You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -4,6 +4,7 @@ \section{Introduction to \troupelang}
4
4
\troupelang\ is a research language, and as such is intended as a playground for research in
5
5
information flow control.
6
6
7
+
7
8
\subsection{Background and influence}
8
9
The design of \troupelang\ is influenced by a number of programming languages and systems. With respect to
9
10
security, our design draws heavily on the systems such as Fabric/Jif, LIO, and FLAM.
@@ -12,17 +13,78 @@ \subsection{Background and influence}
12
13
13
14
14
15
16
+
17
+
15
18
\subsection{Intended audience}
16
19
This guide is intended for researchers and graduate-level students\footnote{You have the authors' sympathies if your instructor makes you read this.} interested in \troupelang.
17
20
We assume that the reader is familiar with basic functional programming and the
18
21
core concepts of language-based information flow control such as noninterference.
19
22
20
-
\section{Basic features}
21
23
22
-
This guide assumes that \troupelang\ is installed on your system, with appropriately set environment variables.
24
+
\section{System architecture}
25
+
\label{sec:design}
26
+
This section describes the basic architecture of the Troupe system
27
+
and an overview of the programming model.
28
+
29
+
\subsection{Troupe architecture}
30
+
31
+
Two key concepts in Troupe's architecture are \emph{processes} and \emph{nodes}. A process is the primary unit of computation. Processes are lightweight and communicate with each other using message passing. Troupe processes run on Troupe nodes. A node is the primary unit of trust and corresponds to an instance of the Troupe runtime. Each node has a unique network identifier, and all communication between nodes is point-to-point encrypted using standard techniques.
32
+
33
+
34
+
To enforce information flow control in a decentralized fashion, Troupe combines the notions of standard security levels and \emph{trust} between nodes.
35
+
There are no special requirements on the underlying label model other than the standard requirements of the distinguished bottom and top elements, denoted~$\bot$ and~$\top$, operators for the least upper bound and the greatest lower bound, denoted~$\sqcup$ and~$\sqcap$ respectively, and the security ordering $\flowsto$.
36
+
37
+
Troupe nodes decide for themselves how much they trust other nodes.
38
+
Trust is specified via security levels. Every node fully trusts itself, corresponding to trust level~$\top$. Trust levels of selected few nodes are specified through runtime configuration. All other nodes have trust level~$\bot$. Such nodes are assumed to perform no security monitoring on their end. In particular, nodes that do not run Troupe runtime also have trust level~$\bot$ (communication with such nodes is possible for as long as they adhere to the serialization protocol). When communicating with $\bot$-trusted nodes, all data from received them is treated as public (i.e., confidentiality level $\bot$) and no confidential data can be sent to them.
39
+
40
+
In general, when node~$n_1$ trusts node~$n_2$ up to level~$\ell$ it means:
41
+
\begin{enumerate}
42
+
\item only data labeled up to~$\ell$ is sent from $n_1$ to $n_2$, and
43
+
\item data received from~$n_2$ by $n_1$ is attenuated to be at most~$\ell$.
44
+
\end{enumerate}
45
+
46
+
\noindent
47
+
The first item prevents sending sensitive information to nodes that are not trusted to protect it. The second item weakens security labels of untrusted nodes.
48
+
49
+
50
+
51
+
We note that trust between nodes may be asymmetric, but is implicitly transitive. Trust should also not be conflated with integrity -- in the current system we only focus on the confidentiality.
52
+
53
+
Figure~\ref{fig:troupe:architecture} illustrates three Troupe nodes, each running a few processes. The arrows in the figure correspond to the messages between processes. Messages within each node are delivered to processes directly, whereas messages between nodes are subject to inspection by the networking runtime based on the trust levels. % (cf. Section~\ref{sec:io:check}).
\caption{Nodes and processes in Troupe. The zigzagged line on the incoming message corresponds to message attenuation, the dashed line on the outgoing message corresponds to checking that the recipient is trusted to receive the message.
60
+
\label{fig:troupe:architecture}}
61
+
\end{figure}
62
+
63
+
64
+
65
+
\subsection{Tag-based label model}
66
+
The current version of Troupe uses a simple tag-based label model.
67
+
Tags are abstract identifiers, e.g., \tag{alice}, \tag{bob}, \tag{secret},
68
+
that specify confidentiality restrictions on data.
69
+
A security level is a set of tags, e.g.,
70
+
\lev{\tag{alice}, \tag{bob}}, or
71
+
\lev{\tag{alice, bob, charlie}}.
72
+
The more tags there are in the level the more restrictive is the data.
73
+
For example, the level
74
+
\lev{\tag{alice, bob}} is less restrictive than
75
+
\lev{\tag{alice, bob, charlie}}. The least restrictive level is the
76
+
empty set level \lev{}. When two levels are ordered we write
77
+
$\ell_1\sqsubseteq\ell_2$ to say that level $\ell_2$ is as restrictive
78
+
as $\ell_1$.
79
+
80
+
23
81
%
24
-
See Appendix~\ref{appendix:installationandconfig} for further
25
-
information on how to install and configure Troupe.
82
+
%{\bf Threat model}
83
+
%Troupe's threat model is one of the \emph{remote attackers} that only observes the messages sent to them or their absence. In particular, the adversary does not observe the state of the Troupe runtime, including local error messages or CPU usage. We also do not address traffic analysis attacks.
Troupe implements dynamic information flow control.
385
+
386
+
This section presents the inner workings of Troupe's security monitor. The monitor is fail-stop at the granularity of individual processes: monitor violation in a process terminates that process but does not affect other processes or nodes.
387
+
388
+
389
+
The monitor is designed to enforce a variant of progress-sen\-si\-tive
390
+
noninterference with declassification. Progress-sensitive baseline is chosen because Troupe is a concurrent system that runs untrusted code, making it possible to amplify leaks via progress/termination, e.g., by designating a process per bit.
391
+
%
392
+
In a dynamic system, such as Troupe, a progress leak may stem from several sources that includes divergence, blocking on input, or a runtime crash, such as evaluating the term {\tt 1 + ()}.
324
393
%
325
-
Information flow violations result in termination of a process,
394
+
%Troupe implements dynamic information flow control.
395
+
%
396
+
All information flow violations result in termination of a process,
326
397
unless the process is sandboxed.
327
398
328
-
\paragraph{Labeled values}
329
-
Every value in Troupe is \emph{deeply labeled} with confidentiality
330
-
levels. The security level of
331
-
a value specifies the confidentiality policy of the
332
-
value. Troupe uses the syntax \textcode{$\mathit{v}$@\lev{$\mathit{\ell_{\mathit{val}}}$}\%\lev{$\mathit{\ell_{\mathit{type}}}$}} to
333
-
denote that the value $\mathit{v}$ has security level
334
-
$\mathit{\ell_{\mathit{val}}}$, and the information about the type of this value is labeled at $\mathit{\ell_{\mathit{type}}}$.
335
399
336
400
337
401
338
402
403
+
\subsection{Privileged operations and authority}
404
+
\label{sec:infoflow:authority}
405
+
406
+
Troupe provides a set of privileged operations
407
+
such as declassifications or process registration. All privileged operations require special \emph{authority} values.
408
+
409
+
Authorities in Troupe are capabilities and are unforgeable.
410
+
%They are modeled after similar concepts in Jif~\cite{Jif} and Fabric~\cite{liu2017fabric}, LIO~\cite{LIO} (where they are known as privileges), and operating systems~\cite{HiStar,Asbestos,Flume}.
411
+
Operationally, authority is an encapsulated security level that we dub \emph{efficacy} of an authority\footnote{In standard nomenclature this is simply ``authority level''. However, because authorities in Troupe are values with the corresponding value and type levels, we use a different term to avoid confusion.}. The higher the efficacy level the more powerful is the authority.
412
+
%
413
+
System-wide privileged primitives, such as \textcode{register} in the echo-server example require the top authority, while declassification operations may use attenuated authority. Attenuation happens in one of the following two ways.
414
+
\label{sec:io:check}
415
+
416
+
\begin{enumerate}
417
+
\item
418
+
Programmatic attenuation takes place via a dedicated primitive \textcode{attenuate}. For example, expression \textcode{attenuate( authority, \lev{\ltag{alice}})} returns authority value with efficacy \ltag{\lev{alice}}. Programmatic attenuation helps programmers apply the principle of least privilege, for example, when passing authority to untrusted code that is allowed to perform some (but not all) declassifications.
419
+
420
+
\item Troupe runtime attenuates all levels and authority efficacies in remotely received data from $\ell$ to $\ell\sqcap\ell_{\mathit{trust}}$, where~$\ell_{\mathit{trust}}$ is the trust level of the sending node.
421
+
\end{enumerate}
339
422
340
423
341
-
\paragraph{Remark}
342
-
Current version of Troupe only enforces confidentiality
343
-
properties.
344
424
345
-
\subsection{Tag-based label model}
346
-
The current version of Troupe uses a simple tag-based label model.
347
-
Tags are abstract identifiers, e.g., \tag{alice}, \tag{bob}, \tag{secret},
348
-
that specify confidentiality restrictions on data.
349
-
A security level is a set of tags, e.g.,
350
-
\lev{\tag{alice}, \tag{bob}}, or
351
-
\lev{\tag{alice, bob, charlie}}.
352
-
The more tags there are in the level the more restrictive is the data.
353
-
For example, the level
354
-
\lev{\tag{alice, bob}} is less restrictive than
355
-
\lev{\tag{alice, bob, charlie}}. The least restrictive level is the
356
-
empty set level \lev{}. When two levels are ordered we write
357
-
$\ell_1\sqsubseteq\ell_2$ to say that level $\ell_2$ is as restrictive
358
-
as $\ell_1$.
359
425
426
+
In the beginning of program execution, Troupe runtime binds the top authority to the variable \textcode{authority} in the main program. This variable, however, is not in the scope of the code imported from libraries or received over the network. Such code needs to obtain authority explicitly.
360
427
361
428
429
+
430
+
431
+
%
432
+
%\paragraph{Remark}
433
+
%Current version of Troupe only enforces confidentiality
434
+
%properties.
435
+
%
436
+
%
362
437
\subsection{Monitoring for information flow}
438
+
439
+
440
+
441
+
\paragraph{Labeled values}
442
+
Every value in Troupe is \emph{deeply labeled} with confidentiality
443
+
levels. The security level of
444
+
a value specifies the confidentiality policy of the
445
+
value. Troupe uses the syntax \textcode{$\mathit{v}$@\lev{$\mathit{\ell_{\mathit{val}}}$}\%\lev{$\mathit{\ell_{\mathit{type}}}$}} to
446
+
denote that the value $\mathit{v}$ has security level
447
+
$\mathit{\ell_{\mathit{val}}}$, and the information about the type of this value is labeled at $\mathit{\ell_{\mathit{type}}}$.
448
+
363
449
A labeled value can be created using Troupe's \textcode{raisedTo}
364
450
primitive. Troupe's runtime propagates labels throughout the computation.
365
451
This section presents examples of label propagation via explicit flows, implicit flows, and
@@ -515,7 +601,7 @@ \subsection{Declassification and progress-sensitivity}
515
601
\label{sec:declassification}
516
602
To relax the constraints imposed by the information flow control, Troupe offers
517
603
a mechanism for \emph{declassification}.
518
-
\subsubsection{Authority}
604
+
%\subsubsection{Authority}
519
605
520
606
In Troupe, declassifying information requires a capability to declassify,
0 commit comments