Information flow in nondeterministic systems

Wittbold, J.T.; Johnson, Dale

doi:10.1109/risp.1990.63846

Cited by 198 publications

(155 citation statements)

References 6 publications

Supporting

Mentioning

155

Contrasting

Order By: Relevance

“…However, since we do not analyze the internal structure of systems (it is unavailable to the auditor), our approach can be applied to other models. We limit our discussion to deterministic systems since there are many competing generalizations of noninterference to the nondeterministic setting (e.g., [46][47][48]), but the main competitors collapse into standard noninterference in the deterministic case [49].…”

Section: Relationship With Noninterferencementioning

confidence: 99%

Purpose Restrictions on Information Use

Tschantz

Datta

Wing

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Privacy policies in sectors as diverse as Web services, finance and healthcare often place restrictions on the purposes for which a governed entity may use personal information. Thus, automated methods for enforcing privacy policies require a semantics of purpose restrictions to determine whether a governed agent used information for a purpose. We provide such a semantics using a formalism based on planning. We model planning using Partially Observable Markov Decision Processes (POMDPs), which supports an explicit model of information. We argue that information use is for a purpose if and only if the information is used while planning to optimize the satisfaction of that purpose under the POMDP model. We determine information use by simulating ignorance of the information prohibited by the purpose restriction, which we relate to noninterference. We use this semantics to develop a sound audit algorithm to automate the enforcement of purpose restrictions.

show abstract

Section: Relationship With Noninterferencementioning

confidence: 99%

Purpose Restrictions on Information Use

Tschantz

Datta

Wing

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Early approaches focus on quantifying the capacity of covert channels between processes in multi-user systems [23,38,54]. The models predate the first published side-channel attack against cryptography [26] and are so general that it is unclear how they could be instantiated to address the problem at hand.…”

Section: Related Workmentioning

confidence: 99%

Automatically deriving information-theoretic bounds for adaptive side-channel attacks

Köpf

Basin

2011

JCS

View full text Add to dashboard Cite

We present a model of adaptive attacks which we combine with information-theoretic metrics to quantify the information revealed to an adaptive adversary. This enables us to express an adversary's remaining uncertainty about a secret as a function of the number of interactions with the system under attack. We present algorithms and approximation methods for computing this function. The main application area for our approach is the analysis of side-channels in cryptographic algorithms and we give examples of how it can be used to characterize the vulnerability of hardware implementations to timing and power attacks. We also show the generality of our approach by using it to quantify the information leaked by a security protocol.

show abstract

“…Several notions of noninterference have been designed to analyze sequential programs and concurrent systems (see, e.g., [25,12,22]). For instance, one of these properties, called strong nondeterministic noninterference and formalized in the CCS process algebraic setting [12], establishes whether the view of the system behavior as observed by a low-level user when the system interacts with high-level users is the same -according to weak bisimulation equivalence ≈ B [20] -as that observed by the low-level user in the absence of high-level users.…”

Section: Noninterference Analysismentioning

confidence: 99%

Weak Behavioral Equivalences for Verifying Secure and Performance-Aware Component-Based Systems

Aldini

Bernardo

2009

Architecting Dependable Systems VI

View full text Add to dashboard Cite

Abstract. Component-based systems are characterized by several orthogonal requirements, ranging from security to quality of service, which may demand for the use of opposite strategies and interfering mechanisms. To achieve a balanced tradeoff among these aspects, we have previously proposed the use of a predictive methodology, which encompasses classical tools such as the noninterference approach to security analysis and standard performance evaluation techniques. The former tool, which is based on equivalence checking, is used to reveal functional dependencies among component behaviors, while the latter tool, which relies on reward-based numerical analysis, is used to study the quantitative impact of these dependencies on the system performance. In order to strengthen the relation between these two different analysis techniques we advocate the use of performance-aware notions of behavioral equivalence as a formal means for detecting functional and performance dependencies and then pinpointing the metrics at the base of a balanced tradeoff. Trading Security with PerformanceOne of the major issues in the design of modern computing systems is trading dependability aspects with the expected quality of service [16,10,15]. A balanced tradeoff is particularly hard to accomplish when the dependability aspect of interest is security and the system under analysis requires the interaction of several, possibly untrusted components performing their activities in wide-area, public networks. As an example, it is commonly recognized that lightweight securing infrastructures like those employed for access control in the setting of the IEEE 802.11 standard for wireless local area networks [26] are able to mitigate the impact of the securing mechanisms on quality of service parameters, such as system throughput and response time, still preserving to a specific extent the properties for which they are introduced.Examples such as this emphasize the importance of integrating the different qualitative and quantitative views of a system in order to understand whether a reasonable balance can be achieved between the satisfaction of security requirements and the expected quality of service. However, foundational approaches to the analysis of secure and performance-aware systems have not successfully

show abstract

Information flow in nondeterministic systems

Cited by 198 publications

References 6 publications

Purpose Restrictions on Information Use

Purpose Restrictions on Information Use

Automatically deriving information-theoretic bounds for adaptive side-channel attacks

Weak Behavioral Equivalences for Verifying Secure and Performance-Aware Component-Based Systems

Contact Info

Product

Resources

About