PROBABILISTIC COMPUTATION FOR INFORMATION SECURITY Piotr (Peter) Mardziel (UMD) Kasturi Raghavan (UCLA)

Convenience 2 ~params prior ~params | [ model(~params) == sample ] posterior B 1 ~secret Bob’s belief about secret params B 1 ~secret | [ sys(B 1 ~secret) == sys(secret) ] = B 2 ~secret Bob’s revised belief secret Alice’s secret ~sample = model(~params) B 1 ~visible = sys(B 1 ~secret)

Photography Convenience 3 B 1 ~secret Bob’s belief about secret B 1 ~secret | [ sys(B 1 ~secret) == special-offer(secret) ] = B 2 ~secret Bob’s revised belief secret = (age, gender, engaged?) Alice’s secret B 1 ~visible = special-offer(B 1 ~secret) special-offer(age, gender, engaged?) = return (24 <= age <= 30 and gender == ‘female and engaged?) B 2 ~visible = fun 1 (B 1 ~secret) B 2 ~secret | [ sys(B 2 ~secret) == fun 2 (secret) ] = B 3 ~secret

Photography Protection 4 B 1 ~secret B 2 ~secret secret = (age, gender, engaged?) Alice’s secret special-offer (secret) Assumptions

Obfuscation/Noising 5 special-offer(secret) special-offer’(secret) special-offer’(age, gender, engaged?) = return (24 <= age <= 30 and gender == ‘female and engaged?) or Bernoulli(0.1) N(special-offer(O(secret))) … ? ?

Information flow Information flow / Non-interference: Does information flow? B 2 ~secret =? B 1 ~secret Quantified information flow: How much information flows? H(B 2 ~secret) – H(B 1 ~secret) 6 Yes?No? 0 ∞ B 1 ~secret B 2 ~secretB 3 ~secret Entropy / Min-entropy / Guessing entropy / etc..

“Semantic” information flow Information flow / Non-interference: Does information flow? Quantified information flow: How much information flows? Knowledge tracking / “semantic” information flow What information flows? 7 distributions over secret. B 1 ~secret. B 2 ~secret. B 3 ~secret entropy min-entropy guessing entropy … …

“Semantic” information flow 8 distributions over secret. B 1 ~secret. B 2 ~secret. B 3 ~secret entropy min-entropy guessing entropy … … Which quantity is appropriate? H(B 2 ~s) H ∞ (B 2 ~s) G(B 2 ~s) KL(A~s || B 2 ~s) s = (age, gender, engaged?)

More convenience Alice wants to hide her political preference. (not an aspect of the secret) Take function pol-pref: secret  { } that predicts political preference from demographics (age, gender, engaged?) 9 distributions over secret. B 1 ~secret. B 2 ~secret. B 3 ~secret entropy min-entropy guessing entropy … …

“Blacklist” function 10 distributions over secret. B 1 ~secret. B 3 ~secret distributions over party. B 1 ~party. B 2 ~party. B 3 ~party. B 2 ~secret B i ~party = pol-ref(B i ~secret) ambiguous privacy implication

Limiting knowledge 11 Alice can use knowledge tracking to enforce limits to knowledge. distributions over secret. B 1 ~secret. B 2 ~secret. B 3 ~secret. B 4 ~secret Policy(~secret)  {true,false}

Assumptions 12 Alice knows what Bob believes about her secret initially. Alice can perform the probabilistic interpretation and conditioning “accurately enough”. distributions over secret. B 1 ~secret. B 3 ~secret. B 4 ~secret. B 2 ~secret. B’ 4 ~secret Policy(~secret)  {true,false}

Assumptions 13 Alice knows what Bob believes about her secret initially. Alice can perform the probabilistic interpretation and conditioning “accurately enough”. distributions over secret. B 1 ~secret. B 3 ~secret. B 4 ~secret. B 2 ~secret. B’ 4 ~secret Soundness: Policy(B i ~secret) == false  Policy(B’ i ~secret) == false Policy(~secret)  {true,false}

An approach 14 distributions over secret. B 3 ~secret. B 2 ~secret. B 1 ~secret Abstract representation of sets of distributions. Abstract probabilistic semantics and conditioning, over-approximating the exact semantics and conditioning. Policy: sound check for min-entropy bounds. B 4 ~secret Piotr Mardziel, Stephen Magill, Michael Hicks, Mudhakar Srivasta. Dynamic enforcement of knowledge-based security policies using abstract interpretation.

Probabilistic computation for information security Convenient reasoning about information security. “Semantic” information flow: more flexible than quantified information flow Enforcement mechanisms require soundness to guarantee security conditions.

Probabilistic computation for information security Convenient reasoning about information security. “Semantic” information flow: more flexible than quantified information flow Enforcement mechanisms require soundness to guarantee security conditions. How to take advantage of ML-inspired probabilistic programming techniques for information security? More efficient inference? Search problems: find “optimal” noising/obfuscation parameters. B 1 ~secret. B 2 ~secret. B 3 ~secret. B 4 ~secret

Go back. 17