A static analysis for quantifying information flow in a simple imperative language

Abstract

We propose an approach to quantify interference in a simple imperative language that includes a looping construct. In this paper we focus on a particular case of this definition of interference: leakage of information from private variables to public ones via a Trojan Horse attack. We quantify leakage in terms of Shannon's information theory and we motivate our definition by proving a result relating this definition of leakage and the classical notion of programming language interference. The major contribution of the paper is a quantitative static analysis based on this definition for such a language. The analysis uses some non-trivial information theory results like Fano's inequality and L1 inequalities to provide reasonable bounds for conditional statements. While-loops are handled by integrating a qualitative flow-sensitive dependency analysis into the quantitative analysis.

A semiring-based trace semantics for processes with applications to information leakage analysis

“…A highly desirable outcome of this effort would be the automatic checking of enforcement via either model checking or program analysis. So far, the efforts have lead to some notable progress for simple imperative languages [13,21,20,4,10]. By contrast, progress for process algebras has been notably slower.…”

“…In declassification, a program may be declared as acceptable if information can flow from high to low but only in prescribed ways [11,24]. In more recent years, attempts have been made to provide methods to quantify the amount of leaked information, mostly building on information-theoretic or probabilistic tools [12,13,8,6]. Then a program may be declared as acceptable if the information it leaks does not exceed a prescribed threshold.…”

Quantifying leakage in the presence of unreliable sources of information

“…There seems to be a general consensus in the literature for using Shannon entropy to measure uncertainty and mutual information to quantify information leakage [35,36,14,37,33]. We remind the reader that these approaches aim at quantifying information flow as a reduction of the adversary uncertainty about the high input and take no account of the adversary's initial belief.…”

Maximizing entropy over Markov processes

“…The difference between the information, in Shannon's information-theoretical sense [5], that a given attacker possesses about the secret before and after a single attack is called leakage [4]. Different attackers would infer different amount of information.…”

“…Quantitative Information Flow techniques can be employed to precisely quantify the number of bits of information an attacker would gain about the confidential data of a system by interacting with the system and observing its behavior [4], leaving to the analyst to decide whether this amount is acceptable for the protocol analyzed.…”