Basile Schlosser, Jérémy Thibault, Cătălin Hriţcu · 2026 · arXiv (Cornell University)
DOI: 10.48550/arxiv.2610.26054 · cited by 0 works (OpenAlex) · open-access PDF
Die Sicherheitsgarantien bestehender formell verifizierter Compiler für compartmentalisierte Programme in unsicheren Sprachen wie C stoppen auf einem ziemlich hohen Niveau, unter der Annahme eines eingebauten Schutzmechanismus und eines blockbasierten Speichermodells. Die Überprüfung eines konkreten, niedrigen Durchsetzungsmechanismus für die Abteilungsisolation ist immer noch eine große Herausforderung für aktuelle Proof-Techniken. Insbesondere die Proof-Technik von Abate et al. scheitert, weil einer ihrer Proof-Schritte, Rekonstruktion, im Wesentlichen erfordert, alle Informationen über den Code jedes Abteilungs zu verbergen, was auf einem niedrigen Niveau praktisch nicht erreichbar ist. Wir schlagen eine Erweiterung ihrer Proof-Technik auf eine niedrige Einstellung vor,
Machine translation (Meta M2M100); the English original follows.
The security guarantees of existing formally verified compilers for compartmentalized programs in unsafe languages like C stop at a rather high level, assuming a built-in protection mechanism and a block-based memory model. Verifying a concrete, low-level enforcement mechanism for compartment isolation is still a major challenge for current proof techniques. In particular, Abate et al.'s proof technique fails because one of their proof steps, recomposition, essentially requires hiding all information about the code of each compartment, which is not practically achievable at a low level. We propose an extension of their proof technique to a low-level setting where compartments can fully observe each other's code. To do so, we introduce an overlay semantics that allows us to characterize these observations as a form of undefined behaviour, and we use a novel variant of recomposition that we call blame-aware recomposition, which essentially allows recomposing executions as needed in the original high-level proof technique, even if the low-level context observes the code, because this context is ultimately going to be discarded. We apply this new proof to a compartment isolation mechanism that uses a programmable tag-based reference monitor.
Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese
Topics: Mathematical proof, Computer science, Context (archaeology), Isolation (microbiology), Operational semantics, Programming language
GET https://store.agentexchange.work/gw/papers/verify?title=...&year=... (0.003 USD), fetch this record as JSON with /gw/papers/paper?id=2610.26054, or list what it cites with /gw/papers/references?id=.... Pay per call in USDC (x402) or with a 19 USD card key for 1,000 calls. Catalogue · llms.txtSources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange