Quantifying opacity

Abstract

Opacity is a general language-theoretic framework in which several security properties of a system can be expressed. Its parameters are a predicate, given as a subset of runs of the system, and an observation function, from the set of runs into a set of observables. The predicate describes secret information in the system and, in the possibilistic setting, it is opaque if its membership cannot be inferred from observation. In this paper, we propose several notions of quantitative opacity for probabilistic systems, where the predicate and the observation function are seen as random variables. Our aim is to measure (i) the probability of opacity leakage relative to these random variables and (ii) the level of uncertainty about membership of the predicate inferred from observation. We show how these measures extend possibilistic opacity, we give algorithms to compute them for regular secrets and observations, and we apply these computations on several classical examples. We finally partially investigate the non-deterministic setting. † Part of this work has been published in the proceedings of Qest'10 (Bérard et al. 2010).

Current-State Opacity Formulations in Probabilistic Finite Automata

“…The work in this paper devises appropriate measures to quantify opacity in a probabilistic setting and is motivated by the absence of likelihood information in most of the existing work on current-state opacity. Notable exceptions are the information-theoretic works in [9], [10], and more recently the work in [11] which we revisit once we have a chance to describe the contributions in this paper in more detail. We consider a scenario where we are given a stochastic discrete event system (SDES) that can be modeled as a probabilistic finite automaton (PFA) with partial observation on its transitions.…”

“…Our work in this paper is closely related to [11] which studies probabilistic automata with a terminating action, which effectively makes the probabilistic automaton a Markov chain with a single absorbing (sink) state. Among the four notions of opacity considered in [11], namely liberal probabilistic (symmetrical) opacity (LPO, LPSO) and restrictive probabilistic (symmetrical) opacity (RPO, RPSO), the most closely related to our work is the notion of liberal probabilistic opacity (LPO): LPO aims at evaluating the a priori probability that the system generates sequences of observations that allow the intruder to determine a violation of opacity.…”

“…The main difference is that in our work we consider arbitrary probabilistic automata without a requirement for a terminating condition. Note that the notions of step-based almost current-state opacity and probabilistic current-state opacity are quite different from the measures of opacity used in [11].…”

“…When probabilities are available, this type of problems can be more precisely analyzed using the framework of this paper. In the sequel, we discuss an example in the context of anonymity for web transactions which was initially studied in [8] (also in [11]) and show how this example can be analyzed using the probabilistic notions of opacity introduced in this paper.…”

“…(As we will see, this assumption is not restrictive but makes the notation in the subsequent discussion easier.) Using (11), for k ≥ m * , we have…”