Policy Dependent and Independent Information Flow Analyses

M. Töws,H. Wehrheim

DOI: https://doi.org/10.1007/978-3-319-68690-5_22

2017-11-13

Abstract:

What problem does this paper attempt to address?

Analysis for Real-time Intransitive Information Flow Security Properties

Yong Huang,Lingdi Ping,Shanping Li,Xuezeng Pan

DOI: https://doi.org/10.4304/jsw.4.1.90-97

2009-01-01

Journal of Software

Abstract:Real-time information flow security properties such as timed noninterference provide assurances that some time dependent information flows may not become possible. However, with transitive noninterference formulation, it is difficult to deal with intransitive flow policies like channel control and secure downgrading of information with time constraints. In this paper, we introduce the notion of trust domain into Timed Secure Process Algebra (tSPA), extending intransitive noninterference to real-time systems. Based on weak timed bisimulation equivalence, some security properties for intransitive flow are reformulated in a realtime setting, in particular one property which is persistent, meaning that if a system is secure then all of its reachable states are secure too. Furthermore, we prove that such persistent intransitive timed property is compositional, which is thus possible to alleviate the state space explosion problem caused by the interleaving of all the possible executions of parallel processes. Finally, we provide one case study showing that it is possible to model and analyze the real-time system through our approach.
Analysis for Intransitive Noninterference Security Properties in Probabilistic Systems

姜励,平玲娣,陈小平,潘雪增,李善平

DOI: https://doi.org/10.3785/j.issn.1008-973x.2008.12.010

2008-01-01

Abstract:The concept of trust domain was introduced into probabilistic secure process algebra(PSPA),and the intransitive noninterference information flow security model was extended to probabilistic systems to implement many important security policies such as secure downgrading of probabilistic information and channel control.Intransitive probabilistic information flow security properties were analyzed based on the probabilistic weak bisimulation equivalence.Intransitive bisimulation strong probabilistic noninterference(I_BSPNI) and intransitive probabilistic bisimulation-based nondeducibility on composition(I_PBNDC) were presented.To expose the potential secure problem that I_PBNDC cannot discover in dynamic context,the persistent I_PBNDC property was proposed,which required that every reachable state of the system must satisfy I_PBNDC.The properties like bisimulation-based nondeducibility on composition are difficult to prove.To overcome this shortcoming,strong I_PBNDC property was defined in terms of unwinding conditions demanding properties of individual actions.Finally,the relations between these properties were given and proved.
A Multi-Compositional Enforcement on Information Flow Security

Cong Sun,Ennan Zhai,Zhong Chen,Jianfeng Ma

DOI: https://doi.org/10.1007/978-3-642-25243-3_28

2011-01-01

Abstract:Interactive/Reactive computational model is known to be proper abstraction of many pervasively used systems, such as clientside web-based applications. The critical task of information flow control mechanisms aims to determine whether the interactive program can guarantee the confidentiality of secret data. We propose an efficient and flow-sensitive static analysis to enforce information flow policy on program with interactive I/Os. A reachability analysis is performed on the abstract model after a form of transformation, called multi-composition, to check the conformance with the policy. In the multi-composition we develop a store-match pattern to avoid duplicating the I/O channels in the model, and use the principle of secure multi-execution to generalize the security lattice model which is supported by other approaches based on automated verification. We also extend our approach to support a stronger version of termination-insensitive noninterference. The results of preliminary experiments show that our approach is more precise than existing flow-sensitive analysis and the cost of verification is reduced through the store-match pattern.
Handling Dynamic Information Release

Li Jiang,Lingdi Ping,Xuezeng Pan

DOI: https://doi.org/10.1007/978-3-540-76788-6_6

2007-01-01

Abstract:Information flow and in particular noninterference ensure that sensitive information does not affect public information. But noninterference is too restrictive: real computing systems sometimes need to dynamically release certain amount of sensitive information. In this paper, we propose a new security property that requires the decision to perform information release have high integrity, and permits low integrity data which comes from untrusted sources to dynamically affect information release by upgrading (or endorsing) its integrity. To control such integrity upgrading, we introduce an endorsement mechanism that takes the form of a local integrity endorsing policy declaration. So the programmer can express more precise ways of endorsing, by specifying the integrity levels from which information may be endorsed. In addition, we show a new type system to enforce the security property.
Modes of Information Flow

Ryan G. James,Blanca Daniella Mansante Ayala,Bahti Zakirov,James P. Crutchfield

DOI: https://doi.org/10.48550/arXiv.1808.06723

2018-08-21

Abstract:Information flow between components of a system takes many forms and is key to understanding the organization and functioning of large-scale, complex systems. We demonstrate three modalities of information flow from time series X to time series Y. Intrinsic information flow exists when the past of X is individually predictive of the present of Y, independent of Y's past; this is most commonly considered information flow. Shared information flow exists when X's past is predictive of Y's present in the same manner as Y's past; this occurs due to synchronization or common driving, for example. Finally, synergistic information flow occurs when neither X's nor Y's pasts are predictive of Y's present on their own, but taken together they are. The two most broadly-employed information-theoretic methods of quantifying information flow---time-delayed mutual information and transfer entropy---are both sensitive to a pair of these modalities: time-delayed mutual information to both intrinsic and shared flow, and transfer entropy to both intrinsic and synergistic flow. To quantify each mode individually we introduce our cryptographic flow ansatz, positing that intrinsic flow is synonymous with secret key agreement between X and Y. Based on this, we employ an easily-computed secret-key-agreement bound---intrinsic mutual information&mdashto quantify the three flow modalities in a variety of systems including asymmetric flows and financial markets.

Statistical Mechanics,Cryptography and Security,Information Theory,Chaotic Dynamics
Nonmalleable Information Flow: Technical Report

Ethan Cecchetti,Andrew C. Myers,Owen Arden

DOI: https://doi.org/10.1145/3133956.3134054

2017-09-01

Abstract:Noninterference is a popular semantic security condition because it offers strong end-to-end guarantees, it is inherently compositional, and it can be enforced using a simple security type system. Unfortunately, it is too restrictive for real systems. Mechanisms for downgrading information are needed to capture real-world security requirements, but downgrading eliminates the strong compositional security guarantees of noninterference. We introduce nonmalleable information flow, a new formal security condition that generalizes noninterference to permit controlled downgrading of both confidentiality and integrity. While previous work on robust declassification prevents adversaries from exploiting the downgrading of confidentiality, our key insight is transparent endorsement, a mechanism for downgrading integrity while defending against adversarial exploitation. Robust declassification appeared to break the duality of confidentiality and integrity by making confidentiality depend on integrity, but transparent endorsement makes integrity depend on confidentiality, restoring this duality. We show how to extend a security-typed programming language with transparent endorsement and prove that this static type system enforces nonmalleable information flow, a new security property that subsumes robust declassification and transparent endorsement. Finally, we describe an implementation of this type system in the context of Flame, a flow-limited authorization plugin for the Glasgow Haskell Compiler.

Cryptography and Security,Programming Languages
Information Flow for Security in Control Systems

Sean Weerakkody,Bruno Sinopoli,Soummya Kar,Anupam Datta

DOI: https://doi.org/10.48550/arXiv.1603.05710

2016-03-18

Abstract:This paper considers the development of information flow analyses to support resilient design and active detection of adversaries in cyber physical systems (CPS). The area of CPS security, though well studied, suffers from fragmentation. In this paper, we consider control systems as an abstraction of CPS. Here, we extend the notion of information flow analysis, a well established set of methods developed in software security, to obtain a unified framework that captures and extends system theoretic results in control system security. In particular, we propose the Kullback Liebler (KL) divergence as a causal measure of information flow, which quantifies the effect of adversarial inputs on sensor outputs. We show that the proposed measure characterizes the resilience of control systems to specific attack strategies by relating the KL divergence to optimal detection techniques. We then relate information flows to stealthy attack scenarios where an adversary can bypass detection. Finally, this article examines active detection mechanisms where a defender intelligently manipulates control inputs or the system itself in order to elicit information flows from an attacker's malicious behavior. In all previous cases, we demonstrate an ability to investigate and extend existing results by utilizing the proposed information flow analyses.

Systems and Control
Tool-Supported Architecture-Based Data Flow Analysis for Confidentiality

Felix Schwickerath,Nicolas Boltz,Sebastian Hahner,Maximilian Walter,Christopher Gerking,Robert Heinrich

2023-08-03

Abstract:Through the increasing interconnection between various systems, the need for confidential systems is increasing. Confidential systems share data only with authorized entities. However, estimating the confidentiality of a system is complex, and adjusting an already deployed software is costly. Thus, it is helpful to have confidentiality analyses, which can estimate the confidentiality already at design time. Based on an existing data-flow-based confidentiality analysis concept, we reimplemented a data flow analysis as a Java-based tool. The tool uses the software architecture to identify access violations based on the data flow. The evaluation for our tool indicates that we can analyze similar scenarios and scale for certain scenarios better than the existing analysis.

Software Engineering,Cryptography and Security
Information Flow in Logical Environments

Robert E. Kent

DOI: https://doi.org/10.48550/arXiv.1603.03475

2016-03-10

Logic in Computer Science

Abstract:This paper describes information flow within logical environments. The theory of information flow, the logic of distributed systems, was first defined by Barwise and Seligman (Information Flow: The Logic of Distributed Systems. 1997). Logical environments are a semantic-oriented version of institutions. The theory of institutions, which was initiated by Goguen and Burstall (Institutions: Abstract Model Theory for Specification and Programming. 1992), is abstract model theory. Information flow is the flow of information in channels over distributed systems. The semantic integration of distributed systems, be they ontologies, databases or other information resources, can be defined in terms of the channel theory of information flow. As originally defined, the theory of information flow uses only a specific logical environment in order to discuss information flow. This paper shows how information flow can be defined in an arbitrary logical environment.
Quantifying information flow in quantum processes

Leonardo Santos,Zhen-Peng Xu,Jyrki Piilo,Otfried Gühne

2024-03-05

Abstract:We present a framework for quantifying information flow within general quantum processes. For this purpose, we introduce the signaling power of quantum channels and discuss its relevant operational properties. This function supports extensions to higher order maps, enabling the evaluation of information flow in general quantum causal networks and also processes with indefinite causal order. Furthermore, our results offer a rigorous approach to information dynamics in open systems that applies also in the presence of initial system-environment correlations, and allows for the distinction between classical and quantum information backflow.

Quantum Physics
Logic of Information Flow on Communication Channels

Yanjing Wang,Floor Sietsma,Jan van Eijck

DOI: https://doi.org/10.1007/978-3-642-20715-0_8

2010-01-01

Abstract:In this paper, we develop an epistemic logic for specifying and reasoning about information flow on the underlying communication channels. By combining ideas from Dynamic Epistemic Logic (DEL) and Interpreted Systems (IS), our semantics offers a natural and neat way of modeling multi-agent communication scenarios with different assumptions about the observational power of agents. We relate our logic to the standard DEL and IS approaches and demonstrate its use by studying a telephone call communication scenario.
An Extensible Framework for Architecture-Based Data Flow Analysis for Information Security

Nicolas Boltz,Sebastian Hahner,Christopher Gerking,Robert Heinrich

2024-03-14

Abstract:The growing interconnection between software systems increases the need for security already at design time. Security-related properties like confidentiality are often analyzed based on data flow diagrams (DFDs). However, manually analyzing DFDs of large software systems is bothersome and error-prone, and adjusting an already deployed software is costly. Additionally, closed analysis ecosystems limit the reuse of modeled information and impede comprehensive statements about a system's security. In this paper, we present an open and extensible framework for data flow analysis. The central element of our framework is our new implementation of a well-validated data-flow-based analysis approach. The framework is compatible with DFDs and can also extract data flows from the Palladio architectural description language. We showcase the extensibility with multiple model and analysis extensions. Our evaluation indicates that we can analyze similar scenarios while achieving higher scalability compared to previous implementations.

Software Engineering,Cryptography and Security
Prudent Design Principles for Information Flow Control

Iulia Bastys,Frank Piessens,Andrei Sabelfeld

DOI: https://doi.org/10.1145/3264820.3264824

2018-01-15

Abstract:Recent years have seen a proliferation of research on information flow control. While the progress has been tremendous, it has also given birth to a bewildering breed of concepts, policies, conditions, and enforcement mechanisms. Thus, when designing information flow controls for a new application domain, the designer is confronted with two basic questions: (i) What is the right security characterization for a new application domain? and (ii) What is the right enforcement mechanism for a new application domain? This paper puts forward six informal principles for designing information flow security definitions and enforcement mechanisms: attacker-driven security, trust-aware enforcement, separation of policy annotations and code, language-independence, justified abstraction, and permissiveness. We particularly highlight the core principles of attacker-driven security and trust-aware enforcement, giving us a rationale for deliberating over soundness vs. soundiness. The principles contribute to roadmapping the state of the art in information flow security, weeding out inconsistencies from the folklore, and providing a rationale for designing information flow characterizations and enforcement mechanisms for new application domains.
Output-sensitive Information flow analysis

Cristian Ene,Laurent Mounier,Marie-Laure Potet

DOI: https://doi.org/10.48550/arXiv.1909.09567

2019-09-20

Cryptography and Security

Abstract:Constant-time programming is a countermeasure to prevent cache based attacks where programs should not perform memory accesses that depend on secrets. In some cases this policy can be safely relaxed if one can prove that the program does not leak more information than the public outputs of the computation. We propose a novel approach for verifying constant-time programming based on a new information flow property, called output-sensitive noninterference. Noninterference states that a public observer cannot learn anything about the private data. Since real systems need to intentionally declassify some information, this property is too strong in practice. In order to take into account public outputs we proceed as follows: instead of using complex explicit declassification policies, we partition variables in three sets: input, output and leakage variables. Then, we propose a typing system to statically check that leakage variables do not leak more information about the secret inputs than the public normal output. The novelty of our approach is that we track the dependence of leakage variables with respect not only to the initial values of input variables (as in classical approaches for noninterference), but taking also into account the final values of output variables. We adapted this approach to LLVM IR and we developed a prototype to verify LLVM implementations.
Symbolic Quantitative Information Flow for Probabilistic Programs

Philipp Schröer,Francesca Randone,Raúl Pardo,Andrzej Wąsowski

2024-12-02

Abstract:It is of utmost importance to ensure that modern data intensive systems do not leak sensitive information. In this paper, the authors, who met thanks to Joost-Pieter Katoen, discuss symbolic methods to compute information-theoretic measures of leakage: entropy, conditional entropy, Kullback-Leibler divergence, and mutual information. We build on two semantic frameworks for symbolic execution of probabilistic programs. For discrete programs, we use weakest pre-expectation calculus to compute exact symbolic expressions for the leakage measures. Using Second Order Gaussian Approximation (SOGA), we handle programs that combine discrete and continuous distributions. However, in the SOGA setting, we approximate the exact semantics using Gaussian mixtures and compute bounds for the measures. We demonstrate the use of our methods in two widely used mechanisms to ensure differential privacy: randomized response and the Gaussian mechanism.

Cryptography and Security
Information Flow Within Stochastic Dynamical Systems.

X. San Liang

DOI: https://doi.org/10.1103/physreve.78.031113

2008-01-01

Abstract:Information flow or information transfer is an important concept in general physics and dynamical systems which has applications in a wide variety of scientific disciplines. In this study, we show that a rigorous formalism can be established in the context of a generic stochastic dynamical system. An explicit formula has been obtained for the resulting transfer measure, which possesses a property of transfer asymmetry and, if the stochastic perturbation to the receiving component does not rely on the giving component, has a form the same as that for the corresponding deterministic system. This formula is further illustrated and validated with a two-dimensional Langevin equation. A remarkable observation is that, for two highly correlated time series, there could be no information transfer from one certain series, say x_{2} , to the other (x_{1}) . That is to say, the evolution of x_{1} may have nothing to do with x_{2} , even though x_{1} and x_{2} are highly correlated. Information flow analysis thus extends the traditional notion of correlation analysis and/or mutual information analysis by providing a quantitative measure of causality between dynamical events.
A Precise Information Flow Measure from Imprecise Probabilities

Sari Haj Hussein

DOI: https://doi.org/10.48550/arXiv.1206.5487

2012-06-24

Cryptography and Security

Abstract:Dempster-Shafer theory of imprecise probabilities has proved useful to incorporate both nonspecificity and conflict uncertainties in an inference mechanism. The traditional Bayesian approach cannot differentiate between the two, and is unable to handle non-specific, ambiguous, and conflicting information without making strong assumptions. This paper presents a generalization of a recent Bayesian-based method of quantifying information flow in Dempster-Shafer theory. The generalization concretely enhances the original method removing all its weaknesses that are highlighted in this paper. In so many words, our generalized method can handle any number of secret inputs to a program, it enables the capturing of an attacker's beliefs in all kinds of sets (singleton or not), and it supports a new and precise quantitative information flow measure whose reported flow results are plausible in that they are bounded by the size of a program's secret input, and can be easily associated with the exhaustive search effort needed to uncover a program's secret information, unlike the results reported by the original metric.
The Liang-Kleeman Information Flow: Theory and Applications.

X. San Liang

DOI: https://doi.org/10.3390/e15010327

IF: 2.738

2013-01-01

Entropy

Abstract:Information flow, or information transfer as it may be referred to, is a fundamental notion in general physics which has wide applications in scientific disciplines. Recently, a rigorous formalism has been established with respect to both deterministic and stochastic systems, with flow measures explicitly obtained. These measures possess some important properties, among which is flow or transfer asymmetry. The formalism has been validated and put to application with a variety of benchmark systems, such as the baker transformation, Hénon map, truncated Burgers-Hopf system, Langevin equation, etc. In the chaotic Burgers-Hopf system, all the transfers, save for one, are essentially zero, indicating that the processes underlying a dynamical phenomenon, albeit complex, could be simple. (Truth is simple.) In the Langevin equation case, it is found that there could be no information flowing from one certain time series to another series, though the two are highly correlated. Information flow/transfer provides a potential measure of the cause–effect relation between dynamical events, a relation usually hidden behind the correlation in a traditional sense.
Information Flow as an Emergent Property of Divergence in Phase-Space

Praveen Kumar

2023-09-26

Abstract:Recent developments have created the ability to quantify information flow among components that interact in a dynamical system, and have led to significant advances in characterizing the dependence between the variables involved. In particular, they have been used to characterize causal dependency and feedback using observations across diverse fields such as environment, climate, finance, and human health. What causes information flow among coupled components of a dynamical system? This fundamental question has remained unanswered so far. Here it is established that the information flow is an emergent response resulting from the divergence of trajectories in phase-space of a dynamical system. This finding shows that the dynamics encapsulated in the traditional expression of Liouville equation, which neglects this divergence, merely propagates the dependence encoded in the initial conditions. However, when this is not the case, the informational dependence between the components change creating an information flow. This finding has significant implications in a variety of fields, both for the interpretation of observational data for causal inference in natural dynamics, and design of systems with targeted informational dependency.

Data Analysis, Statistics and Probability,Statistical Mechanics
Algebraic Foundations for Information Theoretical, Probabilistic and Guessability measures of Information Flow

Pasquale Malacaria

DOI: https://doi.org/10.48550/arXiv.1101.3453

2011-01-18

Abstract:Several mathematical ideas have been investigated for Quantitative Information Flow. Information theory, probability, guessability are the main ideas in most proposals. They aim to quantify how much information is leaked, how likely is to guess the secret and how long does it take to guess the secret respectively. In this paper, we show how the Lattice of Information provides a valuable foundation for all these approaches; not only it provides an elegant algebraic framework for the ideas, but also to investigate their relationship. In particular we will use this lattice to prove some results establishing order relation correspondences between the different quantitative approaches. The implications of these results w.r.t. recent work in the community is also investigated. While this work concentrates on the foundational importance of the Lattice of Information its practical relevance has been recently proven, notably with the quantitative analysis of Linux kernel vulnerabilities. Overall we believe these works set the case for establishing the Lattice of Information as one of the main reference structure for Quantitative Information Flow.

Information Theory

Policy Dependent and Independent Information Flow Analyses

Analysis for Real-time Intransitive Information Flow Security Properties

Analysis for Intransitive Noninterference Security Properties in Probabilistic Systems

A Multi-Compositional Enforcement on Information Flow Security

Handling Dynamic Information Release

Modes of Information Flow

Nonmalleable Information Flow: Technical Report

Information Flow for Security in Control Systems

Tool-Supported Architecture-Based Data Flow Analysis for Confidentiality

Information Flow in Logical Environments

Quantifying information flow in quantum processes

Logic of Information Flow on Communication Channels

An Extensible Framework for Architecture-Based Data Flow Analysis for Information Security

Prudent Design Principles for Information Flow Control

Output-sensitive Information flow analysis

Symbolic Quantitative Information Flow for Probabilistic Programs

Information Flow Within Stochastic Dynamical Systems.

A Precise Information Flow Measure from Imprecise Probabilities

The Liang-Kleeman Information Flow: Theory and Applications.

Information Flow as an Emergent Property of Divergence in Phase-Space

Algebraic Foundations for Information Theoretical, Probabilistic and Guessability measures of Information Flow