Automatic Discovery and Quantification of Information Leaks

被引：111

作者：

Backes, Michael ^{[1
]}

Koepf, Boris ^{[2
]}

Rybalchenko, Andrey ^{[2
]}

机构：

[1] Univ Saarland, Saarland, Germany

[2] MPI SWS, Kaiserslautern, Germany

来源：

PROCEEDINGS OF THE 2009 30TH IEEE SYMPOSIUM ON SECURITY AND PRIVACY | 2009年

关键词：

FLOW;

D O I：

10.1109/SP.2009.18

中图分类号：

TP301 [理论、方法];

学科分类号：

081202 ;

摘要：

Information-flow analysis is a powerful technique for reasoning about the sensitive information exposed by a program during its execution. We present the first automatic method for information-flow analysis that discovers what information is leaked and computes its comprehensive quantitative interpretation. The leaked information is characterized by an equivalence relation on secret artifacts, and is represented by a logical assertion over the corresponding program variables. Our measurement procedure computes the number of discovered equivalence classes and their sizes. This provides a basis for computing a set of quantitative properties, which includes all established information-theoretic measures in quantitative information-flow. Our method exploits an inherent connection between formal models of qualitative information-flow and program verification techniques. We provide an implementation of our method that builds upon existing tools for program verification and information-theoretic analysis. Our experimental evaluation indicates the practical applicability of the presented method.

引用

页码：141 / +

页数：3

共 41 条

[21] Graf S, 1997, LECT NOTES COMPUT SC, V1254, P72
[22] Gray J. W., 1992, Journal of Computer Security, V1, P255, DOI DOI 10.3233/JCS-1992-13-405
[23] Abstractions from proofs
Henzinger, TA
Jhala, R
Majumdar, R
McMillan, KL
[J]. ACM SIGPLAN NOTICES, 2004, 39 (01) : 232 - 244
[24] Jhala R, 2007, LECT NOTES COMPUT SC, V4590, P193
[25] Köpf B, 2006, LECT NOTES COMPUT SC, V4189, P243
[26] Quantifying information flow
Lowe, G
[J]. 15TH IEEE COMPUTER SECURITY FOUNDATION WORKSHOP, PROCEEDINGS, 2002, : 18 - 31
[27] Malacaria Pasquale, 2007, POPL 2007. The 34th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, P225, DOI 10.1145/1190216.1190251
[28] Massey J. L., 1994, Proceedings. 1994 IEEE International Symposium on Information Theory (Cat. No.94CH3467-8), DOI 10.1109/ISIT.1994.394764
[29] Quantitative Information Flow as Network Flow Capacity
McCamant, Stephen
Ernst, Michael D.
[J]. PLDI'08: PROCEEDINGS OF THE 2008 SIGPLAN CONFERENCE ON PROGRAMMING LANGUAGE DESIGN & IMPLEMENTATION, 2008, : 193 - 205
[30] Millen J. K., 1987, Proceedings of the 1987 IEEE Symposium on Security and Privacy (Cat. No.87CH2416-6), P60

← 1 2 3 4 5 →