Several mathematical ideas have been investigated for Quantitative
Information Flow. Information theory, probability, guessability are the main
ideas in most proposals. They aim to quantify how much information is leaked,
how likely is to guess the secret and how long does it take to guess the secret
respectively.
Leakage of confidential information represents a serious security risk.
Despite a number of novel, theoretical advances, it has been unclear if and how
quantitative approaches to measuring leakage of confidential information could
be applied to substantial, real-world programs. This is mostly due to the high
complexity of computing precise leakage quantities. In this paper, we introduce
a technique which makes it possible to decide if a program conforms to a
quantitative policy which scales to large state-spaces with the help of bounded
model checking.
When studying the information leakage in programs or protocols, a natural
question arises: "what is the worst case scenario?". This problem of
identifying the maximal leakage can be seen as a channel capacity problem in
the information theoretical sense. In this paper, by combining two powerful
theories: Information Theory and Karush-Kuhn-Tucker conditions, we demonstrate
a very general solution to the channel capacity problem.