Obtaining Information Leakage Bounds via Approximate Model Counting-Reference-Cited by-同舟云学术

Obtaining Information Leakage Bounds via Approximate Model Counting

Published:2023-06-06 Issue:PLDI Volume:7 Page:1488-1509
ISSN:2475-1421
Container-title:Proceedings of the ACM on Programming Languages
language:en
Short-container-title:Proc. ACM Program. Lang.

Author:

Saha Seemanta¹^ORCID,Ghentiyala Surendra¹^ORCID,Lu Shihua¹^ORCID,Bang Lucas²^ORCID,Bultan Tevfik¹^ORCID

Affiliation:

1. University of California at Santa Barbara, USA

2. Harvey Mudd College, USA

Abstract

Information leaks are a significant problem in modern software systems. In recent years, information theoretic concepts, such as Shannon entropy, have been applied to quantifying information leaks in programs. One recent approach is to use symbolic execution together with model counting constraints solvers in order to quantify information leakage. There are at least two reasons for unsoundness in quantifying information leakage using this approach: 1) Symbolic execution may not be able to explore all execution paths, 2) Model counting constraints solvers may not be able to provide an exact count. We present a sound symbolic quantitative information flow analysis that bounds the information leakage both for the cases where the program behavior is not fully explored and the model counting constraint solver is unable to provide a precise model count but provides an upper and a lower bound. We implemented our approach as an extension to KLEE for computing sound bounds for information leakage in C programs.

Funder

NSF

Publisher

Association for Computing Machinery (ACM)

Subject

Safety, Risk, Reliability and Quality,Software

Link

https://dl.acm.org/doi/pdf/10.1145/3591281

Reference37 articles.

1. Minimum and Maximum Entropy Distributions for Binary Systems with Known Means and Pairwise Correlations

2. Decomposition instead of self-composition for proving the absence of timing channels

3. Abdulbaki Aydin , Lucas Bang , and Tevfik Bultan . 2015 . Automata-Based Model Counting for String Constraints . In Proceedings of the 27th International Conference on Computer Aided Verification (CAV). 255–272 . Abdulbaki Aydin, Lucas Bang, and Tevfik Bultan. 2015. Automata-Based Model Counting for String Constraints. In Proceedings of the 27th International Conference on Computer Aided Verification (CAV). 255–272.

4. Michael Backes , Boris Köpf , and Andrey Rybalchenko . 2009 . Automatic Discovery and Quantification of Information Leaks. In 30th IEEE Symposium on Security and Privacy (S&P 2009) , 17-20 May 2009, Oakland, California, USA. 141–153. Michael Backes, Boris Köpf, and Andrey Rybalchenko. 2009. Automatic Discovery and Quantification of Information Leaks. In 30th IEEE Symposium on Security and Privacy (S&P 2009), 17-20 May 2009, Oakland, California, USA. 141–153.

5. The Parma Polyhedra Library: Toward a complete set of numerical abstractions for the analysis and verification of hardware and software systems