07 33/58/58

A Protection MechanismA Protection Mechanism Run-time program monitorsRun-time program monitors

– Ensure that software dynamically Ensure that software dynamically adheres to constraints specified by a adheres to constraints specified by a security policysecurity policy

UntrustedTarget

ProgramMonitor

ExecutingSystem

Open(f,“w”)is OK

Open(f,“w”) Open(f,“w”)

08/06/0708/06/07 44/58/58

Common Monitor Common Monitor ExamplesExamples

File access controlFile access control FirewallsFirewalls Resource monitorsResource monitors Stack inspectionStack inspection Applet sandboxingApplet sandboxing Bounds checks on input values Bounds checks on input values Security loggingSecurity logging Displaying security warningsDisplaying security warnings Operating systems and virtual Operating systems and virtual

machinesmachines ……

08/06/0708/06/07 55/58/58

Policies Become More Policies Become More Complex…Complex…

As software becomes more sophisticatedAs software becomes more sophisticated(i.e., enters new domains)(i.e., enters new domains)– Multi-user and networked systemsMulti-user and networked systems– Electronic commerceElectronic commerce– Medical databases (HIPAA, EU Data Protection Law)Medical databases (HIPAA, EU Data Protection Law)

08/06/0708/06/07 66/58/58


As software becomes more sophisticatedAs software becomes more sophisticated(i.e., enters new domains)(i.e., enters new domains)– Multi-user and networked systemsMulti-user and networked systems– Electronic commerceElectronic commerce– Medical databases (HIPAA, EU Data Protection Medical databases (HIPAA, EU Data Protection

Law)Law) As we tighten overly relaxed policiesAs we tighten overly relaxed policies

– Insecure default configurations disallowedInsecure default configurations disallowed– Downloading .doc files requires warningDownloading .doc files requires warning

08/06/0708/06/07 77/58/58


As software becomes more sophisticatedAs software becomes more sophisticated(i.e., enters new domains)(i.e., enters new domains)– Multi-user and networked systemsMulti-user and networked systems– Electronic commerceElectronic commerce– Medical databases (HIPAA, EU Data Protection Law)Medical databases (HIPAA, EU Data Protection Law)

As we tighten overly relaxed policiesAs we tighten overly relaxed policies– Insecure default configurations disallowedInsecure default configurations disallowed– Downloading .doc files requires warningDownloading .doc files requires warning

As we relax overly tight policiesAs we relax overly tight policies– All applets sandboxed (JDK 1.0) vs. All applets sandboxed (JDK 1.0) vs.

only only unsignedunsigned applets sandboxed (JDK 1.1) applets sandboxed (JDK 1.1)

08/06/0708/06/07 88/58/58

Research QuestionsResearch QuestionsGiven:Given:

• The prevalence and usefulness of monitorsThe prevalence and usefulness of monitors• The need to enforce increasingly complex policiesThe need to enforce increasingly complex policies

1.1. Which of the policies can monitors enforce?Which of the policies can monitors enforce?• Want to know when and when not to use monitorsWant to know when and when not to use monitors

2.2. How can we conveniently specify the complex How can we conveniently specify the complex policies that monitors can enforce?policies that monitors can enforce?

08/06/0708/06/07 99/58/58

OutlineOutline Motivation and GoalsMotivation and Goals

– Program monitors are useful, so…Program monitors are useful, so…– What are their enforcement powers?What are their enforcement powers?– How can we cope with their complexity?How can we cope with their complexity?

Delineating the enforceable policiesDelineating the enforceable policies Conveniently specifying policies in Conveniently specifying policies in

practicepractice ConclusionsConclusions

08/06/0708/06/07 1010/58/58

Delineating the Delineating the Enforceable PoliciesEnforceable Policies

2. Define monitors and how they enforce policies

1. Define policies on systems

3. Analyze which policies monitors can enforce

08/06/0708/06/07 1111/58/58

Systems and Systems and ExecutionsExecutions

SystemSystem = a state machine that transitions states = a state machine that transitions states by executing by executing actionsactions

We specify a system according to the possibly We specify a system according to the possibly countably infinite set of actions it can executecountably infinite set of actions it can execute AA = { logBegin( = { logBegin(nn), ), (log that ATM is about to dispense $(log that ATM is about to dispense $nn))

dispense( dispense(nn),), (dispense $(dispense $nn)) logEnd( logEnd(nn)) (log that ATM just dispensed $(log that ATM just dispensed $nn)) } }

ExecutionExecution = possibly infinite sequence of actions = possibly infinite sequence of actions logBegin(80); logEnd(80) logBegin(80); logEnd(80) dispense(100); dispense(100); dispense(100); …dispense(100); dispense(100); dispense(100); …

08/06/0708/06/07 1212/58/58

Execution NotationExecution Notation On a system with action set On a system with action set AA,,

AA** = set of all = set of all finitefinite executionsexecutionsAAωω = set of all = set of all infiniteinfinite executionsexecutionsAA∞∞ = set of = set of allall executionsexecutions

Prefix notation: Prefix notation: ss≤≤uu (or (or uu≥≥ss) ) – Means: Means: ss is a finite prefix of possibly is a finite prefix of possibly

infinite infinite uu– Read: Read: ss prefixesprefixes uu (or (or uu extendsextends ss))

08/06/0708/06/07 1313/58/58

PoliciesPolicies A A policypolicy PP is a predicate on executions is a predicate on executions

Execution Execution ss satisfies policy satisfies policy PP if and only if if and only if P P ((ss))– Termination: Termination: P P ((ss) ) ss is finite is finite– Transactional: Transactional: P P ((ss) ) s s is a sequence of valid is a sequence of valid

transactionstransactions

TerminologyTerminology– IfIf P P ((ss) then) then s s is valid, or “good” is valid, or “good”– IfIf P P ((ss) then) then s s is invalid, or “bad” is invalid, or “bad”

08/06/0708/06/07 1414/58/58

Safety and LivenessSafety and Liveness [Lamport ’77; Alpern, Schneider ’85][Lamport ’77; Alpern, Schneider ’85]

Two types of policies have been studied a lotTwo types of policies have been studied a lot

SafetySafety: “Bad executions cannot be made good”: “Bad executions cannot be made good”ssAA∞∞ : : P P ((ss) ) ss’≤’≤ss : : uu≥≥ss’ : ’ : P P ((uu))

– Access-control (cannot “undo” illegal accesses)Access-control (cannot “undo” illegal accesses)

LivenessLiveness: “Finite executions can be made : “Finite executions can be made good”good” ssAA* : * : uu≥≥ss : : P P ((uu))– Termination and nonterminationTermination and nontermination

08/06/0708/06/07 1515/58/58





08/06/0708/06/07 1616/58/58

Operation of Monitors: Operation of Monitors: Accepting an OK ActionAccepting an OK Action

UntrustedTarget

ProgramMonitor

ExecutingSystem

Open(f,“w”)is OK

Open(f,“w”) Open(f,“w”)

Monitor inputs actions from target andoutputs actions to the executing system

Here, input action is safe to execute, somonitor accepts it (makes it observable)

08/06/0708/06/07 1717/58/58

Operation of Monitors: Operation of Monitors: Suppressing an ActionSuppressing an Action

UntrustedTarget

ProgramMonitor

ExecutingSystem

Open(f,“w”)is not OK

Open(f,“w”)

Input action is not safe to execute, so monitor suppresses it and allows target to continue executing

08/06/0708/06/07 1818/58/58

Operation of Monitors: Operation of Monitors: Inserting an ActionInserting an Action

UntrustedTarget

ProgramMonitor

ExecutingSystem

Open(f,“w”)is not OK

Open(f,“w”) Close(f,“w”)

Input action is not safe to execute, so monitor inserts another action, then reconsiders the original action

08/06/0708/06/07 1919/58/58

Modeling MonitorsModeling Monitors[Ligatti, Bauer, Walker ’05][Ligatti, Bauer, Walker ’05]

Model a monitor that can Model a monitor that can accept, suppress, accept, suppress, andand insert insert actions as an actions as an edit automatonedit automaton ((QQ,,qq00,,tt))– QQ is finite or countably infinite set of states is finite or countably infinite set of states– qq00 is initial state is initial state– A complete, deterministic, and TM-decidable A complete, deterministic, and TM-decidable

functionfunctiont : Q x A Q x (A U {●})

currentstate

input(trigger)action

new state

actionto insert

suppresstriggeraction

08/06/0708/06/07 2020/58/58

Operational SemanticsOperational Semantics Transition functions define how monitors behave Transition functions define how monitors behave

on on individualindividual input actions input actions

For the definition of enforcement, we will For the definition of enforcement, we will generalize and consider how monitors transform generalize and consider how monitors transform entireentire input executions input executions

a1;a2;a2;a3;… a1;a2;a2;a4;…Untrusted input Valid output

Monitor

Monitors are execution transformers

08/06/0708/06/07 2121/58/58

Enforcing PoliciesEnforcing Policies[Ligatti, Bauer, Walker ’05][Ligatti, Bauer, Walker ’05]

A monitor A monitor enforcesenforces a policy a policy PP when it is when it is sound sound and and transparent transparent with respect to with respect to PP

SoundnessSoundness: : – Monitors’ outputs (observable executions) must be Monitors’ outputs (observable executions) must be

validvalid

TransparencyTransparency::– Monitors must not alter the semantics of valid inputsMonitors must not alter the semantics of valid inputs– Conservative definition: on any valid input execution Conservative definition: on any valid input execution ss

monitor must output monitor must output ss

08/06/0708/06/07 2222/58/58





08/06/0708/06/07 2323/58/58

Enforcement Powers Enforcement Powers Related WorkRelated Work

Previous work on monitors’ enforcement Previous work on monitors’ enforcement bounds only modeled monitors that accept bounds only modeled monitors that accept actions and halt target actions and halt target [Schneider ’00; Viswanathan [Schneider ’00; Viswanathan ’00; Hamlen, Morrisett, Schneider ’03; Fong ’04]’00; Hamlen, Morrisett, Schneider ’03; Fong ’04]

Enforcing policy meant Enforcing policy meant recognizingrecognizing rather rather than than transformingtransforming executionsexecutions

Result: monitors only enforce safety Result: monitors only enforce safety policiespolicies

08/06/0708/06/07 2424/58/58

Enforcing Properties with Enforcing Properties with Edit AutomataEdit Automata

Modeling realistic ability to Modeling realistic ability to insertinsert and and suppresssuppress actions enables a powerful actions enables a powerful enforcement techniqueenforcement technique– Suppress (feign execution of) potentially bad Suppress (feign execution of) potentially bad

actions, and later, if the suppressed actions are actions, and later, if the suppressed actions are found to be safe, re-insert themfound to be safe, re-insert them

Using this technique, Using this technique, monitors can monitors can sometimes enforce non-safety policiessometimes enforce non-safety policies, , contrary to earlier results and conjecturescontrary to earlier results and conjectures

08/06/0708/06/07 2525/58/58

Example: ATM PolicyExample: ATM Policy ATM must log before and after dispensing ATM must log before and after dispensing

cashcashand may only log before and after dispensing and may only log before and after dispensing cashcash

Valid executions = (logBegin(n); dispense(n); Valid executions = (logBegin(n); dispense(n); logEnd(n))logEnd(n))∞∞

Guarantees that the ATM software generates a proper log whenever it dispenses cash

08/06/0708/06/07 2626/58/58

Example: ATM PolicyExample: ATM Policy ATM must log before and after dispensing ATM must log before and after dispensing

cashcashand may only log before and after dispensing and may only log before and after dispensing cashcash

Valid executions = (logBegin(n); dispense(n); Valid executions = (logBegin(n); dispense(n); logEnd(n))logEnd(n))∞∞

init begun(n) dispensed(n)

logBegin(n) dispense(n)

logEnd(n)insert: logBegin(n);dispense(n);logEnd(n)

(suppress) (suppress)

08/06/0708/06/07 2727/58/58

Example: ATM PolicyExample: ATM Policy ATM must log before and after dispensing cashATM must log before and after dispensing cash

and may only log before and after dispensing cashand may only log before and after dispensing cash

Valid executions = (logBegin(n); dispense(n); logEnd(n))Valid executions = (logBegin(n); dispense(n); logEnd(n))∞∞

Is not a safety policy Is not a safety policy (safety=bad executions can’t be made good)(safety=bad executions can’t be made good):: logBegin(200) by itself is illegal but can be “made good”logBegin(200) by itself is illegal but can be “made good”

Is not a liveness policy Is not a liveness policy (liveness=finite executions can be made good)(liveness=finite executions can be made good):: dispense(200) cannot be “made good”dispense(200) cannot be “made good”

08/06/0708/06/07 2828/58/58

Enforceable Policies Enforceable Policies Renewal PoliciesRenewal Policies

Theorem: Theorem: Except for a technical corner case, edit Except for a technical corner case, edit automata enforce automata enforce exactlyexactly the set of the set of reasonable reasonable infinite renewalinfinite renewal policiespolicies

RenewalRenewal: “Infinite executions are good iff : “Infinite executions are good iff they are good infinitely often”they are good infinitely often”sAω : P(s) {u≤s | P(u)} is an infinite set

08/06/0708/06/07 2929/58/58

Example: ATM PolicyExample: ATM Policy ATM must log before and after dispensing cashATM must log before and after dispensing cash

and may only log before and after dispensing cashand may only log before and after dispensing cash Valid executions = (logBegin(n); dispense(n); logEnd(n))Valid executions = (logBegin(n); dispense(n); logEnd(n))∞∞

This is a renewal policy:This is a renewal policy:– Valid infinite executions have infinitely many valid Valid infinite executions have infinitely many valid

prefixesprefixes– Invalid infinite executions have finitely many valid Invalid infinite executions have finitely many valid

prefixesprefixes Some prefix with multiple of 3 actions ends with a bad Some prefix with multiple of 3 actions ends with a bad

transaction; all successive prefixes are invalidtransaction; all successive prefixes are invalid

08/06/0708/06/07 3030/58/58

Safety, Liveness, Safety, Liveness, RenewalRenewal

Safety Liveness

Renewal

All Policies

1 2

4

3 5

6

1 File access control2 Trivial3 Eventually audits4 ATM transactions5 Termination6 Termination + File access control

08/06/0708/06/07 3131/58/58





08/06/0708/06/07 3232/58/58

Managing Policy Managing Policy Complexity via Complexity via CentralizationCentralization

Application with policyscattered throughout

Scattered policy is hard to find and reason about

Application with centralized policy

Centralized policy is easier to find and reason about

Policy contains: - Security code - When to run the security code

08/06/0708/06/07 3333/58/58

Related Work: Managing Related Work: Managing Policy Complexity via Policy Complexity via

CentralizationCentralization General monitoring systemsGeneral monitoring systems

– Java-MaC Java-MaC [Lee, Kannan, Kim, Sokolsky, Viswanathan ’99][Lee, Kannan, Kim, Sokolsky, Viswanathan ’99]– Naccio Naccio [Evans, Twyman ’99][Evans, Twyman ’99]– Diana Diana [Sen, Vardhan, Agha, Rosu ’04][Sen, Vardhan, Agha, Rosu ’04]– Policy Enforcement Toolkit Policy Enforcement Toolkit [Erlingsson, Schneider ’00; [Erlingsson, Schneider ’00;

Erlingsson ’03]Erlingsson ’03]– Aspect-oriented software systems Aspect-oriented software systems [Kiczales, Hilsdale, [Kiczales, Hilsdale,

Hugunin, Kersten, Palm, Griswold ’01; …]Hugunin, Kersten, Palm, Griswold ’01; …]– ……

Language theoryLanguage theory– Semantics for AOPLs Semantics for AOPLs [Tucker, Krishnamurthi ’03; [Tucker, Krishnamurthi ’03;

Walker, Zdancewic, Ligatti ’03; Wand, Kiczales, Dutchyn ’04; Walker, Zdancewic, Ligatti ’03; Wand, Kiczales, Dutchyn ’04; …]…]

Automata theoryAutomata theory– Security automata Security automata [Schneider ’00; Ligatti, Bauer, [Schneider ’00; Ligatti, Bauer,

Walker ’05]Walker ’05]

08/06/0708/06/07 3434/58/58

Beyond Centralization: Beyond Centralization: CompositionComposition

Policy centralization is not enoughPolicy centralization is not enough– Need methodology for organizing a Need methodology for organizing a

complex centralized policycomplex centralized policy

All of the cited efforts lack a flexible All of the cited efforts lack a flexible methodology for decomposing methodology for decomposing complex policies into simpler complex policies into simpler modulesmodules

08/06/0708/06/07 3535/58/58

Polymer ContributionsPolymer Contributions[Bauer, Ligatti, Walker ’05][Bauer, Ligatti, Walker ’05]

PolymerPolymer– Is a fully implemented language (with formal Is a fully implemented language (with formal

semantics) for specifying run-time policies on Java codesemantics) for specifying run-time policies on Java code– Provides a methodology for conveniently specifying Provides a methodology for conveniently specifying

and generating complex monitors from simpler and generating complex monitors from simpler modulesmodules

StrategyStrategy– MakeMake all all policies first-class and composeable policies first-class and composeable– So higher-order policies (So higher-order policies (superpoliciessuperpolicies) can compose ) can compose

simpler policies (simpler policies (subpoliciessubpolicies))

08/06/0708/06/07 3636/58/58

Overview: Polymer System Overview: Polymer System ToolsTools

Policy compilerPolicy compiler – Converts monitor policies written in the Polymer Converts monitor policies written in the Polymer

language into Java source codelanguage into Java source code– Then runs javac to compile the Java sourceThen runs javac to compile the Java source

Bytecode instrumenterBytecode instrumenter– Inserts calls to the monitor at the right places in: Inserts calls to the monitor at the right places in:

The core Java librariesThe core Java libraries The untrusted (The untrusted (targettarget) application) application

08/06/0708/06/07 3737/58/58

Securing Targets in Securing Targets in PolymerPolymer

1.1. Create a listing of all security-relevant Create a listing of all security-relevant methods (methods (trigger actionstrigger actions))

2.2. Instrument trigger actions in core Java Instrument trigger actions in core Java librarieslibraries

3.3. Write and compile security policyWrite and compile security policy4.4. Run target using instrumented Run target using instrumented

libraries, libraries, instrumenting target classes as they instrumenting target classes as they load (with a custom class loader)load (with a custom class loader)

08/06/0708/06/07 3838/58/58

Securing Targets in Securing Targets in PolymerPolymer

Target Libraries… …

Original application

Instrumented target

Instrumentedlibraries

Compiled policy

… …

Secured application

08/06/0708/06/07 3939/58/58

Overview: Polymer Overview: Polymer LanguageLanguage

Syntactically almost identical to Java Syntactically almost identical to Java sourcesource

Primary additions to JavaPrimary additions to Java– Key abstractions for first-class Key abstractions for first-class actionsactions, ,

suggestionssuggestions, and , and policiespolicies– Programming disciplineProgramming discipline– Composeable policy organizationComposeable policy organization

08/06/0708/06/07 4040/58/58

First-class ActionsFirst-class Actions ActionAction objects contain information objects contain information

about a method invocationabout a method invocation– Static method signatureStatic method signature– Dynamic calling object Dynamic calling object – Dynamic parametersDynamic parameters

Policies can analyze trigger actionsPolicies can analyze trigger actions Policies can synthesize actions to insertPolicies can synthesize actions to insert

08/06/0708/06/07 4141/58/58

Action PatternsAction Patterns For convenient analysis, action objects For convenient analysis, action objects

can be matched to patterns in aswitch can be matched to patterns in aswitch statementsstatements

Wildcards can appear in action patternsWildcards can appear in action patterns

aswitch(a) { case <void ex.ATM.logBegin(int amt)>: E; …}

<public void *.*.logBegin(..)>

08/06/0708/06/07 4242/58/58

First-class SuggestionsFirst-class Suggestions Policies return Policies return SuggestionSuggestion objects to objects to

indicate how to handle trigger actionsindicate how to handle trigger actions– IrrSugIrrSug: action is irrelevant: action is irrelevant– OKSugOKSug: action is relevant but safe: action is relevant but safe– InsSugInsSug: defer judgment until after running and : defer judgment until after running and

evaluating some auxiliary codeevaluating some auxiliary code– ReplSugReplSug: replace action (which computes a : replace action (which computes a

return value) with another return valuereturn value) with another return value– ExnSugExnSug: raise an exception to notify target that : raise an exception to notify target that

it is not allowed to execute this actionit is not allowed to execute this action– HaltSugHaltSug: disallow action and halt execution: disallow action and halt execution

08/06/0708/06/07 4343/58/58

First-class SuggestionsFirst-class Suggestions SuggestionsSuggestions implement the implement the

theoretical capabilities of monitorstheoretical capabilities of monitors

– IrrSugIrrSug– OKSugOKSug– InsSugInsSug– ReplSugReplSug– ExnSugExnSug– HaltSugHaltSug

Different ways to accept

Insert

Different ways to suppress

08/06/0708/06/07 4444/58/58

First-class PoliciesFirst-class Policies PoliciesPolicies include state and several methods: include state and several methods:

– query()query() suggests how to deal with trigger actionssuggests how to deal with trigger actions– accept()accept() performs bookkeeping before a performs bookkeeping before a

suggestion is followedsuggestion is followed– result()result() performs bookkeeping after an OK’d or performs bookkeeping after an OK’d or

inserted action returns a resultinserted action returns a result

public abstract class Policy { public abstract Sug query(Action a); public void accept(Sug s) { }; public void result(Sug s, Object result, boolean wasExnThn) { };}

08/06/0708/06/07 4545/58/58

Compositional Policy Compositional Policy DesignDesign

query()query() methods should be effect-free methods should be effect-free– Superpolicies test reactions of subpolicies Superpolicies test reactions of subpolicies

by calling their query() methodsby calling their query() methods– Superpolicies combine reactions in Superpolicies combine reactions in

meaningful waysmeaningful ways– Policies cannot assume suggestions will Policies cannot assume suggestions will

be followedbe followed Effects postponed for Effects postponed for accept()accept() and and

result()result()

08/06/0708/06/07 4646/58/58

A Simple Policy That A Simple Policy That Forbids Runtime.exec(..) Forbids Runtime.exec(..)

methodsmethodspublic class DisSysCalls extends Policy { public Sug query(Action a) { aswitch(a) { case <* java.lang.Runtime.exec(..)>: return new HaltSug(this, a); } return new IrrSug(this); } public void accept(Sug s) { if(s.isHalt()) { System.err.println(“Illegal method called”); System.err.println(“About to halt target.”); } } }

08/06/0708/06/07 4747/58/58

Another Example:Another Example:public class ATMPolicy extends Policypublic class ATMPolicy extends Policy

public Suggestion query(Action a) { if(isInsert) return new IrrSug( ); aswitch(a) { case <void ex.ATM.logBegin(int n)>: if(transState==0) return new ReplSug(null, a); else return new HaltSug(a); case <void ex.ATM.dispense(int n)>: if(transState==1 && amt==n) return new ReplSug(null, a); else return new HaltSug(a); case <void ex.ATM.logEnd(int n)>: if(transState==2 && amt==n) return new OKSug(a); else return new HaltSug(a); default: if(transState>0) return new HaltSug(a); else return new IrrSug( ); } }

private boolean isInsert = false;private int transState = 0;private int amt = 0;public void accept(Sug s) { aswitch(s.getTrigger( )) { case <void ex.ATM.dispense(int n)>: transState = 2; break; case <void ex.ATM.logBegin(int n)>: transState = 1; amt = n; } if(s.isOK( )) { isInsert = true; ex.ATM.logBegin(amt); ex.ATM.dispense(amt); isInsert = false; transState = 0; amt = 0; }}

08/06/0708/06/07 4848/58/58

Policy CombinatorsPolicy Combinators Polymer provides library of generic Polymer provides library of generic

superpolicies (superpolicies (combinatorscombinators)) Policy writers are free to create new Policy writers are free to create new

combinatorscombinators Standard form:Standard form:

public class Conjunction extends Policy { private Policy p1, p2; public Conjunction(Policy p1, Policy p2) { this.p1 = p1; this.p2 = p2; } public Sug query(Action a) { Sug s1 = p1.query(a), s2 = p2.query(a); //return the conjunction of s1 and s2 …

08/06/0708/06/07 4949/58/58

Conjunctive CombinatorConjunctive Combinator Apply several policies at once, first making Apply several policies at once, first making

any insertions suggested by subpoliciesany insertions suggested by subpolicies When no subpolicy suggests an insertion, When no subpolicy suggests an insertion,

obey most restrictive subpolicy suggestion obey most restrictive subpolicy suggestion

Irrelevant OK

Replace(v1)Replace(v2)

…Replace(v3)

Exception Halt

Least restrictive Most restrictive

Policy netPoly = new Conjunction(new FirewallPoly(), new LogSocketsPoly(), new WarnB4DownloadPoly());

08/06/0708/06/07 5050/58/58

Selector CombinatorsSelector Combinators Make some initial choice about which Make some initial choice about which

subpolicy to enforce and forget about subpolicy to enforce and forget about the other subpoliciesthe other subpolicies

IsClientSignedIsClientSigned: Enforce first subpolicy : Enforce first subpolicy if and only if target is if and only if target is cryptographically signedcryptographically signed

Policy sandboxUnsigned = new IsClientSigned( new TrivialPolicy(), new SandboxPolicy());

08/06/0708/06/07 5151/58/58

Unary CombinatorsUnary Combinators

Perform some extra operations while Perform some extra operations while enforcing a single subpolicyenforcing a single subpolicy

AutoUpdateAutoUpdate: Obey sole subpolicy but : Obey sole subpolicy but also intermittently check for also intermittently check for subpolicy updatessubpolicy updates

08/06/0708/06/07 5252/58/58

Case StudyCase Study Polymer policy for email clients that use the Polymer policy for email clients that use the

JavaMail APIJavaMail API– 1539 lines of Polymer code, available at1539 lines of Polymer code, available at

http://www.cs.princeton.edu/sip/projects/polymerhttp://www.cs.princeton.edu/sip/projects/polymer

Tested on Pooka Tested on Pooka [http://www.suberic.net/pooka][http://www.suberic.net/pooka]– Approx. 50K lines of Java code + librariesApprox. 50K lines of Java code + libraries (Java standard libraries, JavaMail, JavaBeans (Java standard libraries, JavaMail, JavaBeans

Activation Framework, JavaHelp, The Knife mbox Activation Framework, JavaHelp, The Knife mbox provider, Kunststoff Look and Feel, and ICE JNI provider, Kunststoff Look and Feel, and ICE JNI library)library)

08/06/0708/06/07 5353/58/58

Email Policy HierarchyEmail Policy HierarchyRelated policyRelated policyconcerns areconcerns aremodularizedmodularized => =>1) Easier to 1) Easier to

create the create the policypolicy- Modules are - Modules are reusablereusable

- Modules can - Modules can be written in be written in isolationisolation

2) Easier to 2) Easier to understand the understand the policypolicy

3) Easier to 3) Easier to update the update the policypolicy

08/06/0708/06/07 5454/58/58





08/06/0708/06/07 5555/58/58

SummarySummary Long-term research goal:Long-term research goal:

Whenever possible, generate efficient and Whenever possible, generate efficient and provably effective mechanisms to enforce provably effective mechanisms to enforce conveniently specified policiesconveniently specified policies

Results:Results:– Defined what it means for a monitor to enforce a policyDefined what it means for a monitor to enforce a policy– Analyzed which of the increasingly complex policies Analyzed which of the increasingly complex policies

that need to be enforced can be with monitorsthat need to be enforced can be with monitors– Made it easier to specify and generate complex Made it easier to specify and generate complex

monitorsmonitors

08/06/0708/06/07 5656/58/58

Future Research Future Research Directions Directions (Specification (Specification

Technologies)Technologies) Develop languages for safely and Develop languages for safely and

easily specifying many types of easily specifying many types of policiespolicies– Transactional policiesTransactional policies– Fault-tolerance policiesFault-tolerance policies

Create GUIs for visualizing and Create GUIs for visualizing and specifying policy compositions and specifying policy compositions and dynamic policy updatesdynamic policy updates

08/06/0708/06/07 5757/58/58

Future Research DirectionsFuture Research Directions(Policy Analysis and Enforcement)(Policy Analysis and Enforcement)

Generalize formal models for:Generalize formal models for:– Real-time policiesReal-time policies– ConcurrencyConcurrency– More “active” monitorsMore “active” monitors

(monitor triggers application, not vice versa)(monitor triggers application, not vice versa) Place resource bounds on mechanismsPlace resource bounds on mechanisms Decompose general policies into Decompose general policies into

practically enforceable static and practically enforceable static and dynamic policiesdynamic policies

08/06/0708/06/07 5858/58/58

EndEnd

Thanks / Questions?

08/06/0708/06/07 5959/58/58

Extra SlidesExtra Slides

08/06/0708/06/07 6060/58/58

Implementation NumbersImplementation Numbers Polymer sizePolymer size

– 30 core classes (approx. 2500 lines of Java) + 30 core classes (approx. 2500 lines of Java) + JavaCC + Apache BCELJavaCC + Apache BCEL

(Unoptimized) Performance (Unoptimized) Performance – Instrument all Java core libraries = 107s = 3.7 ms Instrument all Java core libraries = 107s = 3.7 ms

per methodper method– Typical class loading time = 12 ms Typical class loading time = 12 ms

(vs. 6 ms with default class loader) (vs. 6 ms with default class loader) – Monitored method call = 0.6 ms overheadMonitored method call = 0.6 ms overhead– Policy code’s performance typically dominates costPolicy code’s performance typically dominates cost

08/06/0708/06/07 6161/58/58

Case-study constraintsCase-study constraints OutgoingMail OutgoingMail

– logs all mail being sentlogs all mail being sent– pops up a window confirming email recipientspops up a window confirming email recipients– back up messages by BCCing everything to back up messages by BCCing everything to

[email protected]@cs.princeton.edu– Appends contact info to all mailAppends contact info to all mail

IncomingMailIncomingMail– Logs all incoming mailLogs all incoming mail– Runs a spam filterRuns a spam filter– Truncates long subject linesTruncates long subject lines– Warns before opening a message with an Warns before opening a message with an

attachmentattachment

mailto:[email protected]

08/06/0708/06/07 6262/58/58

Edit Automata Edit Automata EnforcementEnforcement

(Lower Bound)(Lower Bound) Theorem: Theorem: policies P such that policies P such that

1. P is a renewal policy, 1. P is a renewal policy, 2. P( 2. P(●●), and ), and 3. 3. ssA* A* :: P(s) is decidable, P(s) is decidable, an edit automaton that enforces P. an edit automaton that enforces P.

Edit automata can enforce any reasonable renewal policy

08/06/0708/06/07 6363/58/58


(Lower Bound)(Lower Bound) Proof idea: Technique of suppressing actions Proof idea: Technique of suppressing actions

until they are known to be safe causes every until they are known to be safe causes every valid prefix, and only valid prefixes, of the valid prefix, and only valid prefixes, of the input to be outputinput to be output– Given a renewal policy Given a renewal policy PP, construct an edit , construct an edit

automaton automaton XX that uses this technique that uses this technique– In all cases, In all cases, XX correctly enforces correctly enforces PP

If input If input ss has finite length, has finite length, XX outputs longest valid prefix outputs longest valid prefix of of ss

Else if Else if PP((ss), ), XX outputs the longest valid (finite) prefix of outputs the longest valid (finite) prefix of ss Else if Else if PP((ss), ), XX outputs every prefix of outputs every prefix of ss and only prefixes and only prefixes

of of ss

08/06/0708/06/07 6464/58/58

““Transforms” DefinitionTransforms” Definition Definition: Definition: Automaton X = ( Q,qAutomaton X = ( Q,q00,t ) ,t ) transformstransforms

input sinput sAA∞∞ into output u into output uAA∞∞ iff iff

1. 1. q’q’Q Q s’s’AA∞∞ u’u’AA* :* : if (qif (q00,s) ,s) XX u’u’ (q’,s’) then u’ ≤ u (q’,s’) then u’ ≤ u

(On input (On input ss, , XX outputs outputs onlyonly prefixes of prefixes of u)u)

2. 2. u’≤uu’≤uq’q’QQ s’s’AA∞∞ : : (q (q00,s) ,s) XX u’u’ (q’,s’) (q’,s’)(On input (On input ss, , XX outputs outputs everyevery prefix of prefix of uu))

((qq00,,ss) ) X X uu

08/06/0708/06/07 6565/58/58


Edit automata enforce Edit automata enforce exactlyexactly the set of the set of reasonable renewal policies, except for a reasonable renewal policies, except for a corner case that allows some valid infinite corner case that allows some valid infinite executions to have finitely many valid prefixesexecutions to have finitely many valid prefixes

ExampleExample– PP((ss) iff ) iff ss==aa11;;aa11;;aa11;…;…– PP is not a renewal policy is not a renewal policy– Monitor enforces Monitor enforces PP by always entering an by always entering an

infinite loop to insert infinite loop to insert aa11;;aa11;;aa11;…;…

08/06/0708/06/07 6666/58/58


Enforcing an “almost renewal” policy Enforcing an “almost renewal” policy requires automaton having input requires automaton having input sequence sequence ss’ to decide:’ to decide:– only one extension only one extension ss of of ss’ is valid’ is valid– ss has infinite length has infinite length– how to compute the actions in how to compute the actions in ss

Aside from this situation, edit Aside from this situation, edit automata enforce automata enforce exactlyexactly the set of the set of renewal policiesrenewal policies

08/06/0708/06/07 6767/58/58

Precedence CombinatorsPrecedence Combinators

Give one subpolicy precedence over Give one subpolicy precedence over anotheranother

DominatesDominates: Obey first subpolicy if it : Obey first subpolicy if it considers the action relevant; otherwise considers the action relevant; otherwise obey whatever second subpolicy obey whatever second subpolicy suggestssuggests

TryWithTryWith: Obey first subpolicy if and only : Obey first subpolicy if and only if it returns an Irrelevant, OK, or if it returns an Irrelevant, OK, or Insertion suggestionInsertion suggestion

08/06/0708/06/07 6868/58/58

Design of Media-Player Design of Media-Player PolicyPolicy

08/06/0708/06/07 6969/58/58

Decomposing the Example Decomposing the Example into Safety and Livenessinto Safety and Liveness

ATM must log before and after dispensing cashATM must log before and after dispensing cashand may only log before and after dispensing cash:and may only log before and after dispensing cash:Valid executions = (logBegin(n); dispense(n); logEnd(n))Valid executions = (logBegin(n); dispense(n); logEnd(n))∞∞

PPSS((ss) ) ss matches one of: matches one of:– (logBegin(n);dispense(n);logEnd(n))*;logBegin(n)(logBegin(n);dispense(n);logEnd(n))*;logBegin(n)– (logBegin(n);dispense(n);logEnd(n))*;logBegin(n);dispense(n)(logBegin(n);dispense(n);logEnd(n))*;logBegin(n);dispense(n)– (logBegin(n);dispense(n);logEnd(n))(logBegin(n);dispense(n);logEnd(n))∞∞

PPLL((ss) ) ss≠≠ss’;logBegin(n) and ’;logBegin(n) and ss≠≠ss’logBegin(n);dispense(n)’logBegin(n);dispense(n)

Documents

08/06/071/58 Runtime Software Monitoring Jay Ligatti, University of South Florida Joint work with: Lujo Bauer, CMU CyLab David Walker, Princeton University