Alvim Mário S, Chatzikokolakis Konstantinos, Kawamoto Yusuke, Palamidessi Catuscia
Computer Science Department, Universidade Federal de Minas Gerais (UFMG), Belo Horizonte-MG 31270-110, Brazil.
École Polytechnique, 91128 Palaiseau, France.
Entropy (Basel). 2018 May 18;20(5):382. doi: 10.3390/e20050382.
In the inference attacks studied in Quantitative Information Flow (QIF), the attacker typically tries to interfere with the system in the attempt to increase its leakage of secret information. The defender, on the other hand, typically tries to decrease leakage by introducing some controlled noise. This noise introduction can be modeled as a type of protocol composition, i.e., a probabilistic choice among different protocols, and its effect on the amount of leakage depends heavily on whether or not this choice is visible to the attacker. In this work, we consider operators for modeling visible and hidden choice in protocol composition, and we study their algebraic properties. We then formalize the interplay between defender and attacker in a game-theoretic framework adapted to the specific issues of QIF, where the payoff is information leakage. We consider various kinds of leakage games, depending on whether players act simultaneously or sequentially, and on whether or not the choices of the defender are visible to the attacker. In the case of sequential games, the choice of the second player is generally a function of the choice of the first player, and his/her probabilistic choice can be either over the possible functions (mixed strategy) or it can be on the result of the function (behavioral strategy). We show that when the attacker moves first in a sequential game with a hidden choice, then behavioral strategies are more advantageous for the defender than mixed strategies. This contrasts with the standard game theory, where the two types of strategies are equivalent. Finally, we establish a hierarchy of these games in terms of their information leakage and provide methods for finding optimal strategies (at the points of equilibrium) for both attacker and defender in the various cases.
在定量信息流（QIF）中研究的推理攻击中，攻击者通常试图干扰系统，以增加其秘密信息的泄露。另一方面，防御者通常试图通过引入一些可控噪声来减少泄露。这种噪声引入可以建模为一种协议组合类型，即在不同协议之间进行概率选择，其对泄露量的影响在很大程度上取决于这种选择对攻击者是否可见。在这项工作中，我们考虑用于对协议组合中的可见选择和隐藏选择进行建模的算子，并研究它们的代数性质。然后，我们在一个适用于QIF特定问题的博弈论框架中形式化防御者和攻击者之间的相互作用，其中收益是信息泄露。我们考虑各种类型的泄露博弈，这取决于玩家是同时行动还是相继行动，以及防御者的选择对攻击者是否可见。在相继博弈的情况下，第二个玩家的选择通常是第一个玩家选择的函数，并且他/她的概率选择可以是在可能的函数上（混合策略），也可以是在函数的结果上（行为策略）。我们表明，当攻击者在具有隐藏选择的相继博弈中首先行动时，那么行为策略对防御者比混合策略更有利。这与标准博弈论形成对比，在标准博弈论中这两种策略类型是等价的。最后，我们根据信息泄露建立这些博弈的层次结构，并提供在各种情况下为攻击者和防御者找到最优策略（在均衡点）的方法。
