2011 IEEE 24th Computer Security Foundations Symposium最新文献_第2页

Integrated Specification and Verification of Security Protocols and Policies 安全协议和策略的综合规范和验证

2011 IEEE 24th Computer Security Foundations Symposium Pub Date : 2011-06-27 DOI: 10.1109/CSF.2011.9

Simone Frau, M. Dashti

引用次数: 13

The Complexity of Quantitative Information Flow Problems 定量信息流问题的复杂性

2011 IEEE 24th Computer Security Foundations Symposium Pub Date : 2011-06-27 DOI: 10.1109/CSF.2011.21

Pavol Cerný, K. Chatterjee, T. Henzinger

{"title":"The Complexity of Quantitative Information Flow Problems","authors":"Pavol Cerný, K. Chatterjee, T. Henzinger","doi":"10.1109/CSF.2011.21","DOIUrl":"https://doi.org/10.1109/CSF.2011.21","url":null,"abstract":"In this paper, we investigate the computational complexity of quantitative information flow (QIF) problems. Information-theoretic quantitative relaxations of noninterference (based on Shannon entropy)have been introduced to enable more fine-grained reasoning about programs in situations where limited information flow is acceptable. The QIF bounding problem asks whether the information flow in a given program is bounded by a constant $d$. Our first result is that the QIF bounding problem is PSPACE-complete. The QIF memoryless synthesis problem asks whether it is possible to resolve nondeterministic choices in a given partial program in such a way that in the resulting deterministic program, the quantitative information flow is bounded by a given constant $d$. Our second result is that the QIF memoryless synthesis problem is also EXPTIME-complete. The QIF memoryless synthesis problem generalizes to QIF general synthesis problem which does not impose the memoryless requirement (that is, by allowing the synthesized program to have more variables then the original partial program). Our third result is that the QIF general synthesis problem is EXPTIME-hard.","PeriodicalId":364995,"journal":{"name":"2011 IEEE 24th Computer Security Foundations Symposium","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127379585","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 18

A Statistical Test for Information Leaks Using Continuous Mutual Information 基于连续互信息的信息泄漏统计检验

2011 IEEE 24th Computer Security Foundations Symposium Pub Date : 2011-06-27 DOI: 10.1109/CSF.2011.19

Tom Chothia, Apratim Guha

引用次数: 46

Regret Minimizing Audits: A Learning-Theoretic Basis for Privacy Protection 最小化遗憾审计:隐私保护的学习理论基础

2011 IEEE 24th Computer Security Foundations Symposium Pub Date : 2011-06-27 DOI: 10.1109/CSF.2011.28

Jeremiah Blocki, Nicolas Christin, Anupam Datta, Arunesh Sinha

{"title":"Regret Minimizing Audits: A Learning-Theoretic Basis for Privacy Protection","authors":"Jeremiah Blocki, Nicolas Christin, Anupam Datta, Arunesh Sinha","doi":"10.1109/CSF.2011.28","DOIUrl":"https://doi.org/10.1109/CSF.2011.28","url":null,"abstract":"Audit mechanisms are essential for privacy protection in permissive access control regimes, such as in hospitals where denying legitimate access requests can adversely affect patient care. Recognizing this need, we develop the first principled learning-theoretic foundation for audits. Our first contribution is a game-theoretic model that captures the interaction between the defender (e.g., hospital auditors) and the adversary (e.g., hospital employees). The model takes pragmatic considerations into account, in particular, the periodic nature of audits, a budget that constrains the number of actions that the defender can inspect, and a loss function that captures the economic impact of detected and missed violations on the organization. We assume that the adversary is worst-case as is standard in other areas of computer security. We also formulate a desirable property of the audit mechanism in this model based on the concept of regret in learning theory. Our second contribution is an efficient audit mechanism that provably minimizes regret for the defender. This mechanism learns from experience to guide the defender's auditing efforts. The regret bound is significantly better than prior results in the learning literature. The stronger bound is important from a practical standpoint because it implies that the recommendations from the mechanism will converge faster to the best fixed auditing strategy for the defender.","PeriodicalId":364995,"journal":{"name":"2011 IEEE 24th Computer Security Foundations Symposium","volume":"38 1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115637057","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 20

Static Analysis for Efficient Hybrid Information-Flow Control 高效混合信息流控制的静态分析

2011 IEEE 24th Computer Security Foundations Symposium Pub Date : 2011-06-27 DOI: 10.1109/CSF.2011.17

Scott Moore, Stephen Chong

{"title":"Static Analysis for Efficient Hybrid Information-Flow Control","authors":"Scott Moore, Stephen Chong","doi":"10.1109/CSF.2011.17","DOIUrl":"https://doi.org/10.1109/CSF.2011.17","url":null,"abstract":"Hybrid information-flow monitors use a combination of static analysis and dynamic mechanisms to provide precise strong information security guarantees. However, unlike purely static mechanisms for information security, hybrid information-flow monitors incur run-time overhead. We show how static analyses can be used to make hybrid information-flow monitors more efficient, in two ways. First, a simple static analysis can determine when it is sound for a monitor to stop tracking the security level of certain variables. This potentially reduces run-time overhead of the monitor, particularly in applications where sensitive (i.e., confidential or untrusted) data is infrequently introduced to the system. Second, we derive sufficient conditions for soundly incorporating a wide range of memory abstractions into information-flow monitors. This allows the selection of a memory abstraction that gives an appropriate tradeoff between efficiency and precision. It also facilitates the development of innovative and sound memory abstractions that use run-time security information maintained by the monitor. We present and prove our results by extending the information-flow monitor of Russo and Sabelfeld (2010). These results bring us closer to efficient, sound, and precise enforcement of information security.","PeriodicalId":364995,"journal":{"name":"2011 IEEE 24th Computer Security Foundations Symposium","volume":"10 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-06-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127938117","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 50

Termination-Insensitive Computational Indistinguishability (and Applications to Computational Soundness) 终止不敏感的计算不可区分性(及其在计算可靠性中的应用)

2011 IEEE 24th Computer Security Foundations Symposium Pub Date : 2011-06-27 DOI: 10.1109/CSF.2011.24

Dominique Unruh

引用次数: 7

Formal Analysis of Protocols Based on TPM State Registers 基于TPM状态寄存器的协议形式化分析

2011 IEEE 24th Computer Security Foundations Symposium Pub Date : 2011-06-27 DOI: 10.1109/CSF.2011.12

S. Delaune, S. Kremer, M. Ryan, G. Steel

引用次数: 64

Assumptions and Guarantees for Compositional Noninterference 合成不干扰的假设与保证

2011 IEEE 24th Computer Security Foundations Symposium Pub Date : 2011-06-27 DOI: 10.1109/CSF.2011.22

H. Mantel, David Sands, Henning Sudbrock

引用次数: 77

A Formal Framework for Provenance Security 来源安全的正式框架

2011 IEEE 24th Computer Security Foundations Symposium Pub Date : 2011-06-27 DOI: 10.1109/CSF.2011.26

J. Cheney

引用次数: 73

Obstruction-Free Authorization Enforcement: Aligning Security with Business Objectives 无障碍授权实施:使安全性与业务目标保持一致

2011 IEEE 24th Computer Security Foundations Symposium Pub Date : 1900-01-01 DOI: 10.3233/JCS-140500

D. Basin, Samuel J. Burri, G. Karjoth

引用次数: 41