An Automated Quantitative Information Flow Analysis for Concurrent Programs

Abstract

Quantitative information flow is a rigorous approach for evaluating the security of a system. It is used to quantify the amount of secret information leaked to the public outputs. In this paper, we propose an automated approach for quantitative information flow analysis of concurrent programs. Markovian processes are used to model the behavior of these programs. To this end, we assume that the attacker is capable of observing the internal behavior of the program and propose an equivalence relation, back-bisimulation, to capture the attacker’s view of the program behavior. A partition refinement algorithm is developed to construct the back-bisimulation quotient of the program model and then a quantification method is proposed for computing the information leakage using the quotient. Finally, an anonymous protocol, dining cryptographers, is analyzed as a case study to show applicability and scalability of the proposed approach.

Appendices

A Case Study

In this section, we analyze a case study to show applicability and feasibility of the approach.

The Dining Cryptographers Protocol. We consider the dining cryptographers problem [11] to show how an attacker can deduce secret information through execution observations. The dining cryptographers problem was first proposed by David Chaum in 1988 as an example of anonymity and identity hiding [11]. In this problem, N cryptographers are sitting at a round table to have dinner at their favorite restaurant. The waiter informs them that the meal has been arranged to be paid by one of the cryptographers or their master. The cryptographers respect each other’s right to stay anonymous, but would like to know whether the master is paying or not. So, they decide to take part in the following two-stage protocol:

• Stage 1: Each cryptographer tosses a coin and only informs the cryptographer on the right of the outcome.

• Stage 2: Each cryptographer publicly announces whether the two coins that she can see are the same (‘agree’) or different (‘disagree’). However, if she actually paid for the dinner, then she lies, i.e., she announces ‘disagree’ when the coins are the same, and ‘agree’ when they are different.

Let the variable parity be exclusive-or (XOR) between all the announcements. If N is odd, then an odd number of ‘agree’s (parity = 1) implies that none of the cryptographers paid (the master paid), while an even number (parity = 0) implies that one of the cryptographers paid. The latter is reverse for an even N.

The payer can be either

• i. one of the cryptographers, i.e., $Val_{payer} = \{ c_1,\ldots ,c_N \}$, or

• ii. the master (m, for short) or one of the cryptographers, i.e., $Val_{payer} = \{ m,c_1,\ldots ,c_N \}$.

Assume an attacker who tries to find out the payer’s identity. The attacker is external, i.e., none of the cryptographers. This attacker can observe the parity and also the announcements of the cryptographers. All observable variables are concatenated to form a single public variable. The program model is an MC$_\mathfrak {n}$ and we employ the proposed algorithms to compute the leakage.

Table 1. Evaluation results for the dining cryptographers protocol with the coin probability 0.5

The experimental results for the cases in which the coin probability is 0.5 are shown in Table 1. In this table, N denotes the number of cryptographers. $\mathcal {M}^{\texttt {DC}_N}_{uni}$ and $\mathcal {M}^{\texttt {DC}_N}_{uni} /\sim _b$ denote the MC of the program run with a uniform scheduler and the back-bisimulation quotient, respectively. Symbols $\#st$ and $\#tr$ denote the number of states and transitions, respectively.

Similar results for the coin probability of 0 or 1 are shown in Table 2. As shown in Tables 1 and 2, back-bisimulation results in impressive reductions of the state space. For example, when the coin probability is 0.5 (Table 1) reductions vary between $92\%$ and $99.5\%$.

Consider the last three cases of Table 1, where the coin probability is 0.5 and the payer is one of the cryptographers ($Val_{payer} = \{ c_1,\ldots ,c_N \}$). In these cases, the program leakage is 0. This shows that the attacker cannot identify the payer. This is why the dining cryptographers protocol is said to be secure in the context of anonymity.

The analysis results in Table 2 show that when the probability of the coin is 0 or 1, no matter whoever the payer is, the leakage is $\log _2 |Val_{payer}|$, proving that the secret gets completely leaked and thus the attacker learns the identity of the payer.

B Related Work

The notion of back-simulation is similar to the notion of backward strong bisimulation considered by De Nicola and Vaandrager [15]. They use a different notion than our definition, as they only allow to move back from a state along the path representing the history that brought one into that state. Högberg et al. [17] defined and considered backward bisimulation minimization on tree automata, Sproston and Donatelli [32] considered a probabilistic version of backward bisimulation and studied the logical properties it preserves, and Cardelli et al. [9] who considered backward bisimulation in the stochastic setting of chemical reaction networks. None of these works use backward bisimulation in quantitative information flow.

Table 2. Evaluation results for the dining cryptographers protocol with the coin probability 0 or 1

Chen and Malacaria [12] model multi-threaded programs as state transition systems. They use Bellman’s optimality principle to determine the leakage bounds, i.e., minimal and maximal leakage occurred during possible program executions.

Phan et al. [27] propose to use symbolic execution, a verification technique which bounds runtime behavior of the program, thus mitigating state-space explosion problem. In state-space explosion problem, the amount of state-space of the program model gets too huge to store in the memory, thus making the analysis difficult. Phan et al. run symbolic execution to extract all symbolic paths of the program. Then, paths with a direct information flow are labeled. Finally, they use a model counting technique to count the number of inputs that follow direct-labeled paths, to compute channel capacity, which is an upper bound of the leakage over all possible distributions of the secret input.

Biondi et al. [8] use interval Markov chains to compute the channel capacity of deterministic processes. They reduce the channel capacity computation to entropy maximization, a well-known problem in Bayesian statistics.

Chothia et al. [14] have developed LeakWatch to approximate leakage of Java programs. LeakWatch is based on probabilistic point-to-point information leakage, in which the leakage between any given two points in the program from secret to public variables is computed.

Chadha et al. [10] employ symbolic algorithms to quantify the precise leakage from public to secret variables. They use Binary Decision Diagrams (BDDs) to model the relation between the inputs and outputs of the program. To do so, Moped [16], a symbolic model checker, is exploited to construct BDDs. Chadha et al. have implemented their method into a tool called Moped-QLeak.

Klebanov [22] uses symbolic execution in combination with deductive verification [5] and self-composition [4] to measure residual Shannon entropy and min-entropy of the secret input. Exploitation of deductive verification makes the analysis immune to the state-space explosion problem, but also makes it semi-automatic, as user-supplied invariants are needed for the analysis to proceed.