A Game-Theoretic Approach to Information-Flow Control via Protocol Composition

Let \mathcal{X} \subset \mathbb{R}^m and \mathcal{Y} \subset \mathbb{R}^n be compact convex sets, and \textit{U}: \mathcal{X}\times\mathcal{Y}\rightarrow\mathbb{R} be a continuous function such that \textit{U}(x, y) is a convex function in x\in\mathcal{X} and a concave function in y\in\mathcal{Y}. Then

Given a family \{C_{i}\}_{i \in \mathcal{I}} of channels of type \mathcal{X} \times \mathcal{Y} \rightarrow \mathbb{R}, and a distribution \mu on \mathcal{I}, the hidden choice {\osum_{i \leftarrow \mu}} C_{i} is a channel of type \mathcal{X} \times \mathcal{Y} \rightarrow \mathbb{R}.

Given a family \{C_{i}\}_{i \in \mathcal{I}} of compatible channels s.t. each C_{i} has type \mathcal{X} \times \mathcal{Y}_{i} \rightarrow \mathbb{R}, and a distribution \mu on \mathcal{I}, the result of the visible choice {\bigsqcupdot_{i \leftarrow \mu}} C_{i} is a channel of type \mathcal{X} \times \left( \bigsqcup_{i \in \mathcal{I}} \mathcal{Y}_{i} \right) \rightarrow \mathbb{R}.

Given a family \{C_{i}\}_{i \in \mathcal{I}} of channels s.t. C_{i} = C for all i \in \mathcal{I}, and a distribution \mu on \mathcal{I}, then:

(a) {{\osum_{i \leftarrow \mu}}C_{i} = C}; and

(b) {{\bigsqcupdot_{i \leftarrow \mu}}C_{i} \approx C}.

Given a family \{C_{i j}\}_{i \in \mathcal{I}, j \in \mathcal{J}} of channels indexed by sets \mathcal{I} and \mathcal{J}, a distribution \mu on \mathcal{I}, and a distribution \eta on \mathcal{J}:

enumi)(enumi)

1. {{\osum_{i \leftarrow \mu}} \;{\osum_{j \leftarrow \eta}} C_{i j} = {\osum_{\substack{i \leftarrow \mu\\ j \leftarrow \eta}}} C_{i j}}, if all C_{i}’s have the same type;
   

2. {{\bigsqcupdot_{i \leftarrow \mu}} \; {\bigsqcupdot_{j \leftarrow \eta}} C_{i j} \approx {\bigsqcupdot_{\substack{i \leftarrow \mu\\ j \leftarrow \eta}}} C_{i j}}, if all C_{i}’s are compatible; and
   

3. {{\osum_{i \leftarrow \mu}} \; {\bigsqcupdot_{j \leftarrow \eta}} C_{i j} \approx {\bigsqcupdot_{j \leftarrow \eta}}\; {\osum_{i \leftarrow \mu}} C_{i j}}, if, for each i, all C_{i j}’s have same type \mathcal{X} \times \mathcal{Y}_{j}\rightarrow\mathbb{R}.

Let \{C_{i}\}_{i \in \mathcal{I}} be a family of channels, and \mu be a distribution on \mathcal{I}. Then, for every distribution \pi on \mathcal{X}, and every vulnerability \mathbb{V}:

1. posterior vulnerability is convex w.r.t. to hidden choice:

   \mathbb{V}\left[\pi,{\osum_{i \leftarrow \mu}} C_{i}\right] \leq \sum_{i \in \mathcal{I}} \mu(i) \,\mathbb{V}\left[\pi,C_{i}\right]

   if all C_{i}’s have the same type.

2. posterior vulnerability is linear w.r.t. to visible choice:

   \mathbb{V}\left[\pi,{\bigsqcupdot_{i \leftarrow \mu}} C_{i}\right] = \sum_{i \in \mathcal{I}} \mu(i) \,\mathbb{V}\left[\pi,C_{i}\right]

   if all C_{i}’s are compatible.

Let \{C_{i j}\}_{i \in \mathcal{I}, j \in \mathcal{J}} be a family of channels, all with domain \mathcal{X} and with the same type, and let \pi\in \mathbb{D}\mathcal{X}, and \mathbb{V} be any vulnerability. Define \textit{U}: \mathbb{D}\mathcal{I}\times\mathbb{D}\mathcal{J}\rightarrow \mathbb{R} as follows:

\textit{U}(\mu, \eta) \ensuremath{\stackrel{\mathrm{def}}{=}} \mathbb{V}\left[\pi,{\osum_{i \leftarrow \mu}} \; {\bigsqcupdot_{j \leftarrow \eta}} \; C_{i j}\right].

Then \textit{U} is convex on \mu and linear on \eta.

Consider a defender-first sequential game with visible choice, and attacker’s strategies of type \mathbb{D}(\mathcal{D}\,{\rightarrow}\,\mathcal{A}). Let d^*\ensuremath{\stackrel{\mathrm{def}}{=}} \operatornamewithlimits{argmin}_d \max_a \textit{u}(d,a) and let \textit{s}_{\sf a}^*:\mathcal{D}\,{\rightarrow}\,\mathcal{A} be defined as \textit{s}_{\sf a}^*(d)\ensuremath{\stackrel{\mathrm{def}}{=}} \operatornamewithlimits{argmax}_{a} \textit{u}(d,a) (if there is more than one a that maximizes \textit{u}(d,a), we select one of them arbitrarily). Then for every \delta\in\mathbb{D}\mathcal{D} and {\sigma_{\sf a}}\in\mathbb{D}(\mathcal{D}\,{\rightarrow}\,\mathcal{A}) we have \textit{U}(d^*,{\sigma_{\sf a}})\leq \textit{u}(d^*,\textit{s}_{\sf a}^*(d^*))\leq \textit{U}(\delta,\textit{s}_{\sf a}^*).

Consider a defender-first sequential game with visible choice, and attacker’s strategies of type \mathcal{D} \rightarrow \mathbb{D}(\mathcal{A}). Let d^*\ensuremath{\stackrel{\mathrm{def}}{=}} \operatornamewithlimits{argmin}_d \max_a \textit{u}(d,a) and let \phi^*_{\sf a}:\mathcal{D} \rightarrow \mathbb{D}(\mathcal{A}) be defined as \phi^*_{\sf a}(d)(a)\ensuremath{\stackrel{\mathrm{def}}{=}} 1 if a= \operatornamewithlimits{argmax}_{a'} \textit{u}(d,a') (if there is more than one such a, we select one of them arbitrarily), and \phi^*_{\sf a}(d)(a)\ensuremath{\stackrel{\mathrm{def}}{=}} 0 otherwise. Then for every \delta\in\mathbb{D}\mathcal{D} and {\phi_{\sf a}}: \mathcal{D} \rightarrow \mathbb{D}(\mathcal{A}) we have: \textit{U}(d^*,{\phi_{\sf a}}(d^*))\leq \textit{U}(d^*,\phi^*_{\sf a}(d^*))\leq \textit{U}(\delta,\phi^*_{\sf a}).

Consider a defender-first sequential game with visible choice, and let d^*, \textit{s}_{\sf a}^* and \phi^*_{\sf a} be defined as in Theorems A3 and A4 respectively. Then \textit{u}(d^*,\textit{s}_{\sf a}^*(d^*))= \textit{U}(d^*,\phi^*_{\sf a}(d^*)).

Consider a defender-first sequential game with visible choice. Let a^*\ensuremath{\stackrel{\mathrm{def}}{=}} \operatornamewithlimits{argmax}_a \min_d \textit{u}(d,a). Let \textit{s}_{\sf d}^*:\mathcal{A}\,{\rightarrow}\,\mathcal{D} be defined as \textit{s}_{\sf d}^*(a)\ensuremath{\stackrel{\mathrm{def}}{=}} \operatornamewithlimits{argmin}_{d} \textit{u}(d,a), and let \phi^*_{\sf d}:\mathcal{A} \rightarrow \mathbb{D}(\mathcal{D}) be defined as \phi^*_{\sf d}(a)(d)\ensuremath{\stackrel{\mathrm{def}}{=}} 1 if d= \operatornamewithlimits{argmin}_{d'} \textit{u}(d',a). Then:

1. For every \alpha\in\mathbb{D}\mathcal{A} and {\sigma_{\sf d}}\in\mathbb{D}(\mathcal{A}\,{\rightarrow}\,\mathcal{D}) we have \textit{U}(\textit{s}_{\sf d}^*,\alpha)\leq \textit{u}(\textit{s}_{\sf d}^*(a^*),a^*)\leq \textit{U}({\sigma_{\sf d}},a^*).
   

2. For every \alpha\in\mathbb{D}\mathcal{A} and {\phi_{\sf d}}: \mathcal{A} \rightarrow \mathbb{D}(\mathcal{D}) we have: \textit{U}(\phi^*_{\sf d},\alpha)\leq \textit{U}(\phi^*_{\sf d}(a^*),a^*)\leq \textit{U}({\phi_{\sf d}}(a^*),a^*).
   

3. \textit{u}(\textit{s}_{\sf d}^*(a^*),a^*)= \textit{U}(\phi^*_{\sf d}(a^*),a^*).

Consider an attacker-first sequential game with hidden choice.

• 1. Mixed strategies – type \mathbb{D}(\mathcal{A}\,{\rightarrow}\,\mathcal{D}). Let a^*\ensuremath{\stackrel{\mathrm{def}}{=}} \operatornamewithlimits{argmax}_a\min_{{\sigma_{\sf d}}}\mathbb{V}\left[\pi,{{\osum_{\textit{s}_{\sf d} \leftarrow {\sigma_{\sf d}}}}} {C_{\textit{s}_{\sf d}(a) a}}\right], and let \sigma^*_{\sf d}\ensuremath{\stackrel{\mathrm{def}}{=}} \operatornamewithlimits{argmin}_{{\sigma_{\sf d}}} \lambda a. \mathbb{V}\left[\pi,{{\osum_{\textit{s}_{\sf d} \leftarrow {\sigma_{\sf d}}}}} {C_{\textit{s}_{\sf d}(a) a}}\right]. Then, for every \alpha\in\mathbb{D}\mathcal{A} and {\sigma_{\sf d}}\in\mathbb{D}(\mathcal{A}\,{\rightarrow}\,\mathcal{D}) we have

  \textit{U}(\sigma^*_{\sf d},\alpha)\leq \textit{U}(\sigma^*_{\sf d},a^*)\leq \textit{U}({\sigma_{\sf d}},a^*)

• 2. Behavioral strategies – type \mathcal{A}\rightarrow \mathbb{D}(\mathcal{D}). Let a^*\ensuremath{\stackrel{\mathrm{def}}{=}} \operatornamewithlimits{argmax}_a\min_{\delta}\mathbb{V}\left[\pi,{{\osum_{d \leftarrow \delta}}} {C_{d a}}\right], and let \phi^*_{\sf d}\ensuremath{\stackrel{\mathrm{def}}{=}} \operatornamewithlimits{argmin}_{{\phi_{\sf d}}} \lambda a. \mathbb{V}\left[\pi,{{\osum_{d \leftarrow {\phi_{\sf d}}(a)}}} {C_{d a}}\right]. (The minimization is with respect to the point-wise ordering.) Then, for every \alpha\in\mathbb{D}\mathcal{A} and {\phi_{\sf d}}:\mathcal{A}\rightarrow \mathbb{D}(\mathcal{D}) we have

  \textit{U}(\phi^*_{\sf d},\alpha)\leq \textit{U}(\phi^*_{\sf d},a^*)\leq \textit{U}({\phi_{\sf d}},a^*)

For every a\in \mathcal{A} and every \delta\in \mathbb{D}\mathcal{D} we have:   \mathbb{V}\left[\pi,{{\bigsqcupdot_{d \leftarrow \delta}}} {C_{d a}}\right]\,\, \geq\,\, \mathbb{V}\left[\pi,{{\osum_{d \leftarrow \delta}}} {C_{d a}}\right].

For any \alpha\in \mathbb{D}\mathcal{A} and any {\sigma_{\sf d}} \in\mathbb{D}(\mathcal{A}\,{\rightarrow}\,\mathcal{D}) there exists {\phi_{\sf d}} :\mathcal{A}\rightarrow \mathbb{D}(\mathcal{D}) such that:

Consider the password checker program of Algorithm ? for n-bit passwords, where the attacker controls the low input to the checker, and the defender controls the order in which the bits are checked. If the prior \pi on possible passwords is uniform, and the payoff is given by the posterior Bayes-vulnerability \textit{U}(\delta,\alpha) \allowbreak = \allowbreak \operatornamewithlimits{\displaystyle\mathbb{E}}_{\substack{a\leftarrow\alpha\\ }}\hspace{-1ex} \; \mathbb{V}\left[\pi,{{\osum_{d \leftarrow \delta}}} {C_{d a}}\right], then the strategy (\delta^*,\alpha) where \delta^* is uniform and \alpha is arbitrary is an equilibrium strategy.

Two channels C_{1} and C_{2} are equivalent iff every column of C_{1} is a convex combination of columns of C_{2}^{0}, and every column of C_{2} is a convex combination of columns of C_{1}^{0}.

For any channels C_{1} and C_{2} of the same type, and any values 0 \leq p,q \leq 1, the binary hidden choice operator satisfies the following properties:

enumi)enumi)

1. Idempotency: C_{1} \;{{}_{p}{\mathlarger{\mathlarger{\oplus}}}}\; C_{1} = C_{1}

2. Commutativity: C_{1} \;{{}_{p}{\mathlarger{\mathlarger{\oplus}}}}\; C_{2} = C_{2} \;{{}_{\overline{p}}{\mathlarger{\mathlarger{\oplus}}}}\; C_{1}

3. Associativity:

   C_{1} \;{{}_{p}{\mathlarger{\mathlarger{\oplus}}}}\; (C_{2} \;{{}_{q}{\mathlarger{\mathlarger{\oplus}}}}\; C_{3}) = ( \nicefrac{1}{q} \cdot C_{1} \;{{}_{p}{\mathlarger{\mathlarger{\oplus}}}}\; C_{2}) \;{{}_{q}{\mathlarger{\mathlarger{\oplus}}}}\; \overline{p} \cdot C_{3}

   if q \neq 0.

4. Absorption:

   (C_{1} \;{{}_{p}{\mathlarger{\mathlarger{\oplus}}}}\; C_{2}) \;{{}_{q}{\mathlarger{\mathlarger{\oplus}}}}\; (C_{1} \;{{}_{r}{\mathlarger{\mathlarger{\oplus}}}}\; C_{2}) = C_{1} \;{{}_{(pq + \overline{q}r)}{\mathlarger{\mathlarger{\oplus}}}}\; C_{2}.

For any compatible channels C_{1} and C_{2}, and any values 0 \leq p,q \leq 1, the visible choice operator satisfies the following properties:

enumi)enumi)

1. Idempotency: C_{1} \;{{}_{p}{\mathlarger{\mathlarger{\sqcupdot}}}}\; C_{1} \approx C_{1}

2. Commutativity: C_{1} \;{{}_{p}{\mathlarger{\mathlarger{\sqcupdot}}}}\; C_{2} \approx C_{2} \;{{}_{\overline{p}}{\mathlarger{\mathlarger{\sqcupdot}}}}\; C_{1}

3. Associativity: C_{1} \;{{}_{p}{\mathlarger{\mathlarger{\sqcupdot}}}}\; (C_{2} \;{{}_{q}{\mathlarger{\mathlarger{\sqcupdot}}}}\; C_{3}) \approx ( \nicefrac{1}{q} \cdot C_{1} \;{{}_{p}{\mathlarger{\mathlarger{\sqcupdot}}}}\; C_{2}) \;{{}_{q}{\mathlarger{\mathlarger{\sqcupdot}}}}\; \overline{p} \cdot C_{3} if q \neq 0.

Let C_{1}, C_{2} and C_{3} be compatible channels, and C_{2} and C_{3} have the same type. Then, for any values 0 \leq p,q \leq 1: