Upload
morgan-whitehead
View
220
Download
0
Tags:
Embed Size (px)
Citation preview
Annual Conference of ITAAnnual Conference of ITAACITA 2009ACITA 2009
A Metadata Algebra for Sharing Tactical InformationMudhakar Srivatsa†, Dakshi Agrawal† and Steffen Reidt‡
IBM T. J. Watson Research Center† Royal Holloway, University of London‡
Secure Information Flow Need for information flows across
traditional organizational boundaries
Military Coalitions Multiple countries and multiple
teams (special forces Vs search & rescue)
Share tactical intelligence and reconnaissance information
Business-to-Government SEC: securities and exchange
commission EDGAR: Electronic Data Gathering,
Analysis, and Retrieval system XBRL: eXtensible Business Reporting
Language
Business-to-Business Collaborations (e.g.: Supply Chain
Management) Web services (e.g.: mash up)
Operationencounters situation where information within data X,Y
may be very useful
COLLAB
ORATIO
N
Data X
Data Y
FLOW
Risk of (not) sharing information Risk of unauthorized information disclosure
(e.g.: leak secrets, mission failure, etc) Risk of not sharing information (e.g.:
mission failure, loss of life, loss in business, etc)
Risk is inevitable: How to systematically manage risk?
How to quantify risk? Value of object * Probability of
leakage? How to enable risk-based information
sharing? How to control overall risk?
Delivering right information to the right person at the right time
State of the art
Rigid; overtly conservative; and fails to adequately capture dynamic security attributes arising in tactical missions
MLS-like access control Label information with sensitivity level
(e.g.: unclassified, classified, secret and top secret)
Entities have security clearance level Clearance level ≥ sensitivity level ?
Static security labels and entity credentials
Fails to consider dynamic security attributes such as time sensitivity of tactical information
In a tactical mission entity credentials (e.g.: trust, allegiance, need-to-know, etc) and strategies may dynamically evolve
Rigid access control Boolean 0/1 access control decision Does not adequately capture risk due to
information sharing Does not support expressive reasoning:
Why is an object not sharable? What form of the object may be shareable?
Overtly conservative security calculus x = g(y1, y2, …, yn) label(x) = Max(label(y1), label(y2), …,
label(yn)) Does not consider downgrading
transforms Monotonicity problem: eventually
most derived objects are labeled top secret
=> most legitimate accesses are denied (or delayed due to manual intervention)
“MLS has a tendency to inhibit legitimate information flows” [MITRE06]
Strict obligation enforcement across domains is infeasible
Cannot mediate access to information once it leaves the domain
Digital Rights Management (DRM) is a hard problem!
Tracking provenance across semantic transform(s)
Value Arithmetic
Support dynamic attributes, information downgrade and fusion
Notation Object x Metadata vector x Є M (vector space)
Value function Г: M (F F) x = (10, 2) Гx = 10-2*t; Гx = 10*e-2*t
Г maps metadata vector to a time decaying value function
Assumptions 0 ≤ Гx < ∞, for all t Object x is contained in object y => Гx ≤
Гy, for all t Гx is continuous and differentiable in t
and ∂Гx/∂t ≤ 0, for all t
Value arithmetic Info loss and gain (entropy based
metrics) x = f(y1, y2, …, yn) x = g(y1, y2, …, yn) g is homomorphic to f: preserves info
downgrade and fusion semantics
Empirical Value Computation Γx(t) = ∑ Γyi(t) * 2-(I(yi|x,B)-I(x|yi))
yi = {y1, …, yi-1, yi+1, …, yn) B: background/public knowledge Self information I(y|x): minimum
number of information bits required to learn y given x
Metadata Calculus Operators +: M x M -> M and .: F x M -> M
Strong homomorphism x = y1 + y2 Гx = Гy1 + Гy2
x = a.y1 Гx = a * Гy1
Properties Commutative: y1 + y2 = y2 + y1 Associative: (y1 + y2) + y3 = y1 + (y2 +
y3) Distributive + in M: a.(y1 + y2) = a.y1 +
a.y2
Distributive . in M: a.(b.y1) = (a*b).y1
Distributed + in F: (a + b).y1 = a.y1 + b.y1
Zero Vector 0: 0 + y1 = y1
Scalar 1: 1.y1 = y1
Deducing output metadata x = f(y1, y2, …, yn) Γx(t) = ∑ Γyi(t) * 2-(I(yi|x,B)-I(x|yi))
x = ∑ yi . 2-(I(yi|x,B)-I(x|yi))
Strong homomorphism Impossible to achieve strong
homomorphism without incurring metadata expansion
Optimal expansion rate depends on decay function
Linear and exponential decay function x = y1 + y2 => |x| = |y1| + |y2| |x|: size of metadata vector x x = y1 + y2 + …+ yn => |x| ~ 2n-1 *
|yi| Optimal metadata expansion rate is
exponential
Weak homomorphism x = y1 + y2 => Гx ≥ Гy1 + Гy2
x = a.y1 Гx = a * Гy1
Weak homomorphism results in conservative value estimation
Constructively show that one can achieve weak homomorphism without metadata expansion
Trade off tightness of value estimates with metadata size using B-splines
Support automated deduction of output object metadata
B-Splines Spline
Parametric curve defined by piece wise polynomials over a finite set of control points {pi}: S(p1, p2, …, pn)
B-Spline (basis spline) Spline with minimal support (most
compact) Applications in computer graphics
– smoothing We use a special kind of B-spline
clamped uniform cubic B-spline
Strong convex hull property of B-splines
B-Spline is guaranteed to be contained within the convex hull of its control poly-line
Homomorphic + and . operators on B-splines
S(p11, p2
1, …, pn1) + S(p1
2, p22, …,
pn2) = S(p1
1 + p12, p2
1 + p22, …, pn
1 + pn
2) a . S(p1, p2, …, pn) = S(a*p1, a*p2,
…, a*pn)
B-Splines and Weak Homomorphism How to use B-splines?
Slow-decreasing value functions f is decreasing Derivative of f is non-decreasing Linear and exponential decay
functions are slow-decreasing
Basic algebraic result One can always construct a convex
hull dominating slow decreasing functions
Construct a B-spline over the control points of the convex hull
Weak homomorphism follows from strong convex hull property
Spline > convex hull > value function
Detailed proofs in paper
Metadata Size Vs Tightness Removing a control point does not violate
weak homomorphism Algebraic result: convex hull CP-p > CP CP > Гx ^ S(P-p) > CP-p => S(P-p) >
Гx Note: S(P-p) may not completely
dominate S(P)
Minimum curvature heuristics Remove a control point pi such that |
π-θ| is minimum, where θ is angle pi-
1pipi+1
Metadata calculus enables scalable solutions for deducing security metadataEnrich security metadata and calculus to meet new requirements
Future Work Background information and uncertainty: domain-specific models with P7 Disinformation: extend using belief calculus (e.g., Dempster-Shafer) Bootstrapping: deducing the value of human authored documents – open problem in NLP