Side Channel Analysis Using a Model Counting Constraint Solver and Symbolic Execution (Invited Talk)
نویسنده
چکیده
A crucial problem in software security is the detection of side-channels [5, 2, 7]. Information gained by observing non-functional properties of program executions (such as execution time or memory usage) can enable attackers to infer secret information (such as a password). In this talk, I will discuss how symbolic execution, combined with a model counting constraint solver, can be used for quantifying side-channel leakage in Java programs. In addition to computing information leakage for a single run of a program, I will also discuss computation of information leakage for multiple runs for a type of side channels called segmented oracles [3]. In segmented oracles, the attacker is able to explore each segment of a secret (for example each character of a password) independently. For segmented oracles, it is possible to compute information leakage for multiple runs using only the path constraints generated from a single run symbolic execution. These results have been implemented as an extension to the symbolic execution tool Symbolic Path Finder (SPF) [8] using the SMT solver Z3 [4] and two model counting constraint solvers LattE [6] and ABC [1]. 1998 ACM Subject Classification D.4.6 Security and Protection, Verification, D.2.4 Software/Program Verification, Formal Methods
منابع مشابه
Evaluation of String Constraint Solvers Using Dynamic Symbolic Execution
Symbolic execution is a path sensitive program analysis technique used for error detection and test case generation. Symbolic execution tools rely on constraint solvers to determine the feasibility of program paths and generate concrete inputs for feasible paths. Therefore, the effectiveness of such tools depends on their constraint solvers. Most modern constraint solvers for primitive data typ...
متن کاملModel Counting Modulo Theories
This thesis is concerned with the quantitative assessment of security in software. More specifically, it tackles the problem of efficient computation of channel capacity, the maximum amount of confidential information leaked by software, measured in Shannon entropy or Rényi’s min-entropy. Most approaches to computing channel capacity are either efficient and return only (possibly very loose) up...
متن کاملSymbolic execution of oating point computations
Symbolic execution is a classical program testing technique which evaluates a se lected control ow path with symbolic input data A constraint solver can be used to enforce the satis ability of the extracted path conditions as well as to derive test data Whenever path conditions contain oating point computations a common strategy consists of using a constraint solver over the rationals or the re...
متن کاملPex-White Box Test Generation for .NET
Pex automatically produces a small test suite with high code coverage for a .NET program. To this end, Pex performs a systematic program analysis (using dynamic symbolic execution, similar to pathbounded model-checking) to determine test inputs for Parameterized Unit Tests. Pex learns the program behavior by monitoring execution traces. Pex uses a constraint solver to produce new test inputs wh...
متن کاملSymbolic execution of floating-point computations
Symbolic execution is a classical program testing technique which evaluates a selected control flow path with symbolic input data. A constraint solver can be used to enforce the satisfiability of the extracted path conditions as well as to derive test data. Whenever path conditions contain floating-point computations, a common strategy consists of using a constraint solver over the rationals or...
متن کامل