Dynamic Observers for the Synthesis of Opaque Systems Franck Cassez 1 , Jérémy Dubreil 2 and Hervé Marchand 2 1 NICTA & CNRS 2 INRIA/IRISA Sydney Rennes Bretagne Atlantique France Australia ATVA’09, Macau SAR October 13–16, 2009
Context Need for Security in Transactional Systems Web-services: e-banking, online transactions Id documents: biometric passport, Medicare Card E-voting systems Different Types of Security Integrity: illegal actions cannot be performed by an unauthorized user Bank account management cannot be managed by a third party Availability: some actions must be available Withdrawing money from your bank account Privacy: information should remain hidden from some users PIN code Opacity was introduced in [Mazaré, 2004, Bryans et al., 2008] F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 2 / 27
Context Need for Security in Transactional Systems Web-services: e-banking, online transactions Id documents: biometric passport, Medicare Card E-voting systems Different Types of Security Integrity: illegal actions cannot be performed by an unauthorized user Bank account management cannot be managed by a third party Availability: some actions must be available Withdrawing money from your bank account Privacy: information should remain hidden from some users PIN code In this paper we consider opacity (privacy) Opacity was introduced in [Mazaré, 2004, Bryans et al., 2008] F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 2 / 27
Outline of the Talk Opacity for Finite State Systems 1 What is Opacity? Opacity for Non-Deterministic Automata Algorithms for Checking Opacity Minimization Problem with Static Filters 2 Minimization Problem with Dynamic Filters 3 Opacity with Dynamic Filters Checking Opacity with Dynamic Filters Cost of a Dynamic Filter Computing the Cost of a Given Filter Minimization Problem Computation of the Most Permissive Filter Computing an Optimal Dynamic Filter Summary & Future Work 4 F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 3 / 27
Outline Opacity for Finite State Systems 1 What is Opacity? Opacity for Non-Deterministic Automata Algorithms for Checking Opacity Minimization Problem with Static Filters 2 Minimization Problem with Dynamic Filters 3 Opacity with Dynamic Filters Checking Opacity with Dynamic Filters Cost of a Dynamic Filter Computing the Cost of a Given Filter Minimization Problem Computation of the Most Permissive Filter Computing an Optimal Dynamic Filter Summary & Future Work 4 F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 4 / 27
What is Opacity? System S Secret F Secret = set of states b a Events in Σ o ⊆ Σ are observable Example: Σ o = { b } c b Σ = { a, b, c } F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 5 / 27
What is Opacity? System S Secret F Secret = set of states b a Events in Σ o ⊆ Σ are observable Example: Σ o = { b } c b Σ = { a, b, c } Opacity: an external observer should never know F -states F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 5 / 27
What is Opacity? System S Secret F Secret = set of states b a Events in Σ o ⊆ Σ are observable Example: Σ o = { b } c Secret F is opaque b Σ = { a, b, c } Opacity: an external observer should never know F -states F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 5 / 27
What is Opacity? System S Secret F Secret = set of states b a Events in Σ o ⊆ Σ are observable Example: Σ o = { a, b } c Secret F is not opaque b Σ = { a, b, c } Opacity: an external observer should never know F -states F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 5 / 27
What is Opacity? System S Secret F Secret = set of states b a Events in Σ o ⊆ Σ are observable Example: Σ o = { b } c Secret F is not opaque b Σ = { a, b, c } Opacity: an external observer should never know F -states F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 5 / 27
What is Opacity? System S Secret F Secret = set of states b a Events in Σ o ⊆ Σ are observable Example: Σ o = { b } c b Σ = { a, b, c } Opacity Verification Problem: Is F opaque w.r.t. ( S, Σ o ) ? F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 5 / 27
What is Opacity? System S Secret F Secret = set of states b a Events in Σ o ⊆ Σ are observable Example: Σ o = { b } c b Σ = { a, b, c } Opacity Verification Problem: Is F opaque w.r.t. ( S, Σ o ) ? To check opacity: use your favorite Formal Method: Model-checking Theorem proving Tools to support automatic analysis of systems F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 5 / 27
Opacity for Non-Deterministic Automata A = ( Q, q 0 , Σ, δ, F ) a NDA F set of secret states Σ o ⊆ Σ set of observable events v = P ( u ) ∈ Σ ∗ u ∈ Σ ∗ o Projection P NDA A Attacker U Assumptions Attacker knows A and the projection P /alphabet Σ o K Σ o ( v ): knowledge set (of states) of the attacker after observing v Definition (Opacity) F is opaque w.r.t. ( A, Σ o ) if ∀ v ∈ P ( Tr ( A )) , K Σ o ( v ) �⊆ F ( K Σ o ( v ) ∩ ( Q \ F ) ≠ ∅ ). Opacity Problem Input: A NDA A , F secret set of states, Σ o set of observable events. Problem: Is F opaque w.r.t. ( A, Σ o ) ? F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 6 / 27
Opacity for Non-Deterministic Automata A = ( Q, q 0 , Σ, δ, F ) a NDA F set of secret states Σ o ⊆ Σ set of observable events v = P ( u ) ∈ Σ ∗ u ∈ Σ ∗ o Projection P NDA A Attacker U Assumptions Attacker knows A and the projection P /alphabet Σ o K Σ o ( v ): knowledge set (of states) of the attacker after observing v Definition (Opacity) F is opaque w.r.t. ( A, Σ o ) if ∀ v ∈ P ( Tr ( A )) , K Σ o ( v ) �⊆ F ( K Σ o ( v ) ∩ ( Q \ F ) ≠ ∅ ). Opacity Problem Input: A NDA A , F secret set of states, Σ o set of observable events. Problem: Is F opaque w.r.t. ( A, Σ o ) ? F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 6 / 27
Opacity for Non-Deterministic Automata A = ( Q, q 0 , Σ, δ, F ) a NDA F set of secret states Σ o ⊆ Σ set of observable events v = P ( u ) ∈ Σ ∗ u ∈ Σ ∗ o Projection P NDA A Attacker U Assumptions Attacker knows A and the projection P /alphabet Σ o K Σ o ( v ): knowledge set (of states) of the attacker after observing v Definition (Opacity) F is opaque w.r.t. ( A, Σ o ) if ∀ v ∈ P ( Tr ( A )) , K Σ o ( v ) �⊆ F ( K Σ o ( v ) ∩ ( Q \ F ) ≠ ∅ ). Opacity Problem Input: A NDA A , F secret set of states, Σ o set of observable events. Problem: Is F opaque w.r.t. ( A, Σ o ) ? F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 6 / 27
Knowledge Set of the Attacker Tr ( A ) = set of words generated by A P is the projection over Σ o ⊆ Σ P – 1 : Σ ∗ P – 1 ( w ) = set of words which project onto w o → 2 Σ ∗ Pre( ε ) = { ε } and Pre( u.λ ) = P – 1 ( u ) .λ ∩ Tr ( A ) Knowledge set of U : K Σ o ( u ) = δ ( q 0 , Pre( u )) Consider knowledge set right after each observation of the attacker F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 7 / 27
Knowledge Set of the Attacker Tr ( A ) = set of words generated by A P is the projection over Σ o ⊆ Σ P – 1 : Σ ∗ P – 1 ( w ) = set of words which project onto w o → 2 Σ ∗ Pre( ε ) = { ε } and Pre( u.λ ) = P – 1 ( u ) .λ ∩ Tr ( A ) Knowledge set of U : K Σ o ( u ) = δ ( q 0 , Pre( u )) Example a Σ o = { b } b q 4 q 5 q 6 a,b P ( b.b.a.b.a ) = b.b.b b P – 1 ( b ) = a ∗ .b.a ∗ b a Pre( b ) = { b, a.b } K Σ o ( b ) = { q 0 , q 5 , q 2 } a b a q 0 q 1 q 2 q 3 a,b F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 7 / 27
Knowledge Set of the Attacker Tr ( A ) = set of words generated by A P is the projection over Σ o ⊆ Σ P – 1 : Σ ∗ P – 1 ( w ) = set of words which project onto w o → 2 Σ ∗ Pre( ε ) = { ε } and Pre( u.λ ) = P – 1 ( u ) .λ ∩ Tr ( A ) Knowledge set of U : K Σ o ( u ) = δ ( q 0 , Pre( u )) Problem 1: Checking opacity with Static Filters Input: a NDA A , F secret set of states, Σ o set of observable events. Problem: Is F opaque w.r.t. ( A, Σ o ) ? Theorem Problem 1 is PSPACE-complete. F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 7 / 27
Algorithms for Checking Opacity Proof. Reduction of universality problem for non-deterministic automaton. Given A over Σ with accepting states F , the universality problem is: decide whether L F ( A ) = Σ ∗ . Assume A is complete i.e. Tr ( A ) = Σ ∗ . Reduction: A is universal iff Q \ F is opaque for ( A, Σ ). Algorithm to Check Opacity Subset construction 1 check whether a subset S ⊆ F is reachable 2 What if the system is NOT opaque ? F. Cassez, J. Dubreil, H. Marchand Dynamic Observers for the Synthesis of Opaque Systems 8 / 27
Recommend
More recommend
