[Paper Review] Algebraic Foundations for Information Theoretical, Probabilistic and Guessability measures of Information Flow

Pasquale Malacaria|arXiv (Cornell University)|Jan 18, 2011

Security and Verification in Computing16 references20 citations

TL;DR

This paper establishes the Lattice of Information (LoI) as a unifying algebraic foundation for quantitative information flow (QIF) measures—information theory, probability, and guessability—demonstrating that refinement in LoI corresponds to reduced leakage across all three measures. It proves that if one program's observational equivalence relation refines another’s, then its entropy is lower, its guessability is higher, and its probability of being guessed in n tries is greater, unifying these approaches under a single algebraic framework.

ABSTRACT

Several mathematical ideas have been investigated for Quantitative Information Flow. Information theory, probability, guessability are the main ideas in most proposals. They aim to quantify how much information is leaked, how likely is to guess the secret and how long does it take to guess the secret respectively. In this paper, we show how the Lattice of Information provides a valuable foundation for all these approaches; not only it provides an elegant algebraic framework for the ideas, but also to investigate their relationship. In particular we will use this lattice to prove some results establishing order relation correspondences between the different quantitative approaches. The implications of these results w.r.t. recent work in the community is also investigated. While this work concentrates on the foundational importance of the Lattice of Information its practical relevance has been recently proven, notably with the quantitative analysis of Linux kernel vulnerabilities. Overall we believe these works set the case for establishing the Lattice of Information as one of the main reference structure for Quantitative Information Flow.

Motivation & Objective

• To unify information-theoretic, probabilistic, and guessability measures of information flow under a common algebraic framework.
• To establish the Lattice of Information (LoI) as a foundational structure for classifying confidentiality threats in programs.
• To demonstrate that LoI refinement corresponds to consistent ordering across entropy, probability of guessing, and expected number of guesses.
• To show that LoI-based analysis enables practical quantitative verification of real-world vulnerabilities, such as in the Linux kernel.
• To resolve foundational debates in QIF, such as the discrepancy between one-guess and information-theoretic models, by showing distribution-independent relative vulnerability is determined by LoI order.

Proposed method

• Model attacker views as equivalence relations on secret states, representing indistinguishability under observations.
• Define the Lattice of Information (LoI) as the set of all equivalence relations on a state space, forming a complete lattice under refinement.
• Use the LoI to decompose QIF into two steps: (1) algebraic interpretation as an equivalence relation, (2) numerical evaluation via entropy, probability, or guessability.
• Prove that LoI refinement (i.e., finer equivalence) implies lower entropy, higher guessability, and higher probability of guessing in n tries.
• Apply the framework to loops by modeling them as the join of iteration-based partitions intersected with a collision equivalence relation.
• Use assume-guarantee reasoning and symbolic model checking (e.g., CBMC) to compute bounds on channel capacity, enabling scalable analysis of real C code.

Experimental results

Research questions

• RQ1 How can information-theoretic, probabilistic, and guessability measures of information flow be unified under a single algebraic structure?
• RQ2 Does refinement in the Lattice of Information (LoI) correspond to consistent ordering across entropy, probability of guessing, and expected number of guesses?
• RQ3 Can the LoI framework resolve discrepancies between different QIF models, such as the one-guess model vs. information-theoretic models?
• RQ4 Is the LoI framework practically applicable to real-world systems, such as the Linux kernel?
• RQ5 Can LoI-based analysis be scaled to complex constructs like loops and real C programs?

Key findings

• Refinement of an equivalence relation in the Lattice of Information (LoI) implies strictly lower entropy leakage, meaning the system is less vulnerable from an information-theoretic perspective.
• If LoI(P') refines LoI(P), then the probability of guessing the secret within n tries is strictly higher for P' than for P, regardless of the secret distribution.
• The expected number of guesses required to break P' is strictly less than that for P, meaning P' is more vulnerable under a guessability measure.
• These three measures—entropy, probability of n-try guess, and expected number of guesses—form a consistent hierarchy under LoI refinement, with no contradictions across models.
• The LoI framework enables scalable analysis of loops by expressing their LoI as the join of iteration-based partitions intersected with a collision equivalence relation, enabling formal computation of leakage.
• The framework was successfully applied to quantify and verify fixes for real CVE vulnerabilities in the Linux kernel, demonstrating practical applicability of QIF to industrial systems.