Belief Semantics of Authorization Logic

1. Belief Semantics of Authorization Logic Andrew Hirsch and Michael Clarkson George Washington University Cornell University ACM Conference on Computer and Communications Security November 6, 2013

2. Formal Reasoning about Authorization Standard policies: DAC, MAC, … Formula-based policies: • determine access decision on basis of whether properties hold • specify why access should be permitted • useful in distributed systems Top Secret Secret No read up No write down Confidential Unclassified Clarkson: Belief Semantics of Authorization Logic

3. Credentials-based Authorization a.k.a. claims-based authorization and proof-carrying authorization [Abadi, Burrows, Lampson & Plotkin 1991; Bauer, Schneider & Felten 2003; Schneider 2013] Credential:claim or belief about world f,y,… formulas in authorization logic Clarkson: Belief Semantics of Authorization Logic

4. Credentials-based Authorization a.k.a. claims-based authorization and proof-carrying authorization [Abadi, Burrows, Lampson & Plotkin 1991; Bauer, Schneider & Felten 2003; Schneider 2013] Goal formula: must be satisfied to grant request f,y,… a Clarkson: Belief Semantics of Authorization Logic

5. Credentials-based Authorization a.k.a. claims-based authorization and proof-carrying authorization [Abadi, Burrows, Lampson & Plotkin 1991; Bauer, Schneider & Felten 2003; Schneider 2013] f,y,… a Guard: uses logical inference to derive goal formula from credentials Clarkson: Belief Semantics of Authorization Logic

6. Credentials-based Authorization a.k.a. claims-based authorization and proof-carrying authorization [Abadi, Burrows, Lampson & Plotkin 1991; Bauer, Schneider & Felten 2003; Schneider 2013] f,y,… a Guard: uses logical inference to derive goal formula from credentials this work: increase trustworthiness of reasoning in authorization logic Clarkson: Belief Semantics of Authorization Logic

7. Increased Trustworthiness • New belief semantics for authorization logic purpose of semantics: interpret formulas in model of real world standard Kripke semantics: requires technical machinery not related to real world belief semantics: way to interpret formulas in a straightforward, systems-oriented model; belief subsumes Kripke • Sound proof system for both semantics proof system “has no bugs” found unsoundness in existing logic • Machine-checked proof of soundness proof that “proof system ‘has no bugs’” itself has no bugs Clarkson: Belief Semantics of Authorization Logic

8. FOCAL FOCAL • First-Order: • Quantifiers: ∀∃ • Functions, relations • Constructive: • Connectives: ∧ ∨ ⇒ ¬ • Authorization Logic: • Attribution of beliefs: says • Delegation: speaksfor = NAL -- [Schneider, Walsh & Sirer 2011] = CDD ++ [Abadi 2007] Clarkson: Belief Semantics of Authorization Logic

9. FOCAL • First-Order: • Quantifiers: ∀∃ • Functions, relations • Constructive: • connectives: ∧ ∨ ⇒ ¬ • Authorization Logic: • Attribution of beliefs: says • Delegation: speaksfor = NAL -- [Schneider, Walsh & Sirer 2011] = CDD ++ [Abadi 2007] this talk ignores FOC fragment Clarkson: Belief Semantics of Authorization Logic

10. Authorization Logic (Review) Two distinguishing features: • Attribute beliefs to principals p says f • source matters: p says f and q says f aren’t the same • not all-seeing: f holds doesn’t mean p says f • not infallible: maybe p says f but f doesn’t hold says “winter is coming” Clarkson: Belief Semantics of Authorization Logic

11. Authorization Logic (Review) Two distinguishing features: • Attribute beliefs to principals p says f How do principals form beliefs? • Start with initial beliefs • Add to beliefs by: • querying state of system • receiving credentials from other principals • Infer new beliefs by logical inference from existing beliefs • Worldview: snapshot of principal’s beliefs[Schneider, Walsh & Sirer 2011] Clarkson: Belief Semantics of Authorization Logic

12. Authorization Logic (Review) Two distinguishing features: • Enable delegation between principals p speaksfor q …if p says something, it’s as if q says it, too q p • worldview(p) ⊆ worldview(q) on {treaties} speaksfor so the king delegates to the envoy Clarkson: Belief Semantics of Authorization Logic restricted delegation

13. Authorization Logic (Review) King says Envoy speaksfor King Envoy says OpenChest therefore Envoy speaksfor King therefore King says OpenChest therefore goal formula satisfied and chest is opened Goal formula: King says OpenChest Clarkson: Belief Semantics of Authorization Logic

14. Trustworthiness of Reasoning Q: How do we know reasoning is right? A: Formal proof system: mechanical reasoning ⊢y Clarkson: Belief Semantics of Authorization Logic

15. Trustworthiness of Reasoning Q: How do we know reasoning is right? A: Formal proof system: mechanical reasoning Q: How do we know proof system is right? A: Proof of soundness: system is consistent with some model of reality ⊢y Clarkson: Belief Semantics of Authorization Logic

16. Trustworthiness of Reasoning Q: How do we know reasoning is right? A: Formal proof system: mechanical reasoning Q: How do we know proof system is right? A: Proof of soundness: system is consistent with some model of reality Q: How do we get that model? A: Needsemantics:how to interpret formulas …The more natural the model, the better. ⊢y ⊨ y Our new belief semantics… Clarkson: Belief Semantics of Authorization Logic

17. Belief Semantics Use possible worlds to model system state facts: It’s cloudy in Berlin. x=42. TCP port 443 is open. facts: It’s cloudy in Berlin. x=43. TCP port 443 is open. Clarkson: Belief Semantics of Authorization Logic

18. Belief Semantics Each principal p has its own worldview w(w,p) at world w [Konolige 1983; Burrows, Abadi & Needham 1988; Appel & Felten 1999;Schneider, Walsh & Sirer 2011] Why include w as parameter to w? …so that beliefs can depend on system state w(w, princess) w(w, envoy) w(w, king) f∊w(w,p) means: at world w, p believesf Clarkson: Belief Semantics of Authorization Logic

19. Belief Semantics Belief model B: • worldviews w Worldviews must be closed under logical consequence …principals believe all consequences of their beliefs • …machinery for first-order logic • …machinery for constructive logic validity judgment: B,w ⊨ y Clarkson: Belief Semantics of Authorization Logic

20. Belief Semantics Clarkson: Belief Semantics of Authorization Logic

21. Belief Semantics B,w ⊨ p says fifff ∊ w(w,p) (simplified to avoid machinery of constructive FOL) Clarkson: Belief Semantics of Authorization Logic

22. Belief Semantics q B,w ⊨ p speaksfor qiffw(w,p) ⊆ w(w,q) p • worldview(p) ⊆ worldview(q) (simplified to avoid machinery of constructive FOL) Clarkson: Belief Semantics of Authorization Logic

23. Other Semantics for Authorization Logic? Usual semantics is based on Kripkesemantics of modal logic …because says is like ◽ [Abadi, Burrows, Lampson & Plotkin 1991; Howell 2000; Garg& Abadi2008; Garg 2008; Genovese, Garg & Rispoli 2012] Clarkson: Belief Semantics of Authorization Logic

24. Kripke Semantics (Review) K,w⊨ p says f iff for all worlds w’ such that w ≤p w’ : K,w’ ⊨ f ≤p (accessibility relation) w ≤p w’ means: given information in world w, p considers world w’ possible Clarkson: Belief Semantics of Authorization Logic

25. Belief Semantics vs. Kripke Semantics belief semantics: Kripke semantics: B,w ⊨ p says fifff ∊ w(w,p) K,w ⊨ p says fifffor all w’ : w ≤p w’ implies K,w’ ⊨f Belief semantics directly captures intuition about sets of beliefs… Kripke semantics doesn’t;indirects through accessibility relations Clarkson: Belief Semantics of Authorization Logic

26. Belief Semantics vs. Kripke Semantics belief semantics: Kripke semantics: B,w ⊨ p speaksfor qiffw(w,p) ⊆ w(w,q) K,w ⊨ p speaksfor qiff≤p ⊇ ≤q Again, belief semantics directly capturesintuition about sets of beliefs Just an issue of style? …belief semantics more faithfully model reality Clarkson: Belief Semantics of Authorization Logic

27. Belief Semantics vs. Kripke Semantics Which is more expressive? Theorem.Every Kripke structure K can be transformed into an equivalent belief structure B. At each world, form the set of all formulas said by a principal in K. Make that the principal’s worldview in B. Clarkson: Belief Semantics of Authorization Logic

28. Belief Semantics vs. Kripke Semantics Which is more expressive? Theorem.Every Kripke structure K can be transformed into an equivalent belief structure B. Theorem.There exist belief structures that cannot be transformed into equivalent Kripke structures. Clarkson: Belief Semantics of Authorization Logic

29. Belief Semantics vs. Kripke Semantics Which is more expressive? Theorem.Every Kripke structure K can be transformed into an equivalent belief structure B. Theorem.There exist belief structures that cannot be transformed into equivalent Kripke structures. Belief Kripke Clarkson: Belief Semantics of Authorization Logic

30. Belief Semantics vs. Kripke Semantics Which is more expressive? Theorem.Every Kripke structure K can be transformed into an equivalent belief structure B. Theorem.There exist belief structures that cannot be transformed into equivalent Kripke structures. …so belief semantics subsume Kripke semantics Clarkson: Belief Semantics of Authorization Logic

31. FOCAL Proof System Proof theory: calculate with formulas G ⊢ f (derivability judgment) as opposed to… Semantics: interpret meaning of formulas B,w ⊨ f (validity judgment) Clarkson: Belief Semantics of Authorization Logic

32. FOCAL Proof System Clarkson: Belief Semantics of Authorization Logic

33. FOCAL Proof System Natural deduction proof system with localized hypotheses Rules themselves are well-known but this seems to be a mildly novel combination Clarkson: Belief Semantics of Authorization Logic

34. Soundness Theorem.If f is derivable from G, then f is valid in any (belief or Kripke) model of G. Proof. Mechanized in Coq. (about 2,400 LoC) First mechanized proof of soundness for authorization logic! …increases trustworthiness of logic Clarkson: Belief Semantics of Authorization Logic

35. Soundness Nexus Authorization Logic (NAL)[Schneider, Walsh & Sirer 2011] • Has a formal proof system • Has an informal semantics (worldviews, main inspiration for FOCAL) Fact: NAL proof system permits derivation of a formula that is • invalid in our formal belief semantics • not intended to be valid by NAL designers …NAL is unsound (but easily fixed) Formal semantics and proofs of soundness yield a more trustworthy logic! Clarkson: Belief Semantics of Authorization Logic

36. Related Work • CDD [Abadi 2007] • NAL [Schneider, Walsh & Sirer 2011] • ICL [Garg & Abadi 2008] • DTL0 [Garg 2008] • BLsf[Genovese, Garg & Rispoli 2012] • Unnamed logics [Garg & Pfenning 2006] [Howell 2000] • Many other logics and systems:Taos, PCA, SPKI/SDSI, Delegation Logic, Cassandra, PolicyMaker, Referee, KeyNote, SD3, Binder, Soutei, SecPAL, DKAL, Alpaca, WS-Policy, Grey, … FOCAL builds on many of these, and makes new contributions… Clarkson: Belief Semantics of Authorization Logic

37. Summary • FOCAL: first order constructive authorization logic • First formal belief semantics for authorization logic • Transformation from Kripke semantics to belief semantics • Belief subsumes Kripke • Sound proof system for both semantics • Found unsoundness in existing logic • First machine-checked proof of soundness for authorization logic …increased trustworthiness of authorization logic Clarkson: Belief Semantics of Authorization Logic

38. Belief Semantics of Authorization Logic Andrew Hirsch and Michael Clarkson George Washington University Cornell University ACM Conference on Computer and Communications Security November 6, 2013

39. Future Work • Completeness • Verified theorem checker • Semantics of group principals Clarkson: Belief Semantics of Authorization Logic

40. Extra Slides Clarkson: Belief Semantics of Authorization Logic

41. Completeness of FOCAL? Starting points to get completeness result: • ICL[Garg & Abadi 2008]: uses different (lax logic) semantics of says • DTL0[Garg 2008]: doesn’t have speaksfor • BLsf[Genovese, Garg & Rispoli 2012]: uses different (strong) semantics of speaksfor Clarkson: Belief Semantics of Authorization Logic

42. Weak Speaksfor Weak speaksfor: p speaksfor q iff“for all f” : p says f ⇒ q says f Kripke semantics of speaksforare stronger[Howell 2000](principals speak for one another less often) • WSF condition in our paper is ugly but needed to make Kripke semantics behave • Might eliminate WSF by introducing some second-order model theory Clarkson: Belief Semantics of Authorization Logic

43. FOCAL vs. NAL NAL: Schneider, Walsh & Sirer2011 FOCAL = NAL– 2nd order quantification + primitive speaksfor – restricted delegation – subprincipals – group principals simplicity open! Clarkson: Belief Semantics of Authorization Logic

44. FOCAL vs. CDD CDD: Abadi 2007 FOCAL = CDD– 2nd order quantification + primitive speaksfor + 1st order quantification & terms Clarkson: Belief Semantics of Authorization Logic

45. Belief vs. Knowledge • FOCAL (et al.) is a logic of belief • principals who issue credentials are expressing a belief about state of system • they might be wrong • they might be malicious • Logic of knowledgewould impose axiom: (p says f)⇒f Clarkson: Belief Semantics of Authorization Logic

46. Healthiness Conditions (Belief) • Worldview closure: principals believe all consequences of their beliefs • Says transparency: any number of says is equivalent to just one says • Belief hand-off: ensure validity of hand-off: (q says (p speaksfor q)) ⇒ (p speaksfor q) Clarkson: Belief Semantics of Authorization Logic

47. Healthiness Conditions (Kripke) • IT: principal accessibility relations are “intuitionistically” transitive • ID: principal accessibility relations are “intuitionistically” dense • F2: technical condition from constructive modal logic literature to achieve soundness • H: ensure validity of hand-off • WSF: weak speaksforto get equivalence with belief semantics Clarkson: Belief Semantics of Authorization Logic

48. Countermodel for Belief →Kripke w: B,w ⊨ p says X What can ≤p be? • If empty, then p says false, but false isn’t in w(w,p) • If w ≤p w, then K,w ⊭ p says X, but X is in w(w,p) Either way, Kripke semantics is not equivalent to belief semantics X does not hold w(w,p) = {X} Clarkson: Belief Semantics of Authorization Logic