Non-Interference Control Synthesis for Security Timed Automata

0000−0001−8473−9555] and Sun Jun 4[0000−0002−3545−1392]Abstract. Information leakage can have dramatic consequences on systems security. Among harmful information leaks, the timing information leakage is the ability for an attacker to deduce internal information depending on the system execution time. We address the following problem: given a timed system, synthesize the execution times for which one cannot deduce whether the system performed some secret behavior. We solve this problem in the setting of timed automata (TAs). We first provide a general solution, and then extend the problem to parametric TAs, by synthesizing internal timings making the TA secure. We study decidability, devise algorithms, and show that our method can also apply to program analysis.

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Parametric Timed Model Checking for Guaranteeing Timed Opacity

André¹,

Sun²

2019

“…Otherwise, if A e is false then Ψ e is true and thus (σ 11 , δ 11 ) ≡ Z(π(1)) (σ 12 , δ 12 ), because the two pairs are still low equivalent for the variables that are not used in the assignment of e, while the ones used in the assignment of e they do not appear in any condition (or expression) of an edge of a node q that belongs in π (1). 12 ) and the proof is completed using our induction hypothesis on t 2 . The proof of Main Case 1 follows by the result (a) of the fact from above, taking the path π that corresponds to the trace ( * ) and using that ( δ 2 ) and all the nodes in π except q k1 have edges whose conditions contain only low variables).…”

Section: Proof Of Lemmamentioning

confidence: 99%

“…To prove (a), let e = (q 01 , g → x := a: r, q 11 ) and note that because (σ 1 , δ 1 ) ≡ Z(π) (σ 2 , δ 2 ) and con(e) contains only low variables (since q 01 = q ∈ Q ;w and C1 (a)) it is immediate that there exists 12 . Now if l < n, to prove (b) we consider two cases.…”

Section: Proof Of Lemmamentioning

confidence: 99%

“…The authors of [17] define a notion of timed non-interference based on bisimulations for probabilistic timed automata which again have high-level (secret) and low-level (public) actions. A somewhat different approach is taken in [12] that studies the synthesis of controllers. None of those approaches considers timed automata that have data variables, nor is their notion of security able to accommodate systems that leak information intentionally.…”

Section: Contributionmentioning

confidence: 99%

See 1 more Smart Citation

Secure Information Release in Timed Automata

Vasilikos

Nielson

2018

Abstract.One of the key demands of cyberphysical systems is that they meet their safety goals. Timed automata has established itself as a formalism for modeling and analyzing the real-time safety aspects of cyberphysical systems. Increasingly it is also demanded that cyberphysical systems meet a number of security goals for confidentiality and integrity. Notions of security based on Information flow control, such as non-interference, provide strong guarantees that no information is leaked; however, many cyberphysical systems leak intentionally some information in order to achieve their purposes.In this paper, we develop a formal approach of information flow for timed automata that allows intentional information leaks. The security of a timed automaton is then defined using a bisimulation relation that takes account of the non-determinism and the clocks of timed automata. Finally, we define an algorithm that traverses a timed automaton and imposes information flow constraints on it and we prove that our algorithm is sound with respect to our security notion.

Timed Non-interference Under Partial Observability and Bounded Memory

Spriet,

Lime,

Roux

2023

Self Cite

We investigate a timed non-interference property for security systems modeled as timed automata, in which a low-security level user should not be able to deduce the occurrence of some high-security level actions. We assume an attack model in which the malicious (low-level) user has the ability to partially observe and memorize the set of runs of the timed automaton modeling the system. We first formalize a non-interference property that ensures the system security under such an attack model and we then prove the undecidability of that property when the attacker can have an arbitrarily big memory, i. e., when they are able to memorize sequences of previous observations, with time-stamps, of any length. We next assume bounded memory for the attacker and show that the property can then be decided in PSPACE for a subclass of timed automata ensuring finite duration between distinct observations.