论文标题
自动证明无特权升级的微动物从其可执行
Automatically Proving Microkernels Free from Privilege Escalation from their Executable
论文作者
论文摘要
操作系统内核是大多数计算机系统的安全钥匙到底，因为它们提供了核心保护机制。内核特别负责自己的安全性，即，他们必须防止不受信任的用户任务达到其特权水平。我们证明，证明缺乏特权升级是任何确定性安全证明内核的先决条件。 While prior OS kernel formal verifications were performed either on source code or crafted kernels, with manual or semi-automated methods requiring significant human efforts in annotations or proofs, we show that it is possible to compute such kernel security proofs using fully-automated methods and starting from the executable code of an existing microkernel with no modification, thus formally verifying absence of privilege escalation with high confidence for a low cost.我们将方法应用于两个嵌入式的微核，包括工业内核匿名者：只有58行的注释和少于10分钟的计算，我们的方法在第一个（错误）版本的匿名者中找到了一个漏洞，并验证了第二个版本中缺乏特权升级。
Operating system kernels are the security keystone of most computer systems, as they provide the core protection mechanisms. Kernels are in particular responsible for their own security, i.e. they must prevent untrusted user tasks from reaching their level of privilege. We demonstrate that proving such absence of privilege escalation is a pre-requisite for any definitive security proof of the kernel. While prior OS kernel formal verifications were performed either on source code or crafted kernels, with manual or semi-automated methods requiring significant human efforts in annotations or proofs, we show that it is possible to compute such kernel security proofs using fully-automated methods and starting from the executable code of an existing microkernel with no modification, thus formally verifying absence of privilege escalation with high confidence for a low cost. We applied our method on two embedded microkernels, including the industrial kernel AnonymOS: with only 58 lines of annotation and less than 10 minutes of computation, our method finds a vulnerability in a first (buggy) version of AnonymOS and verifies absence of privilege escalation in a second (secure) version.
