Probabilistic Confidentiality Properties based on Indistinguishability.
Thomas Santen · 2005
Abstract: This paper motivates three confidentiality properties based onthe notion of indistinguishable behavior induced by adversary observations of nondeterministic and probabilistic systems. Concealed behavior is a possibilistic property, whereas ensured entropy and bounded risk are probabilistic properties. In contrast to noninterferencelike information flow properties, these properties do not primarily aim at restricting information flow, but on keeping the differences between indistinguishable behavior confidential. To support the probabilistic definitions, the concept of the probability of a trace given an observation is clarified for systems permitting external, nondeterministic, and probabilistic choice. 1 Specification of Confidentiality The question of specifying and analyzing confidentiality properties ofIT-systems has attracted considerable attention in the research community over the last decades. Experience with information flow analysis over program code [Den82] and the Bell-La Padula model of multi-levelsecurity [BL75] shows that it is desirable to formulate confidentiality