Security as a Game – Decisions from Incomplete Models
Stefan Raß, Peter Schartner, Raphael Wigoutschnigg · InTech eBooks · 2010
Decision Support Systems 392 1.1 The problem of perfect end-to-end secrecy Quantum cryptography claims to bring perfect secrecy to a given line, but speaking honestly, it is no more than this.Using a carrier that is sufficiently fragile to rule out copying it, naturally raises the question of how much distance can be bridged?In fact, nowadays available quantum cryptography allows for communication over a distance of up to 144 km, as demonstrated by Schmitt-Manderbach et al. (2007), but arbitrary distances can yet not be bridged.Although theoretical results due to Lo & Chau (1999) indicate that the noise problem can be overcome, making arbitrary ranges theoretically possible, building networks is inevitable for a global roll-out.Existing solutions mostly rely on trusted relay for that matter.However, why attack the quantum line, if attacking a relay node is fully sufficient?Under the assumption of perfectly protected lines, recent results indicate that without preexisting secrets that are exclusively known to the sender and the receiver, end-to-endsecurity is only achievable under hard constraints on the network topology.To be more precise, let G be a graph that models a network.Let V(G), E(G) be the sets of vertices and edges of G, and assume the sender s and receiver r to be parts of G, that is {s, r} ⊆ V(G).The adversary can be modelled by a set A ⊆ 2 V(G)\{s, r} (the powerset of V(G)\{s, r}), that is we assume that a selection of subsets of vertices can be compromised.If k such sets can become conquered simultaneously, then we face a k-active adversary.An infected vertex v is assumed fully under the adversary's control, so a message passing through v can be read, blocked or modified and v is free to create as many new messages as desired.There is no limitation on computational power or knowledge of the adversary.If removing from G the vertices in any k sets in the adversary structure A cannot disconnect s and r in G, then we call the graph A (k) (s,r)-subconnected.If, by doing so, the network cannot be disconnected at all, then the graph is said to be A (k) -subconnected.Referring to these notions, a network permits perfectly secure message delivery from s to r if and only if the graph G is A (2) (s,r)-subconnected.The reader may consult Ashwin Kumar et al. (2002) for a proof.Different, yet no less stringent requirements are imposed by Wang & Desmedt (2008): among related results, the following necessary condition best highlights the difficulty of achieving unconditional security in a real-life network: if for u ≥ 1, 3(ku) + 1 ≥ k + 1 directed node-disjoint paths from s to r exist, then a necessary condition for perfectly secure message transmission from s to r against a k-active adversary is that there are u directed node disjoint paths (these u paths are also disjoint from the 3(ku) + 1 paths from s to r) from r to s.The described adversary model applies to many situations, as for example machines running certain software may all suffer from the same security holes.Networks equipped with devices from different vendors may be considered vulnerable if one vendor's devices turn out to be insecure.A k-active adversary would correspond to k vendors cooperating, or equivalently arise, if k vendors obtained the same malicious module from a single fraudulent manufacturer, turning a heterogeneous set of products into a possible backdoor for an adversary. Decision theory and system securityMany results either guarantee or rule out perfectly secret communication, but this might not be satisfactory.If perfectly secure communication is not possible, then how much is achievable with the given resources?A variety of security metrics has been proposed, but a measure of security is yet missing.This work summarizes a decision-theoretic approach to quantifying risk in terms that can be specified to best suit the application at hand.www.intechopen.