Deterministic Channel Design for Minimum Leakage

Abstract

This work explores the problem of designing a channel that leaks the least amount of information while respecting a set of operational constraints. This paper focuses on deterministic channels and deterministic solutions. This setting is relevant because most programs and many channel design problems are naturally modelled by deterministic channels. Moreover, the setting is also relevant when considering an attacker who can observe many outputs of an arbitrary channel while the secret input stays the same: when the number of observations is arbitrarily large, the channel of minimal leakage is deterministic. The deterministic channel design problem has different solutions depending on which leakage measure is chosen. The problem is shown to be NP-hard in general. However, for a particular class of constraints, called k-complete hypergraph constraints, a greedy algorithm is shown to provide the optimal solution for a wide class of leakage measures.• Section II overviews preliminary concepts of QIF and introduces core-concave entropies. • Section III presents the deterministic channel design problem. The problem is shown to be NP-hard, and it is proven that, in general, it does not have a universal solution.

Channel Ordering and Supermodularity

“…The next result from [2] confirms that some of the most usual entropy measures are channel-supermodular.…”

“…Another preorder introduced by Shannon [17] includes the one above. A channel K 1 is said to include K 2 , indicated 1 All logarithms are taken to the base 2 2 For 0 < α < 1, one may take instead: η(x) = α 1−α log(x), F (X) = p α for the fist case and η(x) = 1 1−α log(x), F (X) = p α α for the second.…”

“…We now introduce the concept of channel-supermodular entropies, which were studied in [2] under the name "leakagesupermodular". They are based on supermodular functions over the euclidean vector space.…”

Channel-Supermodular Entropies: Order Theory and an Application to Query Anonymization

“…However, when designing systems, it is often the case that some leakage is unavoidable. With that in mind, some recent works in QIF aimed at obtaining channels that leak the least amount of information subject to some operational constraints [ 13 , 28 , 29 ]. From Definition 3, the problem can be rephrased as finding the channel which, subject to some operational constraints, maximizes — or, as is increasing, maximizes .…”

“…In this work, we present a robust anonymity mechanism. The algorithm is based on a result from [ 13 ], which uses the properties of channel-supermodularity presented in this paper to derive a greedy channel design algorithm that is provably optimal and unique for all channel-supermodular measures of leakage. We apply our robust anonymity mechanism to query anonymization: we consider the problem in which the real query itself is the secret, and we also consider the scenario where a related attribute is the secret.…”