Blame-aware recomposition extends secure compilation proofs to low-level isolation
Original title: Blame-aware Recomposition for Secure Compilation Proofs of Low-Level Compartment Isolation
The technique allows compartments to observe each other's code and is applied to a tag-based reference monitor.
A cs.CR paper extends Abate et al.'s secure-compilation proof so it works when low-level compartments can fully observe each other's code. An overlay semantics treats those observations as undefined behaviour, and blame-aware recomposition still supports the recomposition step used in higher-level proofs because the observing context is discarded. The authors apply the proof to compartment isolation enforced by a programmable tag-based reference monitor.
- Existing verified compilers for compartmentalized C assume a built-in protection mechanism.
- Standard recomposition fails because it requires hiding each compartment's code.
- Blame-aware recomposition discards the observing low-level context after recomposition.
From the original article
1 min read at arxiv.orgThe security guarantees of existing formally verified compilers for compartmentalized programs in unsafe languages like C stop at a rather high level, assuming a built-in protection mechanism and a block-based memory model. Verifying a concrete, low-level enforcement mechanism for compartment isolation is still a major challenge for current proof techniques. In particular, Abate et al.'
By Basile Schlosser · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.