No abstract

Abstract. A quantification of process's security by differential privacy is defined and studied in the framework of probabilistic process algebras. The resulting (quantitative) security properties are studied and compared with other (qualitative) security notions.

Process testing as a way to obtain information on confidential data is investigated. Our working formalism is based on an appropriate (probabilistic) process algebra and (probabilistic) testing. We define testing noninterference as well as sets of private actions which execution is guaranteed by a given test and sets of actions which execution could be excluded by a given test. Moreover, we relate obtained information to a size of the test.Qualitative security properties are often criticized for being either too restrictive or too benevolent. For example, a standard access control process should be considered insecure even if there always exists some (even very small) information flow which could help an attacker who tries to learn a password. By every attempt an attacker can learn, at least, what is not the correct one. On the other side, it can happen that the sets of excluded and/or gained (possible) passwords are empty but some passwords "almost" belong to some of these sets.There are several ways to overcome these disadvantages. An amount of leaked information could be expressed by means of the Shannon's information theory as it was done, for example, in [1, 2] for simple imperative languages and in [9] for process algebras. Another possibility is to exploit the probability theory as it was done for process algebras in [8]. In this way we can obtain quantification of information flow either as a number of bits of private information which could leak or as a probability that an intruder can learn some secrete property. Here we exploit the probabilistic process algebra (to describe either the test, tested process, or both) to express probabilities for private actions being in the set of gained or excluded actions.Moreover, we relate an amount of obtained information to the size of the test. The presented testing approach is strictly stronger then that of [7], which is based on simple process's observations. On the other side, bisimulation based approach, which is stronger, is often too strong and does not correspond to real(istic) possible intruders. Moreover, testing allow us, besides other advantages, to express security of a system with respect to size of the test which could jeopardize its security. Hence the resulting level of security gives us relevant information on real (practical) system security.The paper is organized as follows. Our working formalism, i.e. the probabilistic process algebra, is introduced in Section 2. In Section 3 we describe our testing scenario. In Sections 4 we define test based noninterference and in Section 5 the sets of gained and excluded actions by a given test. Section 6 is devoted to probabilistic tested noninterference.