A General Framework for Nondeterministic, Probabilistic, and Stochastic Noninterference

Abstract

Abstract. We introduce a notion of stochastic noninterference aimed at extending the classical approach to information flow analysis with finegrain information describing the temporal behavior of systems. In particular, we refer to a process algebraic setting that joins durational activities expressing time passing through exponentially distributed random variables, zero duration activities allowing for prioritized/probabilistic choices, and untimed activities with unspecified duration. In this setting unifying time, priority, probability, and nondeterminism, we highlight the expressive power of stochastic noninterference with respect to the existing definitions of nondeterministic and probabilistic noninterference. From this comparison, we obtain that stochastic noninterference turns out to be very strict and limiting in real-world applications and, therefore, requires the use of relaxation techniques. Among them we advocate performance evaluation as a means for achieving a reasonable balance between security requirements and quality. Fine-grain Models and NoninterferenceInformation flow analysis is a basic approach to the verification of security properties of systems which, in general, require to control who has access to what and when. Among the several conditions that describe the characteristics of unauthorized information flows, called covert channels, one of the most interesting, for its intuitive and wide-used idea, is the noninterference requirement [11]. Very briefly, in a multi-level secure system, the user at the high security level should not be able to affect what the user at the low security level can observe. Independently of the specific formalization of this notion, the underlying approach is based on the idea that checking noninterference is actually checking the indistinguishability of the different low-level views of the system that are obtained by changing the high-level behavior, see e.g. [22,9,17] and the references therein.Along the 90s generalized notions of noninterference were designed to analyze deterministic and nondeterministic systems. However, it was immediately clear that moving to a quantitative framework including fine-grain information, such as probability distributions associated with event execution, augments the distinguishing power of the observer [14,18,19,3]. More recently, the awareness that perfect noninterference is difficult to achieve has urged to estimate the information flow by employing this quantitative information and a relaxed notion of

Component-oriented verification of noninterference

“…For instance, with regard to our running example, since we have proved the compatibility between the router and the low receiver, with a minor effort we may immediately derive the compatibility between the router and several concurrent low receivers, which guarantees the preservation of the noninterference property. We conclude by observing that fine-grain information, such as probability distributions or temporal durations of events, can be added so as to augment the distinguishing power of the noninterference check (see, e.g., [17,5,3] and the references therein). To this aim, the noninterference notion must be defined in terms of behavioral equivalences like, e.g., weak probabilistic bisimilarity and weak Markovian bisimilarity.…”

Persistent Stochastic Non-Interference

“…This bisimulation is defined in the context of both discrete and continuous time Markov chains without any notion of compositionality, and hence of contextuality. Compositionality is considered in [2,5,9], where definitions of weak bisimilarities for stochastic process algebra based on the classical concept of weak action are proposed. Our approach shares with these bisimilarities the idea of ignoring the rates for non-synchronizing (labeled τ) transitions between a state and the others belonging to the same equivalence class.…”

“…Our approach shares with these bisimilarities the idea of ignoring the rates for non-synchronizing (labeled τ) transitions between a state and the others belonging to the same equivalence class. The main difference between our definition and those presented in [2,5,9] is that we explicitly studied the relationships between our lumpable bisimilarity at the process algebra level and the induced lumping of the underlying Markov chains. This led to a coinductive characterization of a notion of contextual lumpability as described in [21].…”

“…The notion of Non-Interference for deterministic systems has been introduced in [17] and it has been extended to non-deterministic systems. Non-Interference has been then studied in different settings such as programming languages [16,30,31], trace models [22,25], cryptographic protocols [1,6,13], process calculi [7,8,12,19,29], probabilistic models [2,10], timed models [14,18], and stochastic models [2].…”

Weak Behavioral Equivalences for Verifying Secure and Performance-Aware Component-Based Systems

“…The revised methodology is illustrated through its application to a running example based on a multilevel security routing system. The paper, which is an extended version of [3], is organized as follows. In Sect.…”