Hostname: page-component-8448b6f56d-wq2xx Total loading time: 0 Render date: 2024-04-23T19:37:09.572Z Has data issue: false hasContentIssue false
  • English
  • Français

A semiring-based trace semantics for processes with applications to information leakage analysis

Published online by Cambridge University Press:  10 November 2014

MICHELE BOREALE ,
DAVID CLARK  and
DANIELE GORLA
MICHELE BOREALE
Affiliation:
Dipartimento di Statistica, Informatica, Applicazioni – Univ. di Firenze. Viale Morgagni 65, 50134 Firenze, Italy Email: boreale@dsi.unifi.it
DAVID CLARK
Affiliation:
Department of Computer Science, University College London, Gower Street, WC1E 6BT London, United Kingdom Email: david.clark@ucl.ac.uk
DANIELE GORLA
Affiliation:
Dip. di Informatica – Univ. di Roma ‘La Sapienza’. Via Salaria 113, 00198 Roma, Italy Email: gorla@di.uniroma1.it
Get access Rights & Permissions [Opens in a new window]

Abstract

We propose a framework for reasoning about program security building on language-theoretic and coalgebraic concepts. The behaviour of a system is viewed as a mapping from traces of high (unobservable) events to low (observable) events: the less the degree of dependency of low events on high traces, the more secure the system. We take the abstract view that low events are drawn from a generic semiring, where they can be combined using product and sum operations; throughout the paper, we provide instances of this framework, obtained by concrete instantiations of the underlying semiring. We specify systems via a simple process calculus, whose semantics is given as the unique homomorphism from the calculus into the set of behaviours, i.e. formal power series, seen as a final coalgebra. We provide a compositional semantics for the calculus in terms of rational operators on formal power series and show that the final and the compositional semantics coincide. This compositional, syntax-driven framework lays a foundation for automation and abstraction of a quantified approach to flow security of system specifications.

Type
Special Issue: Quantitative Information Flow
Information
Mathematical Structures in Computer Science , Volume 25 , Issue 2: Quantitative Information Flow , February 2015 , pp. 259 - 291
Copyright
Copyright © Cambridge University Press 2014 

Access options

Get access to the full version of this content by using one of the access options below. (Log in options will check for institutional or personal access. Content may require purchase if you do not have access.)

References

Aldini, A., Bravetti, M., Di Pierro, A., Gorrieri, R., Hankin, C. and Wiklicky, H. (2002) Two formal approaches for approximating noninterference properties. In: Proceedings of FOSAD. Springer Lecture Notes in Computer Science 2946 1–43.Google Scholar
Aldini, A., Bravetti, M. and Gorrieri, R. (2004) A process-algebraic approach for the analysis of probabilistic noninterference. Journal of Computer Security 12 (2)191–245.Google Scholar
Aldini, A. and Di Pierro, A. (2004) A quantitative approach to noninterference for probabilistic systems. Electronic Notes in Theoretical Computer Science 99 155–182.Google Scholar
Andrés, M. E., Palamidessi, C., van Rossum, P. and Smith, G. (2010) Computing the leakage of information-hiding systems. In: Proceedings of TACAS. Springer Lecture Notes in Computer Science 6015 373–389.Google Scholar
Backes, M. (2005) Quantifying probabilistic information flow in computational reactive systems. In: Proceedings of ESORICS. Springer Lecture Notes in Computer Science 3679 336–354.CrossRefGoogle Scholar
Bonchi, F., Bonsangue, M., Rutten, J. and Silva, A. (2009) Deriving syntax and axioms for quantitative regular behaviours. In: Proceedings of CONCUR. Springer Lecture Notes in Computer Science 5710 146–162.Google Scholar
Boreale, M., Clark, D. and Gorla, D. (2010) A semiring-based trace semantics for processes with applications to information leakage analysis. In: Proceedings of IFIP-TCS. IFIP AICT 323 340–354.Google Scholar
Boreale, M. and Gadducci, F. (2006) Processes as formal power series: A coinductive approach to denotational semantics. Theoretical Computer Science 360 (1–3)440–458.CrossRefGoogle Scholar
Boreale, M. (2009) Quantifying information leakage in process calculi. Information and Computation 207 (6)699–725.Google Scholar
Chatzikokolakis, K., Palamidessi, C. and Panangaden, P. (2008a) Anonymity protocols as noisy channels. Information and Computation 206 (2–4)378–401.Google Scholar
Chatzikokolakis, K., Palamidessi, C. and Panangaden, P. (2008b) On the bayes risk in information-hiding protocols. Journal of Computer Security 16 (5)531–571.Google Scholar
Chong, S. and Myers, A. C. (2004) Security policies for downgrading. In: Proceedings of CCS, ACM Press 189–209.Google Scholar
Clark, D., Hunt, S. and Malacaria, P. (2001) Quantitative analysis of the leakage of confidential data. Electronic Notes in Theoretical Computer Science 59 (3)238–251.Google Scholar
Clark, D., Hunt, S. and Malacaria, P. (2007) A static analysis for quantifying information flow in a simple imperative language. Journal of Computer Security 15 (3)321–371.Google Scholar
Desharnais, J., Jagadeesan, R., Gupta, V. and Panangaden, P. (2002) The metric analogue of weak bisimulation for probabilistic processes. In: Proceedings of LICS, IEEE Computer Society Press 413–422.Google Scholar
Douglas Mcilroy, M. (1999) Power series, power serious. Journal of Functional Programming 9 (3)325–337.Google Scholar
Focardi, R. and Gorrieri, R. (1995) A classification of security properties for process algebras. Journal of Computer Security 3 (1)5–33.CrossRefGoogle Scholar
Goguen, J. and Meseguer, J. (1982) Security policies and security models. In: Proceedings of Symposium on Security and Privacy, IEEE Computer Society Press 11–20.Google Scholar
Heusser, J. and Malacaria, P. (2010) Quantifying information leaks in software. In: Proceedings of ACSAC, ACM Press 261–269.Google Scholar
Hillston, J. (1996) A Compositional Approach to Performance Modelling, Cambridge University Press.CrossRefGoogle Scholar
Kocher, P. C. (1996) Timing attacks on implementations of diffie-hellman, rsa, dss, and other systems. In: Proceedings of CRYPTO'96. Springer Lecture Notes in Computer Science 1109 104–113.Google Scholar
Kocher, P. C., Jaffe, J. and Jun, B. (1999) Differential power analysis. In: Proceedings of CRYPTO. Springer Lecture Notes in Computer Science 1666 388–397.Google Scholar
Köpf, B. and Rybalchenko, A. (2010) Approximation and randomization for quantitative information-flow analysis. In: Proceedings of CSF, IEEE Computer Society Press 3–14.Google Scholar
Kuich, W. and Salomaa, A. (1986) Semirings, Automata, Languages, Monographs in Theoretical Computer Science, volume 5, Springer.Google Scholar
Lowe, G. (2002) Quantifying information flow. In: Proceedings of CSFW, IEEE Computer Society Press 18–31.Google Scholar
Mu, C. (2009) Measuring information flow in reactive processes. In: Proceedings of ICICS. Springer Lecture Notes in Computer Science 5927 211–225.Google Scholar
Mu, C. and Clark, D. (2009a) An interval-based abstraction for quantifying information flow. Electronic Notes in Theoretical Computer Science 253 (3)119–141.CrossRefGoogle Scholar
Mu, C. and Clark, D. (2009b) Quantitative analysis of secure information flow via probabilistic semantics. In: Proceedings of ARES, IEEE Computer Society Press 49–57.Google Scholar
Rutten, J. J. M. M. (2003) Behavioural differential equations: a coinductive calculus of streams, automata, and power series. Theoretical Computer Science 308 (1–3)1–53.Google Scholar
Sabelfeld, A. and Myers, A. C. (2003) Language-based information-flow security. IEEE Journal on Selelcted Areas in Communications 21 (1).Google Scholar
Sabelfeld, A. and Sands, D. (2005) Dimensions and principles of declassification. In: Proceedings of CSFW, IEEE Computer Society Press 255–269.Google Scholar
Wittbold, J. T. and Johnson, D. M. (1990) Information flow in nondeterministic systems. In: Proceedings of Symposium on Security and Privacy, IEEE Computer Society Press 144–161.Google Scholar