Privilege separation is an effective technique to improve software security. However, past partitioning systems do not allow programmers to make quantitative tradeoffs between security and performance. In this paper, we describe our toolchain called PM. It can automatically find the optimal boundary in program partitioning. This is achieved by solving an integer-programming model that optimizes for a user-chosen metric while satisfying the remaining security and performance constraints on other metrics. We choose security metrics to reason about how well computed partitions enforce information flow control to: (1) protect the program from low-integrity inputs or (2) prevent leakage of program secrets. As a result, functions in the sensitive module that fall on the optimal partition boundaries automatically identify where declassification is necessary. We used PM to experiment on a set of real-world programs to protect confidentiality and integrity; results show that, with moderate user guidance, PM can find partitions that have better balance between security and performance than partitions found by a previous tool that requires manual declassification.
|Original language||English (US)|
|Title of host publication||CCS 2019 - Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security|
|Publisher||Association for Computing Machinery|
|Number of pages||18|
|State||Published - Nov 6 2019|
|Event||26th ACM SIGSAC Conference on Computer and Communications Security, CCS 2019 - London, United Kingdom|
Duration: Nov 11 2019 → Nov 15 2019
|Name||Proceedings of the ACM Conference on Computer and Communications Security|
|Conference||26th ACM SIGSAC Conference on Computer and Communications Security, CCS 2019|
|Period||11/11/19 → 11/15/19|
Bibliographical noteFunding Information:
We thank anonymous reviewers and our shepherd, Lorenzo DeCarli, for their insightful comments. This research is based upon work supported by US NSF grants CNS-1801534, CCF-1723571, CNS-1408826, CNS-1816282, CNS-1408880, CNS-1526319, as well as a gift from Intel. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of any of the above organizations or any person connected with them.
© 2019 Copyright held by the owner/author(s). Publication rights licensed to ACM.
- Automatic program partitioning
- Integer programming
- Privilege separation