Synthesizing Enforcement Monitors wrt. the Safety-Progress Classification of Properties

Yliès Falcone (1, 2, 3) , Jean-Claude Fernandez (1, 4) , Laurent Mounier (1)

1 VERIMAG - IMAG - VERIMAG
2 IMAG - Institut d'Informatique et de Mathématiques Appliquées de Grenoble
3 LIG - Laboratoire d'Informatique de Grenoble
4 LSR - IMAG - Laboratoire Logiciels Systèmes Réseaux

Runtime enforcement is a powerful technique to ensure that a program will respect a given security policy. We extend previous works on this topic in several directions. Firstly, we propose a generic notion of enforcement monitors based on a memory device and finite sets of control states and enforcement operations. Moreover, we specify their enforcement abilities w.r.t. the general safety-progress classification of properties. It allows a fine-grain characterization of the space of enforceable properties. Finally, we propose a systematic technique to produce an enforcement monitor from the Streett automaton recognizing a given safety, guarantee, obligation or response security property.

Domaines: Systèmes embarqués; Système d'exploitation [cs.OS]; Réseaux et télécommunications [cs.NI]

Yliès Falcone, Jean-Claude Fernandez, Laurent Mounier. Synthesizing Enforcement Monitors wrt. the Safety-Progress Classification of Properties. ICISS'08: International Conference on Information Systems Security, 2008, pp.41-55. ⟨hal-00346063⟩