Measuring opacity in web services
Amina Bourouis, Kaïs Klai, Nejib Ben Hadj-Alouane · 2017
Opacity is a formal security property that formulates the abilities of a passive observer to infer secret information. Usual opacity studies focus on affirming that a system is either opaque or non-opaque w.r.t. the secret and an observation map. This view, however, fails to reflect that a system may be opaque because of a single non-secret execution among an overwhelming number of secret ones. For this reason, we propose, in this work, to quantify the opacity of a Web service (WS) into a numeral value that measures its security. Our approach consists in defining an opacity degree for the system and its Symbolic Observation Graph (SOG) abstraction. Furthermore, and to ensure its efficiency, we conduct an experimental study.