Quantifying information leaks in software

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2010, Pages 261-269

  Heusser, Jonathan ^a   Malacaria, Pasquale ^a  

^a QUEEN MARY UNIVERSITY OF LONDON   (United Kingdom)

Author keywords

information leakage; Linux kernel; quantitative information flow

Indexed keywords

LINUX; MODEL CHECKING;

BOUNDED MODEL CHECKING; CONFIDENTIAL INFORMATION; HIGH COMPLEXITY; INFORMATION LEAKAGE; LINUX KERNEL; QUANTITATIVE APPROACH; QUANTITATIVE INFORMATION FLOWS; REAL WORLD PROJECTS; SECURITY RISKS; STATE-SPACE;

AUTHENTICATION;

EID: 78751504408     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1920261.1920300     Document Type: Conference Paper

References (19)

1. Michael Backes and Boris Köpf and Andrey Rybalchenko: Automatic Discovery and Quantification of Information Leaks. Proc. 30th IEEE Symposium on Security and Privacy (S&P '09)
2. Barthe, Gilles and D'Argenio, Pedro R. and Rezk, Tamara: Secure Information Flow by Self-Composition. CSFW '04: Proceedings of the 17th IEEE workshop on Computer Security Foundations.
3. David Clark, Sebastian Hunt, Pasquale Malacaria: A static analysis for quantifying information flow in a simple imperative language. Journal of Computer Security, Volume 15, Number 3 / 2007.
4. David Clark, Sebastian Hunt, and Pasquale Malacaria: Quantitative information flow, relations and polymorphic types. Journal of Logic and Computation, Special Issue on Lambda-calculus, type theory and natural language, 18(2):181-199, 2005.
5. Clarke, Edmund, and Kroening, Daniel, and Lerda, Flavio: A Tool for Checking ANSI-C Programs. Tools and Algorithms for the Construction and Analysis of Systems (TACAS 2004). Springer, 168-176, Volume 2988
6. http://www.cprover.org/cbmc/applications.shtml - Checked 17 June 2010.
7. Joseph A. Goguen, Jose Meseguer: Security Policies and Security Models. IEEE Symposium on Security and Privacy 1982: 11-20
8. Jonathan Heusser and Pasquale Malacaria: Applied Quantitative Information Flow and Statistical Databases. Formal Aspects in Security and Trust 2009: 96-110
9. Boris Köpf and Andrey Rybalchenko: Approximation and randomization for quantitative information-flow analysis. In Proceedings CST 2010
10. Landauer, J., and Redmond, T.: A Lattice of Information. In Proc. of the IEEE Computer Security Foundations Workshop. IEEE Computer Society Press, 1993.
11. Pasquale Malacaria: Assessing security threats of looping constructs. Proc. ACM Symposium on Principles of Programming Language, 2007.
12. Pasquale Malacaria, Han Chen: Lagrange multipliers and maximum information leakage in different observational models. PLAS 2008: 135-146
13. Pasquale Malacaria and Jonathan Heusser: Information Theory and Security: Quantitative Information Flow. In Formal Methods for Quantitative Aspects of Programming Languages, LNCS, Springer Verlag, 2010
14. Stephen McCamant, Michael D. Ernst: Quantitative information flow as network flow capacity. PLDI 2008: 193-205 MIT Department of Electrical Engineering and Computer Science, Ph.D., Cambridge, MA, 2008.
15. James Newsome, Stephen McCamant, Dawn Song: Measuring channel capacity to distinguish undue influence. PLAS 2009: 73-85
16. Benjamin Schwarz, Hao Chen, David Wagner, Jeremy Lin, Wei Tu, Geoff Morrison, Jacob West: Model Checking An Entire Linux Distribution for Security Violations. ACSAC 2005: 13-22
17. Pasareanu, Corina S. and Dwyer, Matthew B. and Huth, Michael: Assume-Guarantee Model Checking of Software: A Comparative Case Study. Proceedings of the 5th and 6th International SPIN Workshops on Theoretical and Practical Aspects of SPIN Model Checking,1999
18. T. Terauchi and A. Aiken. Secure information flow as a safety problem: In SAS, volume 3672 of LNCS, pages 352-367, 2005.
19. Hirotoshi Yasuoka and Tachio Terauchi Quantitative information flow - verification hardness and possibilities. In Proceedings CSF 2010.