Information Leakage Games

TL;DR

This paper introduces a game-theoretic model for information leakage involving attacker and defender strategies, demonstrating the existence of Nash equilibria and showing that optimal attack strategies are often probabilistic.

Contribution

It develops a novel zero-sum leakage game framework with convex utilities and algorithms for computing optimal strategies, highlighting the probabilistic nature of optimal attacks.

Findings

Nash equilibria exist in the proposed leakage games.

Optimal defender strategies are often mixed to reduce leaks.

First formal proof that optimal attacker strategies are probabilistic in some cases.

Abstract

We consider a game-theoretic setting to model the interplay between attacker and defender in the context of information flow, and to reason about their optimal strategies. In contrast with standard game theory, in our games the utility of a mixed strategy is a convex function of the distribution on the defender's pure actions, rather than the expected value of their utilities. Nevertheless, the important properties of game theory, notably the existence of a Nash equilibrium, still hold for our (zero-sum) leakage games, and we provide algorithms to compute the corresponding optimal strategies. As typical in (simultaneous) game theory, the optimal strategy is usually mixed, i.e., probabilistic, for both the attacker and the defender. From the point of view of information flow, this was to be expected in the case of the defender, since it is well known that randomization at the level of the system design may help to reduce information leaks. Regarding the attacker, however, this seems the first work (w.r.t. the literature in information flow) proving formally that in certain cases the optimal attack strategy is necessarily probabilistic.

Figures

Tables

Table 1. Table 2: The two-millionaires system, from the point of view of the attacker.

		$a=0$		$a=1$
$d=0\left(x\le a?\right)$
$d=1\left(x\ge a?\right)$

Table 2. Table 3: Utility table for the two-millionaires game.

Table 3. Table 6: The binary-sum system, from the point of view of the attacker.

		$a=0$		$a=1$
$d=0\left(x\oplus a\right)$
$d=1\left(x\oplus a\oplus 1\right)$

Table 4. Table 7: Utility table for the binary-sum game.

Table 5. Table 8: The binary-sum mixed strategy of the defender, from the point of view of the attacker, where p 𝑝 p is the probability the defender picks action d = 0 𝑑 0 d=0 .

$a=0$		$a=1$

Table 6. Table 9: Utility for each pure strategy profile.

Equations

$$U_{\mathsf{d}}(\delta ,\alpha )$$

$$U_{\mathsf{a}}(\delta ,\alpha )$$

$$\mathbb{V}(\delta ,\alpha )\stackrel{\mathrm{def}}{=}\underset{\begin{array}{c}a\leftarrow \alpha \end{array}}{E}\mathbb{V}\left[\pi ,C_{\delta a}\right]={\sum }_a\alpha (a)\mathbb{V}\left[\pi ,C_{\delta a}\right]\text{where}{C}_{\delta a}\stackrel{\mathrm{def}}{=}{\sum }_d\delta (d)C_{ad}$$

$$\displaystyle\begin{array}[]{|c|c|c|}\hline\cr C_{1}&y=0&y=1\\ \hline\cr x=0&1-\epsilon&\epsilon\\ x=1&\epsilon&1-\epsilon\\ \hline\cr\end{array}\qquad\begin{array}[]{|c|c|c|}\hline\cr C_{2}&y=0&y=1\\ \hline\cr x=0&1&0\\ x=1&0&1\\ \hline\cr\end{array}\qquad\begin{array}[]{|c|c|c|}\hline\cr C_{3}&y=0&y=1\\ \hline\cr x=0&0&1\\ x=1&1&0\\ \hline\cr\end{array}$$

$$\displaystyle\begin{array}[]{|c|c|c|}\hline\cr p\,C_{1}+(1-p)\,C_{3}&y=0&y=1\\ \hline\cr x=0&\nicefrac{{(1-\epsilon)}}{{2}}&\nicefrac{{(1+\epsilon)}}{{2}}\\ x=1&\nicefrac{{(1+\epsilon)}}{{2}}&\nicefrac{{(1-\epsilon)}}{{2}}\\ \hline\cr\end{array}\quad\text{and}\quad\begin{array}[]{|c|c|c|}\hline\cr p\,C_{2}+(1-p)\,C_{3}&y=0&y=1\\ \hline\cr x=0&\nicefrac{{1}}{{2}}&\nicefrac{{1}}{{2}}\\ x=1&\nicefrac{{1}}{{2}}&\nicefrac{{1}}{{2}}\\ \hline\cr\end{array}$$

$$\begin{array}[]{rcll}\mathbb{V}\!\left[\pi,\operatorname{\sum}_{i}\mu(i)\,C_{i}\right]&=&\,\sum_{y}p(y)\,\mathbb{V}\!\left[\frac{\pi(\cdot)\,\sum_{i}\mu(i)\,C_{i}(\cdot,y)}{p(y)}\right]&\text{(by def. of posterior $\mathbb{V}$)}\\[5.69054pt] &=&\,\sum_{y}p(y)\,\mathbb{V}\!\left[\sum_{i}\mu(i)\,\frac{\pi(\cdot)\,C_{i}(\cdot,y)}{p(y)}\right]&\text{}\\[5.69054pt] &\leq&\,\sum_{y}p(y)\,\sum_{i}\mu(i)\,\mathbb{V}\!\left[\frac{\pi(\cdot)\,C_{i}(\cdot,y)}{p(y)}\right]&\text{(*)}\\[5.69054pt] &=&\,\sum_{i}\mu(i)\,\sum_{y}p(y)\,\mathbb{V}\!\left[\frac{\pi(\cdot)\,C_{i}(\cdot,y)}{p(y)}\right]&\text{}\\[5.69054pt] &=&\,\sum_{i}\mu(i)\,\mathbb{V}\!\left[\pi,C_{i}\right]&\text{(by def. of posterior $\mathbb{V}$)}\end{array}$$

$$\mathbb{V}(\delta ,\alpha )={\sum }_a\alpha (a)\mathbb{V}\left[\pi ,{\sum }_d\delta (d)C_{da}\right]$$

$${\delta }^{(k+1)}=P({\delta }^{(k)}-{\alpha }_k{g}^{(k)})$$

$$\mathbb{V}(\hat{\delta },\alpha )-ϵ\le \mathbb{V}(\hat{\delta },{\alpha }^{\ast })\le \mathbb{V}(\delta ,{\alpha }^{\ast })+ϵ\forall \delta ,\alpha$$

$${\delta }^{\ast }=(34.59,3.48,3.00,10.52,3.32,2.99,35.93,3.19,2.99)$$

Full text

1 Introduction

A fundamental problem in computer security is the leakage of sensitive information due to correlation of secret information with observable information publicly available, or in some way accessible, to the attacker. Correlation in fact allows for the use of Bayesian inference to guessing the value of the secret. Typical examples are side channels attacks, in which (observable) physical aspects of the system, such as the execution time of a decryption algorithm, may be exploited by the attacker to restrict the range of the possible (secret) encryption keys. The branch of security that studies the amount of information leaked by a system is called Quantitative Information Flow (QIF), and it has seen growing interest over the past decade. See for instance [10, 15, 27, 3, 4], just to mention a few.

In general, it has been recognized that randomization can be very useful to obfuscate the link between secrets and observables. Examples include various anonymity protocols (for instance, the dining cryptographers [9] and Crowds [23]), and the renown framework of differential privacy [11]. The defender (the system designer, or the user) is, therefore, typically probabilistic. As for the attacker, most works in the literature consider only passive attacks, limited to observing the system’s behavior. Notable exceptions are the works of Boreale and Pampaloni [4], and of Mardziel et al. [18], which consider adaptive attackers who interact with and influence the system. We note that, however, [4] does not consider probabilistic strategies for the attacker. As for [18], although their model allows them, none of their extensive case-studies needs probabilistic attack strategies to maximize leakage. This may seem surprising, since, as mentioned before, randomization is known to be useful (and, in general, crucial) for the defender to undermine the attack and protect the secret. Thus there seems to be an asymmetry between attacker and defender w.r.t. probabilistic strategies in QIF. Our thesis is that there is indeed an asymmetry, but this does not mean that the attacker has nothing to gain from randomization: when the defender can change his own strategy according to the attacker’s actions, it becomes advantageous for the attacker to try to be unpredictable and, consequently, adopt a probabilistic strategy. For the defender, while randomization is useful for the same reason, it is also useful because it reduces the information leakage, and since information leakage constitutes the gain of the attacker, this reduction influences his strategy. This latter aspect introduces the asymmetry mentioned above.

In the present work, we consider scenarios in which both attacker and defender can make choices that influence the system during the attack. We aim, in particular, at analyzing the attacker’s strategies that can maximize information leakage, and the defender’s most appropriate strategies to counterattack and keep the system as secure as possible. As argued before, randomization can help both attacker and defender make their moves unpredictable. The most suitable framework for analyzing this kind of interplay is, naturally, game theory, where the use of randomization can be modeled by the notion of mixed strategies, and where the interplay between attacker and defender, and their struggle to achieve the best result for themselves, can be modeled in terms of optimal strategies and Nash equilibrium. It is important to note, however, that one of the two advantages that randomization has for the defender, namely the reduction of information leakage, has no counterpart in standard game theory. Indeed, we demonstrate that this property makes the utility of a mixed strategy be a convex function of the distribution of the defender. In contrast, in standard game theory the utility of a mixed strategy is the expectation of the utility of the pure strategies of each player, and therefore it is an affine function on each of the players’ distributions. As a consequence, we need to consider a new kind of games, which we call information leakage games, where the utility of a mixed strategy is a function affine on the attacker’s strategy, and convex on the defender’s. Nevertheless, the fundamental results of game theory, notably the minimax theorem and the existence of Nash equilibria, still hold for our zero-sum leakage games. We also propose algorithms to compute the optimal strategy, namely, the strategies for the attacker and the defender that lead to a Nash equilibrium, where no player has anything to gain by unilaterally changing his own strategy.

For reasoning about information leakage, we employ the well-established information-theoretic framework, which is by far the most used in QIF. A central notion in this model is that of vulnerability, which intuitively measures how easily the secret can be discovered (and exploited) by the attacker. For the sake of generality, we adopt the notion of vulnerability as any convex and continuous function [4, 2], which has been shown to subsume most previous measures of the QIF literature [2], including Bayes vulnerability (a.k.a. min-vulnerability [27, 8]), Shannon entropy [25], guessing entropy [19], and $g$-vulnerability [3].

We note that vulnerability is an expectation measure over the secrets. In this paper we assume the utility to be such average measure, but, in some cases, it could be advantageous for the defender to adopt different strategies depending on the value of the secret. We leave this refinement for future work.

The main contributions of this paper are the following:

• •

We define a general framework of information leakage games to reason about the interplay between attacker and defender in QIF scenarios.

• •

We prove that, in our framework, the utility is a convex function of the mixed strategy of the defender. To the best of our knowledge, this is a novelty w.r.t. traditional game theory, where the utility of a mixed strategy is defined as expectation of the utilities of the pure strategies.

• •

We provide methods for finding the solution and the equilibria of leakage games by solving a convex optimization problem.

• •

We show examples in which Nash equilibria require a mixed strategy. This is, to the best of our knowledge, the first proof in QIF that in some cases the optimal strategy of the attacker must be probabilistic.

• •

As a case study, we consider the Crowds protocol in a MANET (Mobile Ad-hoc NETwork). We study the case in which the attacker can add a corrupted node as an attack, the defender can add an honest node as a countermeasure, and we compute the defender component of the Nash equilibrium.

Plan of the paper

In Section 2 we review the basic notions of game theory and QIF. In Section 3 we introduce some motivating examples. In section 4 we discuss the difference of our leakage games from those of standard game theory. In Section 5 we prove the convexity of the utility of the defender. In Section 6 we present algorithms for computing the Nash equilibria and optimal strategies for leakage games. In Section 7 we apply our framework to a version of the Crowds protocol. In Section 8 we discuss related work. Section 9 concludes.

2 Preliminaries

In this section we review some basic notions from game theory and QIF.

We use the following notation. Given a set $\mathcal{I}$, we denote by $\mathbb{D}\mathcal{I}$ the set of all probability distributions over $\mathcal{I}$. Given $\mu\in\mathbb{D}\mathcal{I}$, its support ${\sf supp}(\mu)$ is the set of its elements with positive probabilities, i.e., ${\sf supp}(\mu)=\{i\in\mathcal{I}:\mu(i)>0\}$. We write $i\leftarrow\mu$ to indicate that a value $i\in\mathcal{I}$ is sampled from a distribution $\mu$ on $\mathcal{I}$.

2.1 Two-player, simultaneous games

We review basic definitions from two-player games, a model for reasoning about the behavior of strategic players. We refer to [22] for more details.

In a game, each player has at its disposal a set of actions that he can perform, and obtains some payoff (gain or loss) depending on the outcome of the actions chosen by both players. The payoff’s value to each player is evaluated using a utility function. Each player is assumed to be rational, i.e., his choice is driven by the attempt to maximize his own utility. We also assume that the set of possible actions and the utility functions of both players are common knowledge.

In this paper we only consider finite games, namely the cases in which the set of actions available to each player is finite. Furthermore, we only consider simultaneous games, meaning that each player chooses actions without knowing the actions chosen by the other. Formally, such a game is defined as a tuple111Following the convention of security games, we set the first player to be the defender. $(\mathcal{D},\mathcal{A},\mathit{u_{\sf d}},\mathit{u_{\sf a}})$, where $\mathcal{D}$ is a nonempty set of defender’s actions, $\mathcal{A}$ is a nonempty set of attacker’s actions, $\mathit{u_{\sf d}}:\mathcal{D}\times\mathcal{A}\rightarrow\mathbb{R}$ is the defender’s utility function, and $\mathit{u_{\sf a}}:\mathcal{D}\times\mathcal{A}\rightarrow\mathbb{R}$ is the attacker’s utility function.

Each player may choose an action deterministically or probabilistically. A pure strategy of the defender (resp. attacker) is a deterministic choice of an action, i.e., an element $d\in\mathcal{D}$ (resp. $a\in\mathcal{A}$). A pair $(d,a)$ is a pure strategy profile, and $\mathit{u_{\sf d}}(d,a)$, $\mathit{u_{\sf a}}(d,a)$ represent the defender’s and the attacker’s utilities.

A mixed strategy of the defender (resp. attacker) is a probabilistic choice of an action, defined as a probability distribution $\delta\in\mathbb{D}\mathcal{D}$ (resp. $\alpha\in\mathbb{D}\mathcal{A}$). A pair $(\delta,\alpha)$ is called a mixed strategy profile. The defender’s and the attacker’s expected utility functions for mixed strategies are defined, respectively, as:

[TABLE]

A defender’s mixed strategy $\delta\in\mathbb{D}\mathcal{D}$ is a best response to an attacker’s mixed strategy $\alpha\in\mathbb{D}\mathcal{A}$ if $\mathit{U_{\sf d}}(\delta,\alpha)=\max_{\delta^{\prime}\in\mathbb{D}\mathcal{D}}\mathit{U_{\sf d}}(\delta^{\prime},\alpha)$. Symmetrically, $\alpha\in\mathbb{D}\mathcal{A}$ is a best response to $\delta\in\mathbb{D}\mathcal{D}$ if $\mathit{U_{\sf a}}(\delta,\alpha)=\max_{\alpha^{\prime}\in\mathbb{D}\mathcal{A}}\mathit{U_{\sf d}}(\delta,\alpha^{\prime})$. A mixed-strategy Nash equilibrium is a profile $(\delta^{*},\alpha^{*})$ such that $\delta^{*}$ is a best response to $\alpha^{*}$ and vice versa. Namely, no unilateral deviation by any single player provides better utility to that player. If $\delta^{*}$ and $\alpha^{*}$ are point distributions concentrated on some $d^{*}\in\mathcal{D}$ and $a^{*}\in\mathcal{A}$, respectively, then $(\delta^{*},\alpha^{*})$ is a pure-strategy Nash equilibrium, and will be denoted by $(d^{*},a^{*})$. While not all games have a pure strategy Nash equilibrium, every finite game has a mixed strategy Nash equilibrium.

2.2 Zero-sum games and Minimax Theorem

A game $(\mathcal{D},\,\mathcal{A},\,\mathit{u_{\sf d}},\mathit{u_{\sf a}})$ is zero-sum if for any $d\in\mathcal{D}$ and any $a\in\mathcal{A}$, $\mathit{u_{\sf d}}(d,a)=-\mathit{u_{\sf a}}(d,a)$, i.e., the defender’s loss is equivalent to the attacker’s gain. For brevity, in zero-sum games we denote by $u$ the attacker’s utility function $\mathit{u_{\sf a}}$, and by $U$ the attacker’s expected utility $\mathit{U_{\sf a}}$.222Conventionally in game theory the utility $u$ is set to be that of the first player, but we prefer to look at the utility from the point of view of the attacker to be in line with the definition of utility as vulnerability, as we will introduce in Section 2.3. Consequently, the goal of the defender is to minimize $U$, and the goal of the attacker is to maximize it.

In simultaneous zero-sum games the Nash equilibrium corresponds to the solution of the minimax problem (or equivalently, the maximin problem), namely, the profile $(\delta^{*},\alpha^{*})$ such that $U(\delta^{*},\alpha^{*})=\min_{\delta}\max_{\alpha}U(\delta,\alpha)$. The von Neumann’s minimax theorem ensures that such solution (which always exists) is stable:

Theorem 2.1 (von Neumann’s minimax theorem)

Let $\mathcal{X}\subset\mathbb{R}^{m}$ and $\mathcal{Y}\subset\mathbb{R}^{n}$ be compact convex sets, and $\mathit{U}:\mathcal{X}\times\mathcal{Y}\rightarrow\mathbb{R}$ be a continuous function such that $\mathit{U}(x,y)$ is convex in $x\in\mathcal{X}$ and concave in $y\in\mathcal{Y}$. Then it is the case that $\min_{x\in\mathcal{X}}\max_{y\in\mathcal{Y}}\mathit{U}(x,y)=\max_{y\in\mathcal{Y}}\min_{x\in\mathcal{X}}\mathit{U}(x,y)$.

A related property is that, under the conditions of Theorem 2.1, there exists a saddle point $(x^{*},y^{*})$ s.t., for all $x\in\mathcal{X}$ and $y\in\mathcal{Y}$, $\mathit{U}(x^{*},y){\leq}\mathit{U}(x^{*},y^{*}){\leq}\mathit{U}(x,y^{*})$.

2.3 Quantitative information flow

Finally, we briefly review the standard framework of quantitative information flow, which is used to measure the amount of information leakage in a system.

Secrets and vulnerability

A secret is some piece of sensitive information the defender wants to protect, such as a user’s password, social security number, or current location. The attacker usually only has some partial knowledge about the value of a secret, represented as a probability distribution on secrets called a prior. We denote by $\mathcal{X}$ the set of possible secrets, and we typically use $\pi$ to denote a prior belonging to the set $\mathbb{D}{\mathcal{X}}$ of probability distributions over $\mathcal{X}$.

The vulnerability of a secret is a measure of the utility of the attacker’s knowledge about the secret. In this paper we consider a very general notion of vulnerability, following [2], and define a vulnerability $\mathbb{V}$ to be any continuous and convex function of type $\mathbb{D}{\mathcal{X}}\rightarrow\mathbb{R}$. It has been shown in [2] that these functions coincide with the set of $g$-vulnerabilities, and are, in a precise sense, the most general information measures w.r.t. a set of basic axioms. 333

More precisely, if posterior vulnerability is defined as the expectation of the vulnerability of posterior distributions, the measure respects the data-processing inequality and yields non-negative leakage iff vulnerability is convex.

Channels, posterior vulnerability, and leakage

Systems can be modeled as information theoretic channels. A channel $C:\mathcal{X}\times\mathcal{Y}\rightarrow\mathbb{R}$ is a function in which $\mathcal{X}$ is a set of input values, $\mathcal{Y}$ is a set of output values, and $C(x,y)$ represents the conditional probability of the channel producing output $y\in\mathcal{Y}$ when input $x\in\mathcal{X}$ is provided. Every channel $C$ satisfies $0\leq C(x,y)\leq 1$ for all $x\in\mathcal{X}$ and $y\in\mathcal{Y}$, and $\sum_{y\in\mathcal{Y}}C(x,y)=1$ for all $x\in\mathcal{X}$.

A distribution $\pi\in\mathbb{D}{\mathcal{X}}$ and a channel $C$ with inputs $\mathcal{X}$ and outputs $\mathcal{Y}$ induce a joint distribution $p(x,y)=\pi(x)C({x,y})$ on $\mathcal{X}\times\mathcal{Y}$, with marginal probabilities $p(x)=\sum_{y}p(x,y)$ and $p(y)=\sum_{x}p(x,y)$, and conditional probabilities $p(x{\mid}y)=\nicefrac{{p(x,y)}}{{p(y)}}$ if $p(y)\neq 0$. For a given $y$ (s.t. $p(y)\neq 0$), the conditional probabilities $p(x{\mid}y)$ for each $x\in\mathcal{X}$ form the posterior distribution $p_{X\mid y}$.

A channel $C$ in which $\mathcal{X}$ is a set of secret values and $\mathcal{Y}$ is a set of observable values produced by a system can be used to model computations on secrets. Assuming the attacker has prior knowledge $\pi$ about the secret value, knows how a channel $C$ works, and can observe the channel’s outputs, the effect of the channel is to update the attacker’s knowledge from a prior $\pi$ to a collection of posteriors $p_{X\mid y}$, each occurring with probability $p(y)$.

Given a vulnerability $\mathbb{V}$, a prior $\pi$, and a channel $C$, the posterior vulnerability $\mathbb{V}\!\left[\pi,C\right]$ is the vulnerability of the secret after the attacker has observed the output of $C$. Formally: $\mathbb{V}\!\left[\pi,C\right]\stackrel{{\scriptstyle\mathrm{def}}}{{=}}\sum_{y\in\mathcal{Y}}p(y)\mathbb{V}\!\left[p_{X\mid y}\right]$.

The information leakage of a channel $C$ under a prior $\pi$ is a comparison between the vulnerability of the secret before the system was run—called the prior vulnerability—and the posterior vulnerability of the secret. The leakage reflects by how much the observation of the system’s outputs increases the utility of the attacker’s knowledge about the secret. It can be defined either additively ($\mathbb{V}\!\left[\pi,C\right]-\mathbb{V}\!\left[\pi\right]$), or multiplicatively ($\nicefrac{{\mathbb{V}\!\left[\pi,C\right]}}{{\mathbb{V}\!\left[\pi\right]}}$).

3 A motivating example

We present some simple examples to motivate our information leakage games.

3.1 The two-millionaires problem

The “two-millionaires problem” was introduced by Yao in [33]. In the original formulation, there are two “millionaires”, Alice and Don, who want to discover who is the richest among them, but neither wants to reveal to the other the amount of money that he or she has.

We consider a (conceptually) asymmetric variant of this problem, where Alice is the attacker and Don is the defender. Don wants to learn whether or not he is richer than Alice, but does not want Alice to learn anything about the amount $x$ of money he has. To this purpose, Don sends $x$ to a trusted server Jeeves, who in turn asks Alice, privately, what is her amount $a$ of money. Jeeves then checks which among $x$ and $a$ is greater, and sends the result $y$ back to Don.444The reason to involve Jeeves is that Alice may not want to reveal $a$ to Don, either. However, Don is worried that Alice may intercept Jeeves’ message containing the result of the comparison, and exploit it to learn more accurate information about $x$ by tuning her answer $a$ appropriately (since, given $y$, Alice can deduce whether $a$ is an upper or lower bound on $x$). We assume that Alice may get to know Jeeves’ reply, but not the messages from Don to Jeeves.

We will use the following information-flow terminology: the information that should remain secret (to the attacker) is called high, and what is visible to (and possibly controllable by) the attacker is called low. Hence, in the program run by Jeeves $a$ is a low input and $x$ is a high input. The result $y$ of the comparison (since it may be intercepted by the attacker) is a low output. The problem is to avoid the flow of information from $x$ to $y$ (given $a$).

One way to mitigate this problem is to use randomization. Assume that Jeeves provides two different programs to ensure the service. Then, when Don sends his request to Jeeves, he can make a random choice $d$ among the two programs 0 and 1, sending $d$ to Jeeves along with the value $x$. Now if Alice intercepts the result $y$, it will be less useful to her since she does not know which of the two programs has been run. As Don of course knows which program was run, the result $y$ will still be just as useful to him. 555Note that $d$ should not be revealed to the attacker: although $d$ is not sensitive information in itself, knowing it would help the attacker figure out the value of $x$.

In order to determine the best probabilistic strategy that Don should apply to select the program, we analyze the problem from a game-theoretic perspective. For simplicity, we assume that $x$ and $a$ both range in $\{0,1\}$. The two alternative programs that Jeeves can run are shown in Table 1.

The combined choices of Alice and Don determine how the system behaves. Let $\mathcal{D}=\{0,1\}$ represent Don’s possible choices, i.e., the program to run, and $\mathcal{A}=\{0,1\}$ represent Alice’s possible choices, i.e., the value of the low input $a$. We shall refer to the elements of $\mathcal{D}$ and $\mathcal{A}$ as actions. For each possible combination of actions $d$ and $a$, we can construct a channel $C_{da}$ with inputs $\mathcal{X}=\{0,1\}$ (the set of possible high input values) and outputs $\mathcal{Y}=\{T,F\}$ (the set of possible low output values), modeling the behavior of the system from the point of view of the attacker. Intuitively, each channel entry $C_{da}(x,y)$ is the probability that the program run by Jeeves (which is determined by $d$) produces output $y\in\mathcal{Y}$ given that the high input is $x\in\mathcal{X}$ and that the low input is $a$. The resulting four channel matrices are represented in Table 2. Note that channels $C_{01}$ and $C_{10}$ do not leak any information about the input $x$ (output $y$ is constant), whereas channels $C_{00}$ and $C_{11}$ completely reveal $x$ (output $y$ is in a bijection with $x$).

We want to investigate how the defender’s and the attacker’s strategies influence the leakage of the system. For that we can consider the (simpler) notion of posterior vulnerability, since, for a given prior, the value of leakage is in a one-to-one (monotonic) correspondence with the value of posterior vulnerability. For this example, we consider posterior Bayes vulnerability [8, 27], defined as $\mathbb{V}\!\left[\pi,C\right]=\sum_{y}\max_{x}C(x,y)\pi(x)$. Intuitively, Bayes vulnerability measures the probability of the adversary guessing the secret correctly in one try, and it can be shown that $\mathbb{V}\!\left[\pi,C\right]$ coincides with the converse of the Bayes error.

For simplicity, we assume a uniform prior distribution $\pi_{u}$. It has been shown that, in this case, the posterior Bayes vulnerability of a channel $C$ can be computed as the sum of the greatest elements of each column of $C$, divided by the high input-domain size [7]. Namely, $\mathbb{V}\!\left[\pi_{u},C\right]=\nicefrac{{\sum_{y}\max_{x}C(x,y)}}{{|\mathcal{X}|}}$. It is easy to see that we have $\mathbb{V}\!\left[\pi_{u},C_{00}\right]=\mathbb{V}\!\left[\pi_{u},C_{11}\right]=1$ and $\mathbb{V}\!\left[\pi_{u},C_{01}\right]=\mathbb{V}\!\left[\pi_{u},C_{10}\right]=\nicefrac{{1}}{{2}}$. Thus we obtain the utility table shown in Table 3, which is similar to that of the well-known “matching-pennies” game.

As in standard game theory, there may not exist an optimal pure strategy profile. The defender as well as the attacker can then try to minimize/maximize the system’s vulnerability by adopting a mixed strategy $\delta$ and $\alpha$, respectively. A crucial task is evaluating the vulnerability of the system under such mixed strategies. This evaluation is naturally performed from the point of view of the attacker, who knows his own choice $a$, but not the defender’s choice $d$. As a consequence, the attacker sees the system as the convex combination $C_{\delta a}=\sum_{d}\delta(d)\,C_{ad}$, i.e., a probabilistic choice between the channels representing the defender’s actions. Hence, the overall vulnerability of the system will be given by the vulnerability of $C_{\delta a}$, averaged over all attacker’s actions.

We now define formally the ideas illustrated above.

Definition 1

An information-leakage game is a tuple $(\mathcal{D},\mathcal{A},C)$ where $\mathcal{D},\mathcal{A}$ are the sets of actions of the attacker and the defender, respectively, and $C=\{C_{da}\}_{da}$ is a family of channel matrices indexed on pairs of actions $d\in\mathcal{D},a\in\mathcal{A}$. For a given vulnerability $\mathbb{V}$ and prior $\pi$, the utility of a pure strategy $(d,a)$ is given by $\mathbb{V}\!\left[\pi,C_{da}\right]$. The utility $\mathbb{V}(\delta,\alpha)$ of a mixed strategy $(\delta,\alpha)$ is defined as:

[TABLE]

In our example, $\delta$ is represented by a single number $p$: the probability that the defender chooses $d=0$ (i.e., Program [math]). From the point of view of the attacker, once he has chosen $a$, the system will look like a channel $C_{pa}=p\,C_{0a}+(1-p)\,C_{1a}$. For instance, in the case $a=0$, if $x$ is [math] Jeeves will send $T$ with probability $1$, but, if $x$ is $1$, Jeeves will send $F$ with probability $p$ and $T$ with probability $1-p$. Similarly for $a=1$. Table 4 summarizes the various channels modelling the attacker’s point of view. It is easy to see that $\mathbb{V}\!\left[\pi_{u},C_{p0}\right]=\nicefrac{{(1+p)}}{{2}}$ and $\mathbb{V}\!\left[\pi_{u},C_{p1}\right]=\nicefrac{{(2-p)}}{{2}}$. In this case $\mathbb{V}\!\left[\pi_{u},C_{pa}\right]$ coincides with the expected utility with respect to $p$, i.e., $\mathbb{V}\!\left[\pi_{u},C_{pa}\right]=p\,\mathbb{V}\!\left[\pi_{u},C_{0a}\right]+(1-p)\,\mathbb{V}\!\left[\pi_{u},C_{1a}\right]$.

Assume now that the attacker choses $a=0$ with probability $q$ and $a=1$ with probability $1-q$. The utility is obtained as expectation with respect to the strategy of the attacker, hence the total utility is: $\mathbb{V}(p,q)=\nicefrac{{q\,(1+p)}}{{2}}+\nicefrac{{(1-p)\,(2-p)}}{{2}}$, which is affine in both $p$ and $q$. By applying standard game-theoretic techniques, we derive that the optimal strategy is $(p^{*},q^{*})=(\nicefrac{{1}}{{2}},\nicefrac{{1}}{{2}})$.

In the above example, things work just like in standard game theory. However, in the next section we will show an example that fully exposes the difference of our games with respect to those of standard game theory.

3.2 Binary sum

The previous example is an instance of a general scenario in which a user, Don, delegates to a server, Jeeves, a certain computation that requires also some input from other users. Here we will consider another instance, in which the function to be computed is the binary sum $\oplus$. We assume Jeeves provides the programs in Table 5. The resulting channel matrices are represented in Table 6.

We consider again Bayes posterior vulnerability as utility. It is easy to see that we have $\mathbb{V}\!\left[\pi_{u},C_{00}\right]=\mathbb{V}\!\left[\pi_{u},C_{11}\right]=\mathbb{V}\!\left[\pi_{u},C_{01}\right]=\mathbb{V}\!\left[\pi_{u},C_{10}\right]=1$. Thus for the pure strategies we obtain the utility table shown in Table 7. This means that all pure strategies have the same utility $1$ and therefore they are all equivalent. In standard game theory this would mean that also the mixed strategies have the same utility $1$, since they are defined as expectation. In our case, however, the utility of a mixed strategy of the defender is convex on the

distribution, so it may be convenient for the defender to adopt a mixed strategy. Let $p,1-p$ be the probabilities of the defender choosing Program [math] and Program $1$, respectively. From the point of view of the attacher, for each of his choices of $a$, the system will appear as the probabilistic channel $C_{pa}$ represented in Table 8.

It is easy to see that $\mathbb{V}\!\left[\pi_{u},C_{p0}\right]=\mathbb{V}\!\left[\pi_{u},C_{p1}\right]=1-p$ if $p\leq\nicefrac{{1}}{{2}}$, and $\mathbb{V}\!\left[\pi_{u},C_{p0}\right]=\mathbb{V}\!\left[\pi_{u},C_{p1}\right]=p$ if $p\geq\nicefrac{{1}}{{2}}$. On the other hand, with respect to a mixed strategy of the attacker the utility is still defined as expectation. Since in this case the utility is the same for $a=0$ and $a=1$, it remains the same for any strategy of the attacker. Formally, $\mathbb{V}(p,q)=q\,\mathbb{V}\!\left[\pi_{u},C_{p0}\right]+(1-q)\,\mathbb{V}\!\left[\pi_{u},C_{p1}\right]=\mathbb{V}\!\left[\pi_{u},C_{p0}\right]$, which does not depend on $q$ and it is minimum for $p=\nicefrac{{1}}{{2}}$. We conclude that the point of equilibrium is $(p^{*},q^{*})=(\nicefrac{{1}}{{2}},q^{*})$ for any value of $q^{*}$.

4 Leakage games vs. standard game theory models

In this section we explain the differences between our information leakage games and standard approaches to game theory. We discuss: (1) why the use of vulnerability as a utility function makes our games non-standard w.r.t. von Neumann-Morgenstern’s treatment of utility, (2) why the use of concave utility functions to model risk-averse players does not capture the behavior of the attacker in our games, and (3) how our games differ from traditional convex-concave games.

4.1 The von Neumann-Morgenstern’s treatment of utility

In their treatment of utility, von Neumann and Morgenstern [29] demonstrated that the utility of a mixed strategy equals the expected utility of the corresponding pure strategies when a set of axioms is satisfied for player’s preferences over probability distributions (a.k.a. lotteries) on payoffs. Since in our leakage games the utility of a mixed strategy is not the expected utility of the corresponding pure strategies, it is relevant to identify how exactly our framework fails to meet von Neumann and Morgenstern (vNM) axioms.

Let us first introduce some notation. Given two mixed strategies $\sigma$, $\sigma^{\prime}$ for a player, we write $\sigma\preceq\sigma^{\prime}$ (or $\sigma^{\prime}\succeq\sigma$) when the player prefers $\sigma^{\prime}$ over $\sigma$, and $\sigma\sim\sigma^{\prime}$ when the player is indifferent between $\sigma$ and $\sigma^{\prime}$. Then, the vNM axioms can be formulated as follows [24]. For every mixed strategies $\sigma$, $\sigma^{\prime}$ and $\sigma^{\prime\prime}$:

A1

Completeness: it is either the case that $\sigma\preceq\sigma^{\prime}$, $\sigma\succeq\sigma^{\prime}$, or $\sigma\sim\sigma^{\prime}$.

A2

Transitivity: if $\sigma\preceq\sigma^{\prime}$ and $\sigma^{\prime}\preceq\sigma^{\prime\prime}$, then $\sigma\preceq\sigma^{\prime\prime}$.

A3

Continuity: if $\sigma\preceq\sigma^{\prime}\preceq\sigma^{\prime\prime}$, then there exist $p\in[0,1]$ s.t. $p\,\sigma{+}(1-p)\,\sigma^{\prime\prime}\sim\sigma^{\prime}$.

A4

Independence: if $\sigma\preceq\sigma^{\prime}$ then for any $\sigma^{\prime\prime}$ and $p\in[0,1]$ we have $p\,\sigma+(1-p)\,\sigma^{\prime\prime}\preceq p\,\sigma^{\prime}+(1-p)\,\sigma^{\prime\prime}$.

For any fixed prior $\pi$ on secrets, the utility function $u(C)=\mathbb{V}[\pi,C]$ is a total function on $\mathcal{C}$ ranging over the reals, and therefore it satisfies axioms A1, A2 and A3 above. However, $u(C)$ does not satisfy A4, as the next example illustrates.

Example 1

Consider the following three channel matrices from input set $\mathcal{X}=\{0,1\}$ to output set $\mathcal{Y}=\{0,1\}$, where $\epsilon$ is a small positive constant:

[TABLE]

If we focus on Bayes vulnerability, it is clear that an attacker would prefer $C_{2}$ over $C_{1}$, i.e., $C_{1}\preceq C_{2}$. However, for the probability $p=\nicefrac{{1}}{{2}}$ we would have:

[TABLE]

Since channel $p\,C_{1}+(1-p)\,C_{3}$ clearly reveals no less information about the secret than channel $p\,C_{2}+(1-p)\,C_{3}$, we have that $p\,C_{1}+(1-p)\,C_{3}\succeq p\,C_{2}+(1-p)\,C_{3}$, and the axiom of independence is not satisfied.

It is actually quite natural that vulnerability does not satisfy independence: a convex combination of two “leaky” channels (i.e., high-utility outcomes) can produce a “non-leaky” channel (i.e., a low-utility outcome). As a consequence, the traditional game-theoretic approach to the utility of mixed strategies does not apply to our information leakage games. However the existence of Nash equilibria is still granted, as we will see in Section 5, Corollary 1.

4.2 Risk functions

At a first glance, it may seem that our information leakage games could be expressed with some clever use of the concept of risk-averse players (in our case, the attacker), which is also based on convex utility functions (cf. [22]). There is, however, a crucial difference: in the models of risk-averse players, the utility function is convex on the payoff of an outcome of the game, but the utility of a mixed strategy is still the expectation of the utilities of the pure strategies, i.e., it is linear on the distributions. On the other hand, the utility of mixed strategies in our information leakage games is convex on the distribution of the defender. This difference arises precisely because in our games utility is defined as the vulnerability of the channel perceived by the attacker, and, as we discussed, this creates an extra layer of uncertainty for the attacker.

4.3 Convex-concave games

Another well-known model from standard game-theory is that of convex-concave games, in which each of two players can choose among a continuous set of actions yielding convex utility for one player, and concave for the other. In this kind of game the Nash equilibria are given by pure strategies for each player.

A natural question would be why not represent our systems as convex-concave games in which the pure actions of players are the mixed strategies of our leakage games. Namely, the real values $p$ and $q$ that uniquely determine the defender’s and the attacker’s mixed strategies, respectively, in the two-millionaires game of Section 3, could be taken to be the choices of pure strategies in a convex-concave game in which the set of actions for each player is the real interval $[0,1]$.

This mapping from our games to convex-concave games, however, would not be natural. One reason is that utility is still defined as expectation in the standard convex-concave games, in contrast to our games. Consider two strategies $p_{1}$ and $p_{2}$ with utilities $u_{1}$ and $u_{2}$, respectively. If we mix them using the coefficient $q\in[0,1]$, the resulting strategy $q\,p_{1}+(1-q)\,p_{2}$ will have utility $u=q\,u_{1}+(1-q)\,u_{2}$ in the standard convex-concave game, while in our case the utility would in general be strictly smaller than $u$. The second reason is that a pure action corresponding to a mixed strategy may not always be realizable. To illustrate this point, consider again the two-millionaires game, and the defender’s mixed strategy consisting in choosing Program [math] with probability $p$ and Program $1$ with probability $1-p$. The requirement that the defender has a pure action corresponding to $p$ implies the existence of a program (on Jeeves’ side) that makes internally a probabilistic choice with bias $p$ and, depending on the outcome, executes Program [math] or Program $1$. However, it is not granted that Jeeves disposes of such a program. Furthermore, Don would not know what choice has actually been made, and thus the program would not achieve the same functionality, i.e., let Don know who is the richest. (Note that Jeeves should not communicate to Don the result of the choice, because of the risk that Alice intercepts it.) This latter consideration underlines a key practical aspect of leakage games, namely, the defender’s advantage over the attacker due to his knowledge of the result of his own random choice (in a mixed strategy). This advantage would be lost in a convex-concave representation of the game since the random choice would be “frozen” in its representation as a pure action.

5 Convexity of vulnerability w.r.t. channel composition

In this section we show that posterior vulnerability is a convex function of the strategy of the defender. In other words, given a set of channels, and a probability distribution over them, the vulnerability of the composition of these channels according to the distribution is smaller than or equal to the composition of their vulnerabilities. As a consequence, we derive the existence of the Nash equilibria.

In order to state this result formally, we introduce the following notation: given a channel matrix $C$ and a scalar $a$, $a\,C$ is the matrix obtained by multiplying every element of $C$ by $a$. Given two compatible channel matrices $C_{1}$ and $C_{2}$, namely matrices with the same indices of rows and columns666Note that two channel matrices with different column indices can always be made compatible by adding appropriate columns with [math]-valued cells in each of them., $C_{1}+C_{2}$ is obtained by adding the cells of $C_{1}$ and $C_{2}$ with same indices. Note that if $\mu$ is a probability distribution on $\mathcal{I}$, then $\operatorname{\sum}_{i\in\mathcal{I}}\mu(i)\,C_{i}$ is a channel matrix.

Theorem 5.1 (Convexity of vulnerability w.r.t. channel composition)

Let $\{C_{i}\}_{i\in\mathcal{I}}$ be a family of compatible channels, and $\mu$ be a distribution on $\mathcal{I}$. Then, for every prior distribution $\pi$, and every vulnerability $\mathbb{V}$, the corresponding posterior vulnerability is convex w.r.t. to channel composition. Namely, for any probability distribution $\mu$ on $\mathcal{I}$, we have $\mathbb{V}\!\left[\pi,\operatorname{\sum}_{i}\mu(i)\,C_{i}\right]\leq\sum_{i}\mu(i)\,\mathbb{V}\!\left[\pi,C_{i}\right]$.

Proof

Define $p(y)=\sum_{x}\pi(x)\sum_{i}\mu(i)\,C_{i}(x,y)$. Then:

[TABLE]

where (*) follows from the convexity of $\mathbb{V}$ w.r.t. the prior (cf. Section 2.3). ∎

The existence of Nash equilibria immediately follows from the above theorem:

Corollary 1

For any (zero-sum) information-leakage game there exist a Nash equilibrium, which in general is given by a mixed strategy.

Proof

Given a mixed strategy $(\delta,\alpha)$, the utility $\mathbb{V}(\delta,\alpha)$ given in Definition 1 is affine (hence concave) on $\alpha$. Furthermore, by Theorem 5.1, $\mathbb{V}(\delta,\alpha)$ is convex on $\delta$. Hence we can apply the von Neumann’s minimax theorem (Section 2.2), which ensures the existence of a saddle point, i.e., a Nash equilibrium. ∎

6 Computing equilibria of information leakage games

Our goal is to solve information leakage games, in which the success of an attack $a$ and a defence $d$ is measured by a vulnerability measure $\mathbb{V}$. The attack/defence combination is a pure strategy profile $(d,a)$ in this game, and is associated with a channel $C_{da}$ modeling the behavior of the system. The attacker clearly knows his own choice $a$, whereas the defender’s choice is assumed to be hidden. Hence the utilty of a mixed strategy profile $(\delta,\alpha)$ will be given by Definition 1, that is:

[TABLE]

Note that $\mathbb{V}(\delta,\alpha)$ is convex on $\delta$ and affine on $\alpha$, hence Theorem 2.1 guarantees the existence of an equilibrium (i.e. a saddle-point) $(\delta^{*},\alpha^{*})$ which is a solution of both the minimax and the maximin problems. The goal in this section is to compute a) a $\delta^{*}$ that is part of an equilibrium, which is important in order to optimize the defence, and b) the utility $\mathbb{V}(\delta^{*},\alpha^{*})$, which is important to provide an upper bound on the effectiveness of an attack when $\delta^{*}$ is applied.

This is a convex-concave optimization problem for which various methods have been proposed in the literature. If $\mathbb{V}$ is twice differentiable (and satisfies a few extra conditions) then the Newton method can be applied [6]; however, many such measures, most notably Bayes-vulnerability, our main vulnerability measure of interest, are not differentiable. For non-differentiable functions, [21] proposes a subgradient method that iterates on both $\delta,\alpha$ at each step. We have applied this method and it does indeed converge to $\mathbb{V}(\delta^{*},\alpha^{*})$, with one important caveat: the solution $\delta$ that it produces is not necessarily an equilibrium (note that $\mathbb{V}(\delta,\alpha)=\mathbb{V}(\delta^{*},\alpha^{*})$ does not guarantee that $(\delta,\alpha)$ is a saddle point). Producing an optimal $\delta^{*}$ is of vital importance in our case.

The method we propose is based on the idea of solving the minimax problem $\hat{\delta}=\operatornamewithlimits{argmin}_{\delta}\max_{\alpha}\mathbb{V}(\delta,\alpha)$, since its solution is guaranteed to be part of an equilibrium.777Note that this is true only for $\delta$, the $\alpha$-solution of the minimax problem is not necessarily part of an equilibrium; we need to solve the maximin problem for this. To solve this problem, we exploit the fact that $\mathbb{V}(\delta,\alpha)$ is affine on $\alpha$ (not just concave). For a fixed $\delta$, maximizing $\textstyle{\sum_{a}\>}\alpha(a)\,\mathbb{V}\!\left[\pi,\textstyle{\sum_{d}\>}\delta(d)\,C_{da}\right]$ simply involves picking the $a$ with the highest $\mathbb{V}\!\left[\pi,\textstyle{\sum_{d}\>}\delta(d)\,C_{da}\right]$ and assigning probability $1$ to it. Hence, our minimax problem is equivalent to $\hat{\delta}=\operatornamewithlimits{argmin}_{\delta}f(\delta)$ where $f(\delta)=\max_{a}\mathbb{V}\!\left[\pi,\textstyle{\sum_{d}\>}\delta(d)\,C_{da}\right]$; that is, we have to minimize the max of finitely many convex functions, with $\delta$ being the only variables.

For this problem we can employ the projected subgradient method, given by:

[TABLE]

where $g^{(k)}$ is any subgradient of $f$ on $\delta^{(k)}$ [5]. Note that the subgradient of a finite max is simply a subgradient of any branch that gives the max at that point. $P(x)$ is the projection of $x$ on the domain of $f$; in our case the domain is the probability simplex, for which there exist efficient algorithms for computing the projection [30]. Finally $\alpha_{k}$ is a step-size, for which various choices guarantee convergence [5]. In our experiments we found $\alpha_{k}=0.1/\sqrt{k}$ to perform well.

As the starting point $\delta^{(1)}$ we take the uniform distribution; moreover the solution can be approximated to within an arbitrary $\epsilon>0$ by using the stopping criterion of [5, Section 3.4]. Note that the obtained $\hat{\delta}$ approximates the equilibrium strategy $\delta^{*}$, while $f(\hat{\delta})$ approximates $\mathbb{V}(\delta^{*},\alpha^{*})$. Hence we achieve both desired goals, as formally stated in the following result.

Proposition 1

If $\mathbb{V}$ is Lipschitz then the subgradient method discussed in this section converges to a $\delta^{*}$ that is part of an equilibrium of the game. Moreover, let $\hat{\delta}$ be the solution computed within a given $\epsilon>0$, and let $(\delta^{*},\alpha^{*})$ be an equilibrium. Then it holds that:

[TABLE]

which also implies that $f(\hat{\delta})-\mathbb{V}(\delta^{*},\alpha^{*})\leq\epsilon$.

Proof

(Sketch) $\operatornamewithlimits{argmin}_{\delta}f(\delta)$ is equivalent to the minimax problem whose $\delta$-solution is guaranteed to be part of an equilibrium. Convergence is ensured by the subgradient method under the Lipschitz condition, and given that $||\delta^{(1)}-\delta^{*}||$ is bounded by the distance between the uniform and a point distribution. ∎

Finally, of particular interest is the Bayes-vulnerability measure [8, 27], given by $\mathbb{V}\!\left[\pi,C\right]=\textstyle{\sum_{y}\>}\max_{x}\pi(x)\,C(x,y)$, since it is widely used to provide an upper bound to all other measures of information leakage [3]. For this measure, $\mathbb{V}$ is Lipschitz and the subgradient vector $g^{(k)}$ is given by $g^{(k)}_{d}=\sum_{y}\pi(x^{*}_{y})\,C_{da^{*}}(x^{*}_{y},y)$ where $a^{*},x^{*}_{y}$ are the ones giving the max in the branches of $f(\delta^{(k)})$. Note also that, since $f$ is piecewise linear, the convex optimization problem can be transformed into a linear one using a standard technique, and then solved by linear programming. However, due to the large number of max branches of $\mathbb{V}$, this conversion can be a problem with a huge number of constraints. In our experiments we found that the subgradient method described above is significantly more efficient than linear programming.

Note also that, although the subgradient method is general, it might be impractical in applications where the number of attacker or defender actions is very large. Application-specific methods could offer better scalability in such cases, we leave the development of such methods as future work.

7 Case study

In this section, we apply our game-theoretic analysis to the case of anonymous communication on a mobile ad-hoc network (MANET). In such a network, nodes can move in space and communicate with other nearby nodes. We assume that nodes can also access some global (wide area) network, but such connections are neither anonymous nor trusted. Consider, for instance, smartphone users who can access the cellular network, but do not trust the network provider. The goal is to send a message on the global network without revealing the sender’s identity to the provider. For that, users can form a MANET using some short-range communication method (e.g., bluetooth), and take advantage of the local network to achieve anonymity on the global one.

Crowds [23] is a protocol for anonymous communication that can be employed on a MANET for this purpose. Note that, although more advanced systems for anonymous communication exist (e.g. Onion Routing), the simplicity of Crowds makes it particularly appeling for MANETs. The protocol works as follows: the initiator (i.e., the node who wants to send the message) selects some other node connected to him (with uniform probability) and forwards the request to him. A forwarder, upon receiving the message, performs a probabilistic choice: with probability $p_{f}$ he keeps forwarding the message (again, by selecting uniformly a user among the ones connected to him), while with probability $1-p_{f}$ he delivers the message on the global network. Replies, if any, can be routed back to the initiator following the same path in reverse order.

Anonymity comes from the fact that the detected node (the last in the path) is most likely not the initiator. Even if the attacker knows the network topology, he can infer that the initiator is most likely a node close to the detected one, but if there are enough nodes we can achieve some reasonable anonymity guarantees. However, the attacker can gain an important advantage by deploying a node himself and participating to the MANET. When a node forwards a message to this corrupted node, this action is observed by the attacker and increases the probability of that node being the initiator. Nevertheless, the node can still claim that he was only forwarding the request for someone else, hence we still provide some level of anonymity. By modeling the system as

a channel, and computing its posterior Bayes vulnerability [27], we get the probability that the attacker guesses correctly the identity of the initiator, after performing his observation.

In this section we study a scenario of 30 nodes deployed in an area of $1$km$\times 1$km, in the locations illustrated in Fig. 1. Each node can communicate with others up to a distance of 250 meters, forming the network topology shown in the graph. To compromise the anonymity of the system, the attacker plans to deploy a corrupted node in the network; the question is which is the optimal location for such a node. The answer is far from trivial: on the one side being connected to many nodes is beneficial, but at the same time these nodes need to be “vulnerable”, being close to a highly connected clique might not be optimal. At the same time, the administrator of the network is suspecting that the attacker is about to deploy a corrupted node. Since this action cannot be avoided (the network is ad-hoc), a countermeasure is to deploy a deliverer node at a location that is most vulnerable. Such a node directly delivers all messages forwarded to it on the global network; since it never generates messages its own anonymity is not an issue, it only improves the anonymity of the other nodes. Moreover, since it never communicates in the local network its operation is invisible to the attacker. But again, the optimal location for the new deliverer node is not obvious, and most importantly, the choice depends on the choice of the attacker.

To answer these questions, we model the system as a game where the actions of attacker and defender are the locations of newly deployed corrupted and honest nodes, respectively. We assume that the possible locations for new nodes are the nine ones shown in Fig. 1. For each pure strategy profile $(d,a)$, we construct the corresponding network and use the PRISM model checker to construct the corresponding channel $C_{da}$, using a model similar to the one of [26]. Note that the computation considers the specific network topology of Fig. 1, which reflects the positions of each node at the time when the attack takes place; the corresponding channels need to be recomputed if the network changes in the future. As leakage measure we use the posterior Bayes vulnerability (with uniform prior $\pi$), which is the attacker’s probability of correctly guessing the initiator given his observation in the protocol. According to Definition 1, for a mixed

strategy profile $(\delta,\alpha)$ the utility is $\mathbb{V}(\delta,\alpha)=\operatornamewithlimits{\displaystyle\mathbb{E}}_{\begin{subarray}{c}a\leftarrow\alpha\\ \end{subarray}}\mathbb{V}\!\left[\pi,C_{\delta a}\right]$.

The utilities (posterior Bayes vulnerability %) for each pure profile are displayed in Table 9. Note that the attacker and defender actions substantialy affect the effectiveness of the attack, with the probability of a correct guess ranging between $5.46\%$ and $9.5\%$. Based on the results of Section 6, we can then compute the best strategy for the defender, which turns out to be (probabilities expressed as %):

[TABLE]

This strategy is part of an equilibrium and guarantees that for any choice of the attacker the vulnerability is at most $8.76\%$, and is substantially better that the best pure strategy (location 1) which leads to a worst vulnerability of $9.32\%$. As expected, $\delta^{*}$ selects the most vulnerable locations (1 and 7) with the highest probability. Still, the other locations are selected with non-negligible probability, which is important for maximizing the attacker’s uncertainty about the defense.

8 Related work

There is an extensive literature on game theory models for security and privacy in computer systems, including network security, vehicular networks, cryptography, anonymity, location privacy, and intrusion detection. See [17] for a survey.

In many studies, security games have been used to model and analyze utilities between interacting agents, especially an attacker and a defender. In particular, Korzhyk et al. [16] present a theoretical analysis of security games and investigate the relation between Stackelberg and simultaneous games under various forms of uncertainty. In application to network security, Venkitasubramaniam [28] investigates anonymous wireless networking, which they formalize as a zero-sum game between the network designer and the attacker. The task of the attacker is to choose a subset of nodes to monitor so that anonymity of routes is minimum whereas the task of the designer is to maximize anonymity by choosing nodes to evade flow detection by generating independent transmission schedules.

Khouzani et al. [14] present a framework for analyzing a trade-off between usability and security. They analyze guessing attacks and derive the optimal policies for secret picking as Nash/Stackelberg equilibria. Khouzani and Malacaria [13] investigate properties of leakage when perfect secrecy is not achievable due to the limit on the allowable size of the conflating sets, and show the existence of universally optimal strategies for a wide class of entropy measures, and for $g$-entropies (the dual of $g$-vulnerabilities). In particular, they show that designing a channel with minimum leakage is equivalent to Nash equilibria in a corresponding two-player zero-sum games of incomplete information for a range of entropy measures.

Concerning costs of security, Yang et al. [32] propose a framework to analyze user behavior in anonymity networks. Utility is modeled as a combination of weighted cost and anonymity utility. They also consider incentives and their impact on users’ cooperation.

Some security games have considered leakage of information about the defender’s choices. For example, Alon et al. [1] present two-player zero-sum games where a defender chooses probabilities of secrets while an attacker chooses and learns some of the defender’s secrets. Then they show how the leakage on the defender’s secrets influences the defender’s optimal strategy. Xu et al. [31] present zero-sum security games where the attacker acquires partial knowledge on the security resources the defender is protecting, and show the defender’s optimal strategy under such attacker’s knowledge. More recently, Farhang et al. [12] present two-player games where utilities are defined taking account of information leakage, although the defender’s goal is different from our setting. They consider a model where the attacker incrementally and stealthily obtains partial information on a secret, while the defender periodically changes the secret after some time to prevent a complete compromise of the system. In particular, the defender is not attempting to minimize the leak of a certain secret, but only to make it useless (for the attacker). Hence their model of defender and utility is totally different from ours. To the best of our knowledge there have been no works exploring games with utilities defined as information-leakage measures.

Finally, in game theory Matsui  [20] uses the term “information leakage game” with a meaning different than ours, namely, as a game in which (part of) the strategy of one player may be leaked in advance to the other player, and the latter may revise his strategy based on this knowledge.

9 Conclusion and future work

In this paper we introduced the notion of information leakage games, in which a defender and an attacker have opposing goals in optimizing the amount of information leakage in a system. In contrast to standard game theory models, in our games the utility of a mixed strategy is a convex function of the distribution of the defender’s actions, rather than the expected value of the utilities of the pure strategies in the support. Nevertheless, the important properties of game theory, notably the existence of a Nash equilibrium, still hold for our zero-sum leakage games, and we provided algorithms to compute the corresponding optimal strategies for the attacker and the defender.

As future research, we would like to extend leakage games to scenarios with repeated observations, i.e., when the attacker can repeatedly observe the outcomes of the system in successive runs, under the assumption that both the attacker and the defender may change the channel at each run. Furthermore, we would like to consider the possibility to adapt the defender’s strategy to the secret value, as we believe that in some cases this would provide significant advantage to the defender. We would also like to consider the cost of attack and of defense, which would lead to non-zero-sum games.

Acknowledgments

The authors are thankful to Arman Khouzani and Pedro O. S. Vaz de Melo for valuable discussions. This work was supported by JSPS and Inria under the project LOGIS of the Japan-France AYAME Program, and by the project Epistemic Interactive Concurrency (EPIC) from the STIC AmSud Program. Mário S. Alvim was supported by CNPq, CAPES, and FAPEMIG. Yusuke Kawamoto was supported by JSPS KAKENHI Grant Number JP17K12667.