The Experts below are selected from a list of 30942 Experts worldwide ranked by ideXlab platform
David Parker - One of the best experts on this subject based on the ideXlab platform.
-
Probabilistic Point-to-Point Information Leakage
2013 IEEE 26th Computer Security Foundations Symposium, 2013Co-Authors: Tom Chothia, Yusuke Kawamoto, Chris Novakovic, David ParkerAbstract:The outputs of a program that processes secret data may reveal Information about the values of these secrets. This paper develops an Information Leakage model that can measure the Leakage between arbitrary points in a probabilistic program. Our aim is to create a model of Information Leakage that makes it convenient to measure specific leaks, and provide a tool that may be used to investigate a program's Information security. To make our Leakage model precise, we base our work on a simple probabilistic, imperative language in which secret values may be specified at any point in the program; other points in the program may then be marked as potential sites of Information Leakage. We extend our Leakage model to address both non-terminating programs (with potentially infinite numbers of secret and observable values) and user input. Finally, we show how statistical approximation techniques can be used to estimate our Leakage measure in real-world Java programs.
-
CSF - Probabilistic Point-to-Point Information Leakage
2013 IEEE 26th Computer Security Foundations Symposium, 2013Co-Authors: Tom Chothia, Yusuke Kawamoto, Chris Novakovic, David ParkerAbstract:The outputs of a program that processes secret data may reveal Information about the values of these secrets. This paper develops an Information Leakage model that can measure the Leakage between arbitrary points in a probabilistic program. Our aim is to create a model of Information Leakage that makes it convenient to measure specific leaks, and provide a tool that may be used to investigate a program's Information security. To make our Leakage model precise, we base our work on a simple probabilistic, imperative language in which secret values may be specified at any point in the program; other points in the program may then be marked as potential sites of Information Leakage. We extend our Leakage model to address both non-terminating programs (with potentially infinite numbers of secret and observable values) and user input. Finally, we show how statistical approximation techniques can be used to estimate our Leakage measure in real-world Java programs.
Simha Sethumadhavan - One of the best experts on this subject based on the ideXlab platform.
-
Side-channel vulnerability factor: A metric for measuring Information Leakage
Proceedings - International Symposium on Computer Architecture, 2012Co-Authors: John Demme, Robert Martin, Adam Waksman, Simha SethumadhavanAbstract:There have been many attacks that exploit side-effects of program execution to expose secret Information and many proposed countermeasures to protect against these attacks. However there is currently no systematic, holistic method- ology for understanding Information Leakage. As a result, it is not well known how design decisions affect informa- tion Leakage or the vulnerability of systems to side-channel attacks. In this paper, we propose a metric for measuring Information Leakage called the Side-channel Vulnerability Fac- tor (SVF). SVF is based on our observation that all side- channel attacks ranging from physical to microarchitectural to software rely on recognizing leaked execution patterns. SVF quantifies patterns in attackers’ observations and mea- sures their correlation to the victim’s actual execution pat- terns and in doing so captures systems’ vulnerability to side-channel attacks. \\ In a detailed case study of on-chip memory systems, SVF measurements help expose unexpected vulnerabilities in whole-system designs and shows how designers can make performance-security trade-offs. Thus, SVF provides a quantitative approach to secure computer architecture.
Tom Chothia - One of the best experts on this subject based on the ideXlab platform.
-
LeakWatch: Estimating Information Leakage from Java Programs
2014Co-Authors: Tom Chothia, Yusuke Kawamoto, Chris NovakovicAbstract:Programs that process secret data may inadvertently reveal Information about those secrets in their publicly-observable output. This paper presents LeakWatch, a quantitative Information Leakage analysis tool for the Java programming language; it is based on a flexible "point-to-point" Information Leakage model, where secret and publicly-observable data may occur at any time during a program's execution. LeakWatch repeatedly executes a Java program containing both secret and publicly-observable data and uses robust statistical techniques to provide estimates, with confidence intervals, for min-entropy Leakage (using a new theoretical result presented in this paper) and mutual Information. We demonstrate how LeakWatch can be used to estimate the size of Information leaks in a range of real-world Java programs.
-
Probabilistic Point-to-Point Information Leakage
2013 IEEE 26th Computer Security Foundations Symposium, 2013Co-Authors: Tom Chothia, Yusuke Kawamoto, Chris Novakovic, David ParkerAbstract:The outputs of a program that processes secret data may reveal Information about the values of these secrets. This paper develops an Information Leakage model that can measure the Leakage between arbitrary points in a probabilistic program. Our aim is to create a model of Information Leakage that makes it convenient to measure specific leaks, and provide a tool that may be used to investigate a program's Information security. To make our Leakage model precise, we base our work on a simple probabilistic, imperative language in which secret values may be specified at any point in the program; other points in the program may then be marked as potential sites of Information Leakage. We extend our Leakage model to address both non-terminating programs (with potentially infinite numbers of secret and observable values) and user input. Finally, we show how statistical approximation techniques can be used to estimate our Leakage measure in real-world Java programs.
-
CSF - Probabilistic Point-to-Point Information Leakage
2013 IEEE 26th Computer Security Foundations Symposium, 2013Co-Authors: Tom Chothia, Yusuke Kawamoto, Chris Novakovic, David ParkerAbstract:The outputs of a program that processes secret data may reveal Information about the values of these secrets. This paper develops an Information Leakage model that can measure the Leakage between arbitrary points in a probabilistic program. Our aim is to create a model of Information Leakage that makes it convenient to measure specific leaks, and provide a tool that may be used to investigate a program's Information security. To make our Leakage model precise, we base our work on a simple probabilistic, imperative language in which secret values may be specified at any point in the program; other points in the program may then be marked as potential sites of Information Leakage. We extend our Leakage model to address both non-terminating programs (with potentially infinite numbers of secret and observable values) and user input. Finally, we show how statistical approximation techniques can be used to estimate our Leakage measure in real-world Java programs.
Yusuke Kawamoto - One of the best experts on this subject based on the ideXlab platform.
-
HyLeak: Hybrid Analysis Tool for Information Leakage
2017Co-Authors: Fabrizio Biondi, Yusuke Kawamoto, Axel Legay, Louis-marie TraonouezAbstract:We present HyLeak, a tool for reasoning about the quantity of Information Leakage in programs. The tool takes as input the source code of a program and analyzes it to estimate the amount of leaked Information measured by mutual Information. The Leakage estimation is mainly based on a hybrid method that combines precise program analysis with statistical analysis using stochastic program simulation. This way, the tool combines the best of both symbolic and randomized techniques to provide more accurate estimates with cheaper analysis, in comparison with the previous tools using one of the analysis methods alone. HyLeak is publicly available and is able to evaluate the Information Leakage of randomized programs, even when the secret domain is large. We demonstrate with examples that HyLeaks has the best performance among the tools that are able to analyze randomized programs with similarly high precision of estimates.
-
LeakWatch: Estimating Information Leakage from Java Programs
2014Co-Authors: Tom Chothia, Yusuke Kawamoto, Chris NovakovicAbstract:Programs that process secret data may inadvertently reveal Information about those secrets in their publicly-observable output. This paper presents LeakWatch, a quantitative Information Leakage analysis tool for the Java programming language; it is based on a flexible "point-to-point" Information Leakage model, where secret and publicly-observable data may occur at any time during a program's execution. LeakWatch repeatedly executes a Java program containing both secret and publicly-observable data and uses robust statistical techniques to provide estimates, with confidence intervals, for min-entropy Leakage (using a new theoretical result presented in this paper) and mutual Information. We demonstrate how LeakWatch can be used to estimate the size of Information leaks in a range of real-world Java programs.
-
Probabilistic Point-to-Point Information Leakage
2013 IEEE 26th Computer Security Foundations Symposium, 2013Co-Authors: Tom Chothia, Yusuke Kawamoto, Chris Novakovic, David ParkerAbstract:The outputs of a program that processes secret data may reveal Information about the values of these secrets. This paper develops an Information Leakage model that can measure the Leakage between arbitrary points in a probabilistic program. Our aim is to create a model of Information Leakage that makes it convenient to measure specific leaks, and provide a tool that may be used to investigate a program's Information security. To make our Leakage model precise, we base our work on a simple probabilistic, imperative language in which secret values may be specified at any point in the program; other points in the program may then be marked as potential sites of Information Leakage. We extend our Leakage model to address both non-terminating programs (with potentially infinite numbers of secret and observable values) and user input. Finally, we show how statistical approximation techniques can be used to estimate our Leakage measure in real-world Java programs.
-
CSF - Probabilistic Point-to-Point Information Leakage
2013 IEEE 26th Computer Security Foundations Symposium, 2013Co-Authors: Tom Chothia, Yusuke Kawamoto, Chris Novakovic, David ParkerAbstract:The outputs of a program that processes secret data may reveal Information about the values of these secrets. This paper develops an Information Leakage model that can measure the Leakage between arbitrary points in a probabilistic program. Our aim is to create a model of Information Leakage that makes it convenient to measure specific leaks, and provide a tool that may be used to investigate a program's Information security. To make our Leakage model precise, we base our work on a simple probabilistic, imperative language in which secret values may be specified at any point in the program; other points in the program may then be marked as potential sites of Information Leakage. We extend our Leakage model to address both non-terminating programs (with potentially infinite numbers of secret and observable values) and user input. Finally, we show how statistical approximation techniques can be used to estimate our Leakage measure in real-world Java programs.
Chris Novakovic - One of the best experts on this subject based on the ideXlab platform.
-
LeakWatch: Estimating Information Leakage from Java Programs
2014Co-Authors: Tom Chothia, Yusuke Kawamoto, Chris NovakovicAbstract:Programs that process secret data may inadvertently reveal Information about those secrets in their publicly-observable output. This paper presents LeakWatch, a quantitative Information Leakage analysis tool for the Java programming language; it is based on a flexible "point-to-point" Information Leakage model, where secret and publicly-observable data may occur at any time during a program's execution. LeakWatch repeatedly executes a Java program containing both secret and publicly-observable data and uses robust statistical techniques to provide estimates, with confidence intervals, for min-entropy Leakage (using a new theoretical result presented in this paper) and mutual Information. We demonstrate how LeakWatch can be used to estimate the size of Information leaks in a range of real-world Java programs.
-
Probabilistic Point-to-Point Information Leakage
2013 IEEE 26th Computer Security Foundations Symposium, 2013Co-Authors: Tom Chothia, Yusuke Kawamoto, Chris Novakovic, David ParkerAbstract:The outputs of a program that processes secret data may reveal Information about the values of these secrets. This paper develops an Information Leakage model that can measure the Leakage between arbitrary points in a probabilistic program. Our aim is to create a model of Information Leakage that makes it convenient to measure specific leaks, and provide a tool that may be used to investigate a program's Information security. To make our Leakage model precise, we base our work on a simple probabilistic, imperative language in which secret values may be specified at any point in the program; other points in the program may then be marked as potential sites of Information Leakage. We extend our Leakage model to address both non-terminating programs (with potentially infinite numbers of secret and observable values) and user input. Finally, we show how statistical approximation techniques can be used to estimate our Leakage measure in real-world Java programs.
-
CSF - Probabilistic Point-to-Point Information Leakage
2013 IEEE 26th Computer Security Foundations Symposium, 2013Co-Authors: Tom Chothia, Yusuke Kawamoto, Chris Novakovic, David ParkerAbstract:The outputs of a program that processes secret data may reveal Information about the values of these secrets. This paper develops an Information Leakage model that can measure the Leakage between arbitrary points in a probabilistic program. Our aim is to create a model of Information Leakage that makes it convenient to measure specific leaks, and provide a tool that may be used to investigate a program's Information security. To make our Leakage model precise, we base our work on a simple probabilistic, imperative language in which secret values may be specified at any point in the program; other points in the program may then be marked as potential sites of Information Leakage. We extend our Leakage model to address both non-terminating programs (with potentially infinite numbers of secret and observable values) and user input. Finally, we show how statistical approximation techniques can be used to estimate our Leakage measure in real-world Java programs.