Dynamic Enforcement of Knowledge-Based Security Policies

Abstract

Abstract-This paper explores the idea of knowledge-based security policies, which are used to decide whether to answer a query over secret data based on an estimation of the querier's (possibly increased) knowledge given the result. Limiting knowledge is the goal of existing information release policies that employ mechanisms such as noising, anonymization, and redaction. Knowledge-based policies are more general: they increase flexibility by not fixing the means to restrict information flow. We enforce a knowledge-based policy by explicitly tracking a model of a querier's belief about secret data, represented as a probability distribution. We then deny any query that could increase knowledge above a given threshold. We implement query analysis and belief tracking via abstract interpretation using a novel domain we call probabilistic polyhedra, whose design permits trading off precision with performance while ensuring estimates of a querier's knowledge are sound. Experiments with our implementation show that several useful queries can be handled efficiently, and performance scales far better than would more standard implementations of probabilistic computation based on sampling.

Expectation Invariants for Probabilistic Program Loops as Fixed Points

“…Refinements of this idea appear in the work of Mardziel et al [17] and Bouissou et al [2]. Instead of the explicit representations of distributions found in these works, we characterize sets of distributions by means of bounds on moments of expressions.…”

“…Proving expectation invariants often requires approximating the distribution of states after n steps of loop execution (see [2,20,22,9,17] for techniques that approximate distributions in a sound manner). However, even simple programs, such as the program shown in Figure 1, can exhibit complex distributions of reachable states after just a few steps of loop execution (see Figure 2).…”

Browser Randomisation against Fingerprinting: A Quantitative Information Flow Approach

“…Evaluation of information flow Mardziel et al [16,17] define the notion of knowledge threshold secure program. This is a generalisation of t-privacy allowing to attach different thresholds to different secrets.…”

“…Inspired by Clarkson et al's work on belief revision [6], Mardziel et al [16,17] propose a definition of knowledge threshold security stating that a program is secure if all the post-beliefs of all possible secrets are bounded by some threshold t. Espinoza and Smith [11] discuss this definition and name it worst-case posterior vulnerability underlining that it is very biased towards the worst output. In order to enforce knowledge threshold security, Mardziel et al [16,17] suggest to: i) run the program if the threshold holds for all the values of the secret input; ii) not run the program in case there is at least one value for which the guarantee does not hold.…”

“…In order to enforce knowledge threshold security, Mardziel et al [16,17] suggest to: i) run the program if the threshold holds for all the values of the secret input; ii) not run the program in case there is at least one value for which the guarantee does not hold. This radical approach forbids all the safe users to run the program.…”