Information Flow Security Research Articles

Multi-Defender Strategic Filtering Against Multi Agent Cyber Epidemics on Multi-Environment Model for Smart Grid Protection

The growing cyber space with the developments in cyber network technologies in smart grid (SG) systems has necessitated questioning the reliability of networks and taking precautions against possible cyber threats. For this reason, defensive strategies and approaches against cyber attacks must be improved to sustain secure information flow of the network connections used in electricity generation, transmission, distribution, and consumption. This paper proposes a multi-agent multi environment deep reinforcement learning (MM-DRL) based defender response against cyber epidemics consisting coordinated cyber-attacks (multi-CAs) in the same time frame scheme to sustain security for SG networks. In this regard, the PMU-connected 123-bus system is integrated as a Markov game. MM-DRL approach is implemented for subenvironments of a typical SG system. Multi-CAs game aims to coordinate PMU signals across intersections to improve the network efficiency of a SG. DRL has been applied to data control recently and demonstrated promising performance where each data signal is regarded as an agent. Conversely, multi-CAs are self-renewing emerging causative agent of electricity theft, network disturbances, and data manipulation in SG systems characterized with wide characteristic diversity and rapid evolution. The game results show that the presented request response algorithm is able to minimize system attack damage and maintain protection duties when compared to a benchmark without request response. In addition, the performance of the MM-DRL approach compared to other developed methods is examined.

Abstraction-Based Verification of Approximate Preopacity for Control Systems

In this letter, we consider the problem of verifying pre-opacity for discrete-time control systems. Pre-opacity is an important information-flow security property that secures the intention of a system to execute some secret behaviors in the future. Existing works on pre-opacity only consider non-metric discrete systems, where it is assumed that intruders can distinguish different output behaviors precisely. However, for continuous-space control systems whose output sets are equipped with metrics (which is the case for most real-world applications), it is too restrictive to assume precise measurements from outside observers. In this letter, we first introduce a concept of approximate pre-opacity by capturing the security level of control systems with respect to the measurement precision of the intruder. Based on this new notion of pre-opacity, we propose a verification approach for continuous-space control systems by leveraging abstraction-based techniques. In particular, a new concept of approximate pre-opacity preserving simulation relation is introduced to characterize the distance between two systems in terms of preserving pre-opacity. This new system relation allows us to verify pre-opacity of complex continuous-space control systems using their finite abstractions. We also present a method to construct pre-opacity preserving finite abstractions for a class of discrete-time control systems under certain stability assumptions.

Strong current-state and initial-state opacity of discrete-event systems

Opacity, as an important property in information-flow security, characterizes the ability of a system to keep some secret information from an intruder. In discrete-event systems, based on a standard setting in which an intruder has the complete knowledge of the system’s structure, the standard versions of current-state opacity and initial-state opacity cannot perfectly characterize higher-level privacy requirements. To overcome such a limitation, in this paper we propose two stronger versions of opacity called strong current-state opacity and strong initial-state opacity for partially-observed nondeterministic finite-state automata. Strong current-state (resp., initial-state) opacity describes that for each run of a system ending (resp., starting) at a secret state, there exists a non-secret run whose observation is the same as that of the previous run. Then we propose an information structure using a novel concurrent-composition technique to verify strong current-state opacity and strong initial-state opacity, which has time complexity O((|Σ||X|2+|Σo||X∖XS|2(1+|Σuo|))2|X∖XS|), where |X| (resp., |Σ|, |Σo|, |Σuo|, |X∖XS|) is the number of states (resp., events, observable events, unobservable events, non-secret states) of an automaton. Finally, the proposed information structure is also used to check strong infinite-step opacity, which has lower time complexity than the previous one in the literature.

Monadic and comonadic aspects of dependency analysis

Dependency analysis is vital to several applications in computer science. It lies at the essence of secure information flow analysis, binding-time analysis, etc. Various calculi have been proposed in the literature for analysing individual dependencies. Abadi et. al., by extending Moggi’s monadic metalanguage, unified several of these calculi into the Dependency Core Calculus (DCC). DCC has served as a foundational framework for dependency analysis for the last two decades. However, in spite of its success, DCC has its limitations. First, the monadic bind rule of the calculus is nonstandard and relies upon an auxiliary protection judgement. Second, being of a monadic nature, the calculus cannot capture dependency analyses that possess a comonadic nature, for example, the binding-time calculus, λ ∘ , of Davies. In this paper, we address these limitations by designing an alternative dependency calculus that is inspired by standard ideas from category theory. Our calculus is both monadic and comonadic in nature and subsumes both DCC and λ ∘ . Our construction explains the nonstandard bind rule and the protection judgement of DCC in terms of standard categorical concepts. It also leads to a novel technique for proving correctness of dependency analysis. We use this technique to present alternative proofs of correctness for DCC and λ ∘ .

Finite-word hyperlanguages

Formal languages are in the core of models of computation and their behavior. A rich family of models for many classes of languages have been widely studied. Hyperproperties lift conventional trace-based languages from a set of execution traces to a set of sets of executions. Hyperproperties have been shown to be a powerful formalism for expressing and reasoning about information-flow security policies and important properties of cyber-physical systems. Although there is an extensive body of work on formal-language representation of trace properties, we currently lack such a general characterization for hyperproperties.We introduce hyperlanguages over finite words and models for expressing them. Essentially, these models express multiple words by using assignments to quantified word variables.Relying on the standard models for regular languages, we propose regular hyperexpressions and finite-word hyperautomata (NFH), for modeling the class of regular hyperlanguages. We demonstrate the ability of regular hyperlanguages to express hyperproperties for finite traces. We explore the closure properties and the complexity of the fundamental decision problems such as nonemptiness, universality, membership, and containment for various fragments of NFH.

Research on Network Security Situational Awareness Based on Crawler Algorithm

Network security situation awareness is a critical basis for security solutions because it displays the target system’s security state by assessing actual or possible cyber-attacks in the target system. Aiming at the security and stability of global information flow, this paper studies the perception and measurement of the overall situation of network security. Through the Scrappy web crawler framework, data were collected from several Zhiming network security event websites, and based on the vulnerability database of China Computer Network Intrusion Prevention Center, the network security event database was designed and established, which enriched the data of situational awareness research. This study investigates the analysis and processing of network security events, a crucial parameter in the stage of security insight and perception, and builds and implements a text-based network security event analysis tool. By designing a network security event analysis tool based on text processing, the data cleaning of network security time text information is completed, and a set of network security event processing solutions with high applicability and comprehensiveness are formed. Statistical experimental results show that the network security event database built based on the crawler algorithm contains 43,848 pieces of data, which increases the capacity by 12.79% and 29.33% compared with the traditional algorithm, and reduces the reading time by 63.5% and 87.2%.

Imperative Process Algebra with Abstraction

This paper introduces an imperative process algebra based on ACP (Algebra of Communicating Processes). Like other imperative process algebras, this process algebra deals with processes of the kind that arises from the execution of imperative programs. It distinguishes itself from already existing imperative process algebras among other things by supporting abstraction from actions that are considered not to be visible. The support of abstraction of this kind opens interesting application possibilities of the process algebra. This paper goes briefly into the possibility of information-flow security analysis of the kind that is concerned with the leakage of confidential data. For the presented axiomatization, soundness and semi-completeness results with respect to a notion of branching bisimulation equivalence are established.

Secure communication technology between network domains based on virtualization avionics platform

In the information interconnection scenario of the new generation wide-body aircraft, there is a large amount of real-time bi-directional data exchange between aircraft control domain and airline information services domain in civil aircraft avionics system, and its security isolation and information flow protection are facing increasingly serious information security threats. Therefore, a bi-directional secure communication architecture based on virtualization avionics platform is proposed in this study. The attribute-based access control for multiple avionics domain is modeling and the designs of protection for contract security critical data and real-time monitoring for security critical component effectiveness are given. Physical implementation and verification results based on the domestic ACoreOS operating system and avionics hardware platform show that the bi-directional secure communication method based on virtualization avionics platform achieves the spatial isolation of security critical components, the data transmit and receive time of ACD network is less than 50 ms, and the message transmit and receive rate of ACD network is greater than 70 Mb/s. These results can meet the performance requirements of secure communication between avionics network domains of wide-body aircraft, which have high practical value.

Information Leakage Games: Exploring Information as a Utility Function

A common goal in the areas of secure information flow and privacy is to build effective defenses against unwanted leakage of information. To this end, one must be able to reason about potential attacks and their interplay with possible defenses. In this article, we propose a game-theoretic framework to formalize strategies of attacker and defender in the context of information leakage, and provide a basis for developing optimal defense methods. A novelty of our games is that their utility is given by information leakage, which in some cases may behave in a non-linear way. This causes a significant deviation from classic game theory, in which utility functions are linear with respect to players’ strategies. Hence, a key contribution of this work is the establishment of the foundations of information leakage games. We consider two kinds of games, depending on the notion of leakage considered. The first kind, the QIF -games , is tailored for the theory of quantitative information flow. The second one, the DP -games , corresponds to differential privacy.

A framework for current-state opacity under dynamic information release mechanism

Opacity is an important information-flow security property that characterizes the plausible deniability of a dynamic system for its “secret” against eavesdropping attacks. As an information-flow property, the underlying observation model is the key in the modeling and analysis of opacity. In this paper, we investigate the verification of current-state opacity for discrete-event systems under Orwellian-type observations, i.e., the system is allowed to re-interpret the observation of an event based on its future suffix. First, we propose a new Orwellian-type observation model called the dynamic information release mechanism (DIRM). In the DIRM, when to release previous “hold on” events is state-dependent. Then we propose a new definition of opacity based on the notion of history-equivalence rather than the standard projection-equivalence. This definition is more suitable for observations that are not prefix-closed. Finally, we show that by constructing a new structure called the DIRM-observer, current-state opacity can be effectively verified under the DIRM. Computational complexity analysis as well as illustrative examples for the proposed approach is also provided. Compared with the existing Orwellian-type observation model, the proposed framework is more general in the sense that the information-release-mechanism is state-dependent, information is partially released and the corresponding definition of opacity is more suitable for non-prefix-closed observations.

Secure information flow connections

Denning's lattice model provided secure information flow analyses with an intuitive mathematical foundation: the lattice ordering determines permitted flows. We propose a connection-based extension of this framework that permits two autonomous organisations, each employing possibly quite different security lattices, to exchange information while maintaining security of information flow as well as their autonomy in formulating and maintaining security policies. Our prescriptive framework is based on the rigorous mathematical framework of Lagois connections proposed by Melton, together with a simple type system and operational model for transferring object data between the two domains. The merit of this formulation is that it is simple, minimal, adaptable and intuitive. We show that our framework is semantically sound, by proving that the connections proposed preserve standard correctness notions such as noninterference. We then illustrate via examples how Lagois theory also provides a robust framework and methodology for negotiating and maintaining secure agreements on information flow between autonomous organisations, even when either or both organisations change their security lattices. Composition and decomposition properties indicate support for a modular approach to secure flow frameworks in complex organisations. Finally, a natural and conservative extension of the Decentralised Labels Model of Myers et al. shows the applicability of the framework — a Lagois connection between the hierarchies of principals in two organisations naturally induces a Lagois connection between the corresponding security label lattices, thus extending the security guarantees ensured by the decentralised model to encompass bidirectional interorganisational flows.

Security-preserving multi-agent coordination for complex temporal logic tasks

This paper investigates the coordination of multiple agents for high-level tasks described by linear temporal logics (LTL). The general purpose for multi-agent coordination is to synthesize a plan such that the LTL task is achieved optimally. In addition to the standard requirement on the correctness of the plan, we further investigate the potential information leakage of each agent during the operating process. Specifically, we consider the scenario where the behavior of each individual agent is partially monitored by a passive intruder modeled as an outside observer or an eavesdropper. The security constraint requires that the intruder can never identify for sure that some specific individual agent is carrying out some sub-tasks of significant importance. To this end, we model the mobile capability of the agent team by a global labeled transition system. To describe information-flow security constraint, motivated by the generic notion of opacity, two different types security requirements are proposed for each individual agent. An effective coordination algorithm is proposed that synthesizes an optimal global plan for the entire agent team such that the global LTL task can be achieved, while the security of each individual agent is preserved. The proposed framework is implemented in real-world experiment and is also demonstrated by several case studies.

Cryptographic core design security verification and vulnerability detection based on information flow analysis

Cryptographic cores are the key components to enforce information security properties related to confidentiality and integrity. Since the security of a cryptographic core implementation and the security of the cryptographic algorithm itself from the mathematical perspective are two different problems, cryptographic cores may contain hidden security vulnerabilities such as design flaws and side channels. Security analysis methods based on functional verification rely heavily on the quality of test vectors and usually have low test coverage, which is difficult to meet the security verification requirements of security-critical components like cryptographic cores. This work proposes a cryptographic core security verification and vulnerability detection method from the perspective of information flow security. The proposed method can accurately measure all logical information flows in cryptographic core designs to formally verify security properties such as confidentiality and integrity. It can detect potential security vulnerabilities in cryptographic implementations by capturing harmful information flows. Experimental results show that our information flow security verification method is effective in detecting sensitive information leakage caused by the design vulnerabilities and side channels in cryptographic cores.

You Don't Know What I Know: On Notion of High-Order Opacity in Discrete-Event Systems

In this paper, we investigate a class of information-flow security properties called opacity in partial-observed discrete-event systems. Roughly speaking, a system is said to be opaque if the intruder, which is modeled by a passive observer, can never determine the “secret” of the system for sure. Most of the existing notions of opacity consider secrets related to the actual behaviors of the system. In this paper, we consider a new type of secret related to the knowledge of the system user. Specifically, we assume that the system user also only has partial observation of the system and has to reason the actual behavior of the system. We say a system is high-order opaque if the intruder can never determine that the system user knows some information of importance based on its own incomparable information. We provide the formal definition of high-order opacity. Two algorithms are provided for the verification of this new notion: one with doubly-exponential complexity for the worst case and the other with single-exponential complexity. Illustrative examples are provided for the new notion of high-order opacity.

SecRSL: security separation logic for C11 release-acquire concurrency

We present Security Relaxed Separation Logic (SecRSL), a separation logic for proving information-flow security of C11 programs in the Release-Acquire fragment with relaxed accesses. SecRSL is the first security logic that (1) supports weak-memory reasoning about programs in a high-level language; (2) inherits separation logic’s virtues of compositional, local reasoning about (3) expressive security policies like value-dependent classification. SecRSL is also, to our knowledge, the first security logic developed over an axiomatic memory model. Thus we also present the first definitions of information-flow security for an axiomatic weak memory model, against which we prove SecRSL sound. SecRSL ensures that programs satisfy a constant-time security guarantee, while being free of undefined behaviour. We apply SecRSL to implement and verify the functional correctness and constant-time security of a range of concurrency primitives, including a spinlock module, a mixed-sensitivity mutex, and multiple synchronous channel implementations. Empirical performance evaluations of the latter demonstrate SecRSL’s power to support the development of secure and performant concurrent C programs.

Verification of Approximate Opacity via Barrier Certificates

This paper is motivated by the increasing security concerns of cyber-physical systems. Here, we develop a discretization-free verification scheme targeting an information-flow security property, called approximate initial-state opacity, for the class of discrete-time control systems. We propose notions of so-called augmented control barrier certificates in conjunction with specified regions of interest capturing the initial and secret sets of the system. Sufficient conditions for (the lack of) approximate initial-state opacity of discrete-time control systems are proposed based on the existence of the proposed barrier certificates. We further present an efficient computation method by casting the conditions for barrier certificates as sum-of-squares programming problems. The effectiveness of the proposed results is illustrated through two numerical examples.

D_PSNI: Delimited persistent stochastic non-interference

Non-Interference is an information flow security property which aims to protect confidential data by ensuring the complete absence of any information flow from high level entities to low level ones. However, this requirement is too demanding when dealing with real applications: indeed, no real policy ever guarantees a total absence of information flow. In order to deal with real applications, it is often necessary to allow mechanisms for downgrading or declassifying information such as information filters and channel control.In this paper we introduce the notion of Delimited Persistent Stochastic Non-Interference (D_PSNI) that allows information to flow from a higher to a lower security level through a downgrader. We provide two algebraic characterizations of D_PSNI and prove some compositionality properties. Finally, we present a decision algorithm and discuss its time complexity.

Recent Developments of Cyber-Offences in Slovenia

Digitalisation of the economy has exceeded its original boundaries and expanded to all areas of social life. In addition to all the benefits of digitalisation, it also creates risks of malicious use of the electronic information potential. Cyber security should play its part to prevent electronic information network and system intrusions, misuse of information, and to ensure smooth and secure information flow. Research design of this paper is the set of three research methods used in collecting legal information about cyber security regulation and analysing findings. First approach is descriptive analysis of legal regulation. Second method is desktop analysis of recently adopted legal acts. Third research method is observational study. Synthesis is presented in the conclusions. Legal regulation of cyber security refers to protecting the data and information systems against unauthorised access, use, disclosure, disruption, alteration, or destruction. Cyber security is concerned with the confidentiality, integrity, and availability of data regardless of the form the data may take electronic, print or any other. The Law of Minor Offences will apply to minor offences in the field of cyber security about “general” issues: liability of the perpetrator, imposition of sanctions, minor offence proceedings, etc., whereas the provisions of special legislation, more specifically, the provisions of the Cyber Security Law and the Electronic Communications Law, will apply to the identification of an act as a minor offence. However, in accordance with the lex specialis derogat legi generali principle, the general provisions of the Law of Minor Offences will apply only if such issues are not regulated otherwise by the Cyber Security Law and the Electronic Communications Law.

Verification of approximate opacity for switched systems: A compositional approach

The security in information-flow has become a major concern for cyber–physical systems (CPSs). In this work, we focus on the analysis of an information-flow security property, called opacity. Opacity characterizes the plausible deniability of a system’s secret in the presence of a malicious outside intruder. We propose a methodology of checking a notion of opacity, called approximate opacity, for networks of discrete-time switched systems. Our framework relies on compositional constructions of finite abstractions for networks of switched systems and their approximate opacity-preserving simulation functions. Those functions characterize how close concrete networks and their finite abstractions are in terms of the satisfaction of approximate opacity. We show that such simulation functions can be obtained compositionally by assuming some small-gain type conditions and composing local simulation functions constructed for each switched subsystem separately. Additionally, assuming certain stability property of switched systems, we also provide a technique on constructing their finite abstractions together with the corresponding local simulation functions. Finally, we illustrate the effectiveness of our results through an example.

Quantitative Analysis of Opacity in Cloud Computing Systems

Federated cloud systems increase the reliability and reduce the cost of the computational support. The resulting combination of secure private clouds and less secure public clouds, together with the fact that resources need to be located within different clouds, strongly affects the information flow security of the entire system. In this paper, the clouds as well as entities of a federated cloud system are assigned security levels, and a probabilistic flow sensitive security model for a federated cloud system is proposed. Then the notion of opacity—a notion capturing the security of information flow—of a cloud computing systems is introduced, and different variants of quantitative analysis of opacity are presented. As a result, one can track the information flow in a cloud system, and analyze the impact of different resource allocation strategies by quantifying the corresponding opacity characteristics.