Quantifying information flow in interactive systems

TL;DR

This paper analyzes how information flows in deterministic interactive systems modeled as finite-state transducers, showing that the flow is either logarithmic or linear and providing algorithms to distinguish these cases efficiently.

Contribution

It extends the theory of information leakage to interactive systems and links the flow rate to the growth rate of antichains in regular languages, with efficient algorithms for deterministic cases.

Findings

Information flow in deterministic systems is either logarithmic or linear.

A polynomial-time algorithm can distinguish the two flow types and compute the flow rate.

Flow rate corresponds to the growth rate of antichains in a regular language.

Abstract

We consider the problem of quantifying information flow in interactive systems, modelled as finite-state transducers in the style of Goguen and Meseguer. Our main result is that if the system is deterministic then the information flow is either logarithmic or linear, and there is a polynomial-time algorithm to distinguish the two cases and compute the rate of logarithmic flow. To achieve this we first extend the theory of information leakage through channels to the case of interactive systems, and establish a number of results which greatly simplify computation. We then show that for deterministic systems the information flow corresponds to the growth rate of antichains inside a certain regular language, a property called the width of the language. In a companion work we have shown that there is a dichotomy between polynomial and exponential antichain growth, and a polynomial time algorithm to distinguish the two cases and to compute the order of polynomial growth. We observe that these two cases correspond to logarithmic and linear information flow respectively. Finally, we formulate several attractive open problems, covering the cases of probabilistic systems, systems with more than two users and nondeterministic systems where the nondeterminism is assumed to be innocent rather than demonic.

Equations

$${\mathcal{L}}_{\infty }(X,Y)=\log {\mathbb{E}}_{y\sim Y}\frac{{\sup }_{x\in \mathcal{X}}{p}_{X|Y}(x|y)}{{\sup }_{x\in \mathcal{X}}{p}_X(x)}.$$

$${\mathcal{L}}_{\infty }(\mathcal{C})=\underset{(X,Y)\sim \mathcal{C}}{\sup }{\mathcal{L}}_{\infty }(X,Y),$$

$${\mathcal{L}}_g(X,Y)=\log {\mathbb{E}}_{y\sim Y}\frac{{\sup }_{w\in \mathcal{W}}{\sum }_{x\in \mathcal{X}}{p}_{X|Y}(x|y)g(w,x)}{{\sup }_{w\in \mathcal{W}}{\sum }_{x\in \mathcal{X}}{p}_X(x)g(w,x)}.$$

$${\mathcal{L}}_g(\mathcal{C})=\underset{(X,Y)\sim \mathcal{C}}{\sup }{\mathcal{L}}_g(X,Y).$$

$${\mathcal{L}}_g(\mathcal{C})\le {\mathcal{L}}_{\infty }(\mathcal{C}).$$

$${\mathcal{L}}_D(X,Y)=\underset{Z\in \mathcal{D}}{\sup }{\mathcal{L}}_{\infty }(Z,Y),$$

$$\underset{g}{\sup }{\mathcal{L}}_g(Z,Y)\le \underset{g}{\sup }{\mathcal{L}}_g(Y,X),$$

$${\mathcal{L}}_D(X,Y)\le {\mathcal{L}}_{\infty }(\mathcal{C}).$$

$${\mathcal{L}}_D(X,Y)$$

$$=\log \sum _{y\in {\mathcal{Y}}^{+}}\underset{x\in \mathcal{X}}{\sup }{p}_{Y|X}(y|x),$$

$${\mathcal{L}}_{\infty }(\mathcal{C})=\log \sum _{y\in \mathcal{Y}}\underset{x\in \mathcal{X}}{\sup }{p}_{Y|X}(y|x).$$

$$\sum _{i=1}^{k-1}{p}_X(x_i)<\xi \le \sum _{i=1}^k{p}_X(x_i).$$

$$p_{X,Z_n}(x,z)=\mu \left(f^{-1}(x)\cap \left[\frac{z}{2^n},\frac{z+1}{2^n}\right]\right).$$

$${\mathcal{L}}_{\infty }(Z_n,Y)$$

$$=\log \sum _{y\in \mathcal{Y}}{p}_Y(y)2^n\underset{z}{\max }{p}_{Z_n|Y}(z|y).$$

$$\underset{n\to \infty }{\lim }{p}_Y(y)2^n\underset{z}{\max }{p}_{Z_n|Y}(z|y)\ge \underset{x}{\sup }{p}_{Y|X}(y|x)$$

$$p_Y(y)p_{Z_n|Y}(z|y)$$

$$=2^{-n}\sum _{x\in \mathcal{X}}{p}_{Y|X}(y|x)p_{X|Z_n}(x|z).$$

$$\underset{n\to \infty }{\lim }{\mathcal{L}}_{\infty }(Z_n,Y)\ge \log \sum _{y\in \mathcal{Y}}\underset{x}{\max }{p}_{Y|X}(y|x),$$

$${\mathcal{L}}_{\infty }((X_A,X_B),Y)$$

$$=\log {\mathbb{E}}_{x_B\sim X_B,y\sim Y}\frac{{\sup }_{x_A\in {\mathcal{X}}_A}{p}_{X_A|X_B,Y}(x_A|x_B,y)}{{\sup }_{x_A\in {\mathcal{X}}_A}{p}_{X_A}(x_A)}$$

$$=\log {\mathbb{E}}_{x_B\sim X_B}{2}^{{\mathcal{L}}_{\infty }(X_A,Y|X_B=x_B)}.$$

$${\mathcal{L}}_{\infty }(\mathcal{C})=\underset{((X_A,X_B),Y)\sim \mathcal{C}}{\sup }{\mathcal{L}}_{\infty }((X_A,X_B),Y).$$

$$\varphi \left(\sum _i{\rho }_i{X}_i\right)\le \underset{i}{\sup }\varphi (X_i).$$

$${\mathcal{L}}_{\varphi }(\mathcal{C})=\underset{((X_A,X_B),Y)\sim \mathcal{C}}{\sup }\varphi (\mathcal{L}(X_A,Y|X_B)).$$

$${\mathcal{L}}_{\varphi }(\mathcal{C})=\underset{x_B\in {\mathcal{X}}_B}{\sup }\underset{(X_A,x_B,Y)\sim \mathcal{C}}{\sup }\mathcal{L}(X_A,Y),$$

$$\varphi (\mathcal{L}(X_A,Y|X_B))=\varphi \left(\sum _{x_B}{p}_{X_B}(x_B)\mathcal{L}(X_A,Y|X_B=x_B)\right).$$

$$\varphi (\mathcal{L}(X_A,Y|X_B=x_B))$$

$$\ge \varphi (\mathcal{L}(X_A,Y|X_B))-ϵ.$$

$$\underset{x_B\in {\mathcal{X}}_B}{\sup }\mathcal{L}(X_A,Y|X_B=x_B)=\varphi (\mathcal{L}(X_A,Y|X_B)),$$

$${\mathcal{L}}_{\infty }(\mathcal{C})=\underset{x_B\in {\mathcal{X}}_B}{\sup }{\mathcal{L}}_{\infty }(\mathcal{C}|X_B=x_B).$$

$$p_{Y|X_A,X_B}(y|x_A,x_B)\in \{0,1\}.$$

$$\begin{gathered} {\mathcal{L}}_{\infty }(\mathcal{C})=\underset{x_B\in {\mathcal{X}}_B}{\sup }\log |\{y\in \mathcal{Y}|\exists x_A\in {\mathcal{X}}_A: \\ {p}_{Y|X_A,X_B}(y|x_A,x_B)=1\}|. \end{gathered}$$

Full text

I Introduction

The notion of ‘noninterference’ was introduced by Goguen and Meseguer in [1]. It has long been recognised, however, that this condition—that no information can reach Bob about the actions of Alice—may in some circumstances be too strong. The field of quantitative information flow therefore aims to compute the amount of information that can reach Bob about Alice’s actions.

The contributions of this work are in two main parts. In the first part we extend the theory of information flow through channels developed by Smith, Palamidessi and many others to the case of interactive systems. In addition to basic definitions, we establish a number of results which greatly simplify computation. In particular, we show that it suffices to consider probability distributions over deterministic strategies for the two parties and that one of them may be assumed to adopt a pure deterministic strategy. We also show that if the system itself is deterministic then there is a possiblistic characterisation of the information flow which avoids quantifying over probability distributions altogether; this will be essential for the work of the second part.

In the second part we study determinstic interactive systems modelled as finite-state transducers in the style of Goguen and Meseguer. We define the information-flow capacity of such systems, before addressing the formidable technical problem of computing it. The key idea is to show that this can be reduced to a certain combinatorial problem on partially ordered sets. This problem is solved in a companion work [2], with the consequence that we are able to show (Theorem 30) that for such systems there is a dichotomy between logarithmic and linear information flow, and a polynomial-time algorithm to distinguish the two cases. These two cases are naturally interpreted as ‘safe’ and ‘dangerous’ respectively, so we have shown that it is possible to distinguish genuinely dangerous information flow. We thereby accomplish a goal proposed by Ryan, McLean, Millen and Gligor at CSFW’01 in [3].

Overview

In Section II we first recall some relevant theory on the information-flow capacity of channels, and improve a result of Alvim, Chatzikokolakis, McIver, Morgan, Palamidessi and Smith giving an upper bound on the ‘Dalenius leakage’ of a channel to an exact formula (Theorem 1). We then consider interactive channels, where both parties may be required to make choices. We define leakage and information-flow capacity in this setting, and show that Bob’s strategy may be assumed to be deterministic (Corollary 3). We show (Theorem 4) that in the case of deterministic channels we may take a possbilistic view of Alice’s actions, which we will find simplifies calculation considerably. Finally we show (Theorem 9) that for systems which may involve multiple rounds of interaction it suffices to consider probability distributions over deterministic, rather than probabilistic, strategies.

In Section III we model deterministic interactive systems as finite-state transducers, and define their information-flow capacity. We then show how to reduce the problem of computing this to a problem involving only nondeterministic finite automata, and then to the combinatorial problem of computing the ‘width’ of the languages generated by the relevant automata. We observe that this problem is solved in [2], and consequently conclude (Theorem 30) that there is a dichotomy between logarithmic and linear information flow, and a polynomial-time algorithm to distinguish the two cases. The structure of the sequence of reductions leading to this theorem is summarised in Figure 3, and we illustrate the theory by applying it to a simple scheduler.

In Section IV we discuss some generalisations of the systems studied in main part of this work: namely nondeterministic systems, systems with more than two agents (which we observe encompasses the case of nondeterministic systems), and probabilistic systems. For the latter two we define the information-flow capacity and formulate the open problems of computing it. Finally in Section V we discuss related work and in Section VI we conclude.

II Information-theoretic preliminaries

II-A Leakage through channels

We consider first the case of leakage through a channel from a space $\mathcal{X}$ of inputs to a space $\mathcal{Y}$ of outputs, corresponding to a situation in which the attacker is purely passive: Alice selects an input according to a known prior distribution $p_{X}$ and Bob (the attacker) receives an output according to the conditional distribution $p_{Y|X}$, which specifies the channel. How much information should we say that Bob has received?

The first work on quantified information flow adopted the classical information-theoretic notion of mutual information introduced by Shannon in the 1940s [4]. However, Smith observed in [5] the problems with this consensus definition. The essential problem is that mutual information represents in some sense the average number of bits of information leaked by the system. This is appropriate for the noisy coding theorem, where we are interested in the limit of many uses of the channel, but not for the case of information leakage where we assume that the adversary receives only one output (or a small number of outputs).

This means that, in the example used by Smith, a system which leaks the whole secret 1/8 of the time is seen as largely secure (because $H(X|Y)=\tfrac{7}{8}H(X)$), although it allows (for instance) a cryptographic key to be guessed 1/8 of the time. Smith addresses this by adopting the min-entropy leakage, defined111Smith and subsequent authors generally define leakage only for random variables whose images are finite sets. However, their definitions are straightforwardly generalised to arbitrary discrete random variables by replacing $\max$ with $\sup$ where appropriate. Except where noted, the proofs of all quoted results remain valid after the same modification. as the expected value of the increase in the probability of guessing the input upon observing the output $y$:

[TABLE]

Given a channel $\mathcal{C}$ specified by a matrix of conditional probabilities $p_{Y|X}$, we may be interested in its capacity, which is the maximum value of the leakage over all possible priors $p_{X}$:

[TABLE]

where the notation $(X,Y)\sim\mathcal{C}$ means that $X$ and $Y$ are random variables compatible with $\mathcal{C}$; that is, that the conditional probabilities $p_{Y|X}$ (where defined) correspond to the matrix defining $\mathcal{C}$.

In [6], Alvim, Chatzikolakis, Palamidessi and Smith generalise this definition to the notion of $g$-leakage, in which Bob makes a guess drawn from a set $\mathcal{W}$, and receives a payoff according to the function $g:\mathcal{W}\times\mathcal{X}\rightarrow[0,1]$. The leakage with respect to $g$ is then

[TABLE]

Once again, we can define the capacity of a channel $\mathcal{C}$:

[TABLE]

In Theorem 5.1 of [6], the authors prove the so-called ‘miracle’ theorem, which states that for any channel $\mathcal{C}$ and any gain function $g$ we have that the $g$-capacity is at most the min-entropy capacity:

[TABLE]

However, it may be the case that the secret which Bob is trying to guess is not Alice’s input but some other secret value (a cryptographic key, say) which is related to $x$ in some known but unspecified way. We may be interested in bounding the possible gain for Bob for any possible secret and any (probabilistic) relationship to the choice of $x$; this is sometimes known as the ‘Dalenius leakage’, after a desideratum attributed to T. Dalenius by Dwork in [7]. We may therefore define

[TABLE]

where $\mathcal{D}$ is the collection of random variables $Z$ such that $Z\rightarrow X\rightarrow Y$ forms a Markov chain (that is, $p_{X,Y,Z}(x,y,z)=p_{Z}(z)p_{X|Z}(x|z)p_{Y|X}(y|x)$).

In [8], Alvim, Chatzikokolakis, McIver, Morgan, Palamidessi and Smith give an upper bound for the Dalenius leakage: they show in Corollary 23 that for any Markov chain $Z\rightarrow X\rightarrow Y$ we have that

[TABLE]

where the suprema are taken over gain functions $g$. Hence in particular we have that $\mathcal{L}_{\infty}(Z,Y)\leq\sup_{g}\mathcal{L}_{g}(Y,X)$. But $\mathcal{L}_{g}(Y,X)\leq\mathcal{L}_{g}(\mathcal{C})$, where $\mathcal{C}$ is any channel such that $(X,Y)\sim\mathcal{C}$, and by the miracle theorem we have that $\mathcal{L}_{g}(\mathcal{C})\leq\mathcal{L}_{\infty}(\mathcal{C})$, and hence we have that

[TABLE]

We are able to improve this to a precise formula for the Dalenius leakage between two random variables.

Theorem 1**.**

Let $X,Y$ be any discrete random variables. Then

[TABLE]

where $\mathcal{Y}^{+}\subseteq\mathcal{Y}$ is the set of $y\in\mathcal{Y}$ such that $p_{Y}(y)>0$.

Proof.

We may assume without loss of generality that $p_{Y}(y)>0$ for all $y\in Y$ (otherwise redefine $\mathcal{Y}$ to be the set of values on which $p_{Y}$ is supported).

For the upper bound, we recall that Braun, Chatzikokolakis and Palamidessi observe in Proposition 5.11 of [9] that there is a simple formula for the min-entropy capacity of a channel $\mathcal{C}$ defined by matrix $p_{Y|X}$:

[TABLE]

This is proved in [9] for random variables with finite image. For general discrete random variables, the upper bound on $\mathcal{L}_{\infty}(\mathcal{C})$ is obtained by replacing $\max$ with $\sup$ as appropriate, but the lower bound requires a little more care since it is given by considering the uniform distribution on $\mathcal{X}$. However, the lower bound can be recovered for infinite $\mathcal{X}$ by considering the uniform distribution on the first $k$ elements of $\mathcal{X}$ and taking the limit as $k\rightarrow\infty$.

The upper bound on $\mathcal{L}_{D}(X,Y)$ is immediate from (1) by taking $\mathcal{C}$ to be any channel such that $(X,Y)\sim\mathcal{C}$.

For the lower bound, suppose that $\mathcal{X}=\{x_{1},x_{2},x_{3},\ldots\}$, and define the function $f:[0,1)\rightarrow\mathcal{X}$ by $f(\xi)=x_{k}$ if

[TABLE]

Note that for each $x\in\mathcal{X}$ we have that $p_{X}(x)=\mu(f^{-1}(x))$, where $\mu$ is the Borel measure.

For each positive integer $n$, let $\mathcal{Z}_{n}=\{0,1,2,\ldots,2^{n}-1\}$ and let $Z_{n}$ be a random variable taking values in $\mathcal{Z}_{n}$, with

[TABLE]

Note that by the previous observation we have $\sum_{z\in\mathcal{Z}_{n}}p_{X,Z_{n}}(x,z)=\mu(f^{-1}(x))=p_{X}(x)$ as required. Note also that we have that $p_{Z}(z)=\sum_{x\in\mathcal{X}}p_{X,Z_{n}}(x,z)=2^{-n}$.

Now we have

[TABLE]

We claim that

[TABLE]

for all $y\in\mathcal{Y}$.

Indeed, by Bayes’ theorem we have

[TABLE]

Let $x\in\mathcal{X}$ be arbitrary. For sufficiently large $n$ we have that $p_{X|Z_{n}}(x|z)=1$ for some $z\in\mathcal{Z}_{n}$, and hence for this $z$ we have that $p_{Y}(y)2^{n}p_{Z_{n}|Y}(z|y)\geq p_{Y|X}(y|x)$, proving the claim. Summing (2) over all $y\in\mathcal{Y}$ and rearranging gives

[TABLE]

as required. ∎

II-B Interactive channels

More generally, we will be interested in interactive channels, where an input is chosen by both Alice and Bob, and the system then produces an output to Bob. This means that the space $\mathcal{X}$ is of the form $\mathcal{X}_{A}\times\mathcal{X}_{B}$, where the spaces $\mathcal{X}_{A}$ and $\mathcal{X}_{B}$ are the spaces of inputs for Alice and Bob respectively, and the interactive channel $\mathcal{C}$ is defined by the matrix of conditional probabilites $p_{Y|X_{A},X_{B}}$.

Note that if the system involves a sequence of outputs and actions by Alice and Bob then the ‘inputs’ $x_{A}$ and $x_{B}$ will in fact represent strategies for Alice and Bob, determining their actions on the basis of the outputs they have seen so far (in general these may be probabilistic, but we will see in Section II-D that in fact it is sufficient to consider only deterministic strategies).

We will write $((X_{A},X_{B}),Y)\sim\mathcal{C}$ to mean that the random variables $X_{A},X_{B}$ and $Y$ are consistent with the channel $\mathcal{C}$: that is, that $X_{A}$ and $X_{B}$ are independent and the matrix $p_{Y|X_{A},X_{B}}$ corresponds with the matrix defining $\mathcal{C}$.

We can once again define the min-entropy leakage as the expected increase in Bob’s probability of guessing the value of the input based on having seen the output:

[TABLE]

Again the capacity of the channel is defined as the maximum leakage over all possible priors $p_{X_{A}}$ and $p_{X_{B}}$.

[TABLE]

It appears at first glance that calculating $\mathcal{L}_{\infty}(\mathcal{C})$ may in general be highly intractible: we have to quantify over mixed strategies (that is over probability distributions on strategies) for Alice and Bob. However, it turns out that we may assume without loss of generality that Bob chooses a pure strategy.222Note that this means a pure strategy over the set $\mathcal{X}_{B}$, which in an interactive system may contain probabilistic strategies (although we will see in Theorem 9 that these may be ignored without loss of generality). Indeed, this holds not only for the choices we have made but for all reasonable such choices.

Specifically, we chose a leakage measure, namely $\mathcal{L}_{\infty}$, and a method of averaging the leakage over different values of $x_{B}$, namely taking $\log\mathbb{E}_{x_{B}}2^{\mathcal{L}}$. The following proposition shows that we may assume a pure strategy for Bob for any choice of leakage measure, and any method of averaging which is ‘reasonable’ in the sense that if the distribution of leakage is constant with value $x$ then the value is $x$, and also that the value of a weighted sum of leakage distributions cannot be more than the maximum value of the distributions making up the sum (this last property is known as ‘quasiconvexity’).

Proposition 2**.**

Let $\mathcal{L}:\mathbb{D}(\mathcal{X}_{A}\times\mathcal{Y})\rightarrow\mathbb{R}$ (the ‘leakage function’) be any function and let $\phi:\mathbb{D}(\mathbb{R})\rightarrow\mathbb{R}$ (the ‘averaging function’) be any function such that if $X\in\mathbb{D}(\mathbb{R})$ is constant $x$ then $\phi(X)=x$ and for any $X_{1},X_{2},\ldots\in\mathbb{D}(\mathbb{R})$ and any $\rho_{1},\rho_{2},\ldots$ with $\sum_{i}\rho_{i}=1$ we have

[TABLE]

Let

[TABLE]

Then we have

[TABLE]

where the notation $(X_{A},x_{B},Y)$ means the distribution with $p_{X_{B}}(x_{B})=1$, and in the above $\mathbb{D}(\mathcal{X})$ means the space of probability distributions over the set $\mathcal{X}$.

Proof.

Suppose that $(X_{A},X_{B},Y)\sim\mathcal{C}$. We have

[TABLE]

Hence for any $\epsilon>0$, by (3) there exists some $x_{B}$ such that

[TABLE]

Hence we have

[TABLE]

establishing the result. ∎

The min-entropy capacity is a special case of this result, with $\mathcal{L}=\mathcal{L}_{\infty}$ and $\phi(X)=\log\mathbb{E}_{x\sim X}2^{x}$.

Corollary 3**.**

Let $\mathcal{C}$ be an interactive channel. Then we have

[TABLE]

II-C Deterministic channels

For the channels we have considered above, once the inputs from Alice and Bob are fixed we obtain a probability distribution on outputs. However, for some systems it may be that the output is not probabilistic, but is determined by the values of the inputs; we will call such a channel deterministic. More concretely, an interactive channel $\mathcal{C}$ defined by the matrix $p_{Y|X_{A},X_{B}}$ is deterministic if for all $x_{A},x_{B},y$ we have

[TABLE]

If $\mathcal{C}$ is deterministic then the computation of $\mathcal{L}_{\infty}(\mathcal{C})$ simplifies considerably, because it turns out that we can take a purely possibilistic view of Alice’s actions and avoid any quantification over probability distributions.

Theorem 4**.**

Let $\mathcal{C}$ be a deterministic interactive channel. Then

[TABLE]

Proof.

By Corollary 3, it suffices to prove that

[TABLE]

By the formula for $\mathcal{L}_{\infty}(\mathcal{C})$ from [9] (recalled as (1) in the proof of Theorem 1) we have

[TABLE]

since $\mathcal{C}$ is deterministic and so $p_{Y|X_{A},X_{B}}(y|x_{A},x_{B})\in\{0,1\}$. ∎

Theorem 4 essentially says that it suffices to count the maximum number of outputs that can be seen by Bob, consistently with his choice of strategy. The corresponding result for non-interactive channels is Theorem 1 of [5].

II-D Probabilistic vs deterministic strategies

We observed in Section II-B that the ‘channel’ paradigm is able to model systems involving many rounds of interaction, because we can take Alice and Bob’s inputs to be strategies, determining the actions they will take at each step of the interaction. At each step, Alice (respectively Bob) will have observed a trace of the interaction thus far drawn from a set $T$, and must select an action drawn from a set $\Sigma$. To specify a randomised strategy for Alice or Bob, we must therefore specify for each $t\in T$ a probability distribution over $\Sigma$, so the set of strategies is the set of maps $T\rightarrow\mathbb{D}\Sigma$.

In this section we will show that in fact it suffices to consider only deterministic strategies for Alice and Bob. The intuition behind this is fairly straightforward: given a probabilistic strategy, we could imagine that any necessary coins are tossed before the execution begins, which gives a probability distribution over deterministic strategies. This changes nothing except that it allows Bob to see how the random choices made by his strategy were resolved, but this only gives him more information and so does not affect the information flow capacity. To avoid technical measurability issues we will assume that the sets $T$ and $\Sigma$ are finite.

Definition 5**.**

Let $T$ be a finite set of traces and $\Sigma$ a finite set of actions. A strategy over $T$ and $\Sigma$ is a function $f:T\rightarrow\mathbb{D}(\Sigma)$. The set of strategies over $T$ and $\Sigma$ is denoted $\mathcal{S}_{T,\Sigma}$.

A strategy $f\in\mathcal{S}_{T,\Sigma}$ is determinsitic if we have

[TABLE]

for all $t\in T$ and $x\in\Sigma$. We write $\mathcal{D}_{T,\Sigma}\subset\mathcal{S}_{T,\Sigma}$ for the set of deterministic strategies over $T$ and $\Sigma$.

In the execution itself, these strategies will be executed and particular actions chosen. The output $y\in\mathcal{Y}$ displayed to Bob is then a function (which may be probabilistic) of the choices that were made; the system is defined by this function, which is a map from pairs of functions $T\rightarrow\Sigma$ (the choices made by Alice and Bob respectively) to distributions over $\mathcal{Y}$. Note that it may be that in some executions not all traces are actually presented to Alice and Bob for decision; this can be represented by the choices made in response to those traces being ignored, so no generality is lost by considering total functions $T\rightarrow\Sigma$ (similarly the trace-sets relevant to Alice and Bob may be distinct, but this can be represented by ignoring the choices made by Alice on Bob’s traces and vice versa).

We write $\Sigma^{T}$ for the set of functions $T\rightarrow\Sigma$; the probability that a particular function is realised by a particular strategy can be computed by multiplying the probabilities for each decision (note that nothing is lost by assuming independence: if Alice and Bob are supposed to know about previous choices they have made then this can be encoded in the traces).

Definition 6**.**

Let $f\in\mathcal{S}_{T,\Sigma}$ be any strategy and $g\in\Sigma^{T}$. The probability that $f$ realises $g$, written $f(g)$, is given by

[TABLE]

Definition 7**.**

Let $\phi:\Sigma^{T}\times\Sigma^{T}\rightarrow\mathbb{D}\mathcal{Y}$ be any map, and let $\mathcal{X}_{A}$ and $\mathcal{X}_{B}$ be any subsets of $\mathcal{S}_{T,\Sigma}$. The interactive channel determined by $\phi,\mathcal{X}_{A}$ and $\mathcal{X}_{B}$, denoted $\mathcal{C}_{\phi,\mathcal{X}_{A},\mathcal{X}_{B}}$, is determined by the matrix of conditional probabilities

[TABLE]

We observe that if the function $\phi$ defining the system is deterministic, and if Alice and Bob use only deterministic strategies, then the channel produced is a deterministic interactive channel in the sense of the previous section, such that Theorem 4 applies to it.

Proposition 8**.**

Suppose that $\phi(g,g^{\prime})(y)\in\{0,1\}$ for every $g,g^{\prime}\in\Sigma^{T}$ and $y\in\mathcal{Y}$. Then $\mathcal{C}_{\phi,\mathcal{D}_{T,\Sigma},\mathcal{D}_{T,\Sigma}}$ is a deterministic interactive channel.

Proof.

If $f_{A},f_{B}\in\mathcal{D}_{T,\Sigma}$ then $f_{A}(g),f_{B}(g)\in\{0,1\}$ for all $g\in\Sigma^{T}$. Hence if $\phi(g_{A},g_{B},y)\in\{0,1\}$ for all $g_{A},g_{B},y$ then we have $p_{Y|X_{A},X_{B}}(y|f_{A},f_{B})\in\{0,1\}$ for all $f_{A},f_{B},y$, as required. ∎

The main theorem of this section is that in fact it suffices to conisder only deterministic strategies for Alice and Bob.

Theorem 9**.**

Let $\Sigma$ and $T$ be any finite sets, $\mathcal{Y}$ any set and $\phi:\Sigma^{T}\times\Sigma^{T}\rightarrow\mathbb{D}\mathcal{Y}$ be any map. Then we have

[TABLE]

Proof.

The lower bound is immediate: since whenever $((X_{A},X_{B}),Y)\sim\mathcal{C}_{\phi,\mathcal{D}_{T,\Sigma},\mathcal{D}_{T,\Sigma}}$ then also $((X_{A},X_{B}),Y)\sim\mathcal{C}_{\phi,\mathcal{S}_{T,\Sigma},\mathcal{S}_{T,\Sigma}}$, we must have (writing $\mathcal{C}_{\mathcal{S}}$ and $\mathcal{C}_{\mathcal{D}}$ resectively for the two channels in the statement of the theorem)

[TABLE]

For the upper bound, let $X_{A}$ and $X_{B}$ be any independent $\mathcal{S}_{T,\Sigma}$-valued random variables. We will first show that without loss of generality we may assume that $X_{B}$ is supported only on $\mathcal{D}_{T,\Sigma}$. By Corollary 3 it suffices to show this where $X_{B}$ is a point distribution,333Strictly speaking Corollary 3 was proved for discrete distributions, whereas $\mathcal{S}_{T,\Sigma}$ is a continuous subset of $\mathbb{R}^{|T|\cdot|\Sigma|}$. The proof for this case is exactly the same, with sums over $\mathcal{X}_{B}$ replaced by integrals with respect to the Lebesgue measure. so say that $X_{B}$ takes the value $f_{B}\in\mathcal{S}_{T,\Sigma}$.

Define the random variable $X_{B}^{\prime}$ to be supported only on $\mathcal{D}_{T,\Sigma}$, and for $f\in\mathcal{D}_{T,\Sigma}$ let

[TABLE]

where $\widetilde{f}$ is the function $T\rightarrow\Sigma$ induced by $f$: that is, $\widetilde{f}(t)$ is the unique element $x$ of $\Sigma$ such that $f(t)(x)=1$.

Note that by Definitions 6 and 7 we have that $(X_{A},X_{B})$ and $(X_{A},X_{B}^{\prime})$ induce the same output distribution $Y$, and so it suffices to prove that for each $y\in\mathcal{Y}$ we have

[TABLE]

Now on the one hand we have

[TABLE]

On the other hand we have

[TABLE]

Plainly $\eqref{eq:xbbig}\geq\eqref{eq:xbsmall}$, establishing the result.

We now show that we may also assume that $X_{A}$ is supported only on $\mathcal{D}_{T,\Sigma}$, and again by Corollary 3 it suffices to show this where $X_{B}$ takes only a single value, say $f_{B}\in\mathcal{D}_{T,\Sigma}$. By the min-entropy capacity formula (1) conditioned on $X_{B}=f_{B}$ it suffices to show that for every $y\in\mathcal{Y}$ we have

[TABLE]

But this is straightforward: indeed, for any $f_{A}\in\mathcal{S}_{T,\Sigma}$ we have

[TABLE]

as required. ∎

III Deterministic interactive systems

III-A Finite-state transducers

We will model deterministic interactive systems as deterministic finite-state transducers. Whereas Goguen and Meseguer in [1] modelled such systems as ‘state-observed’ transducers, we will consider the more general notion of ‘action-observed’ transducers (see the work of van der Meyden and Zhang in [10] for further discussion of the relationship between noninterference properties in these two models; this model is also essentially equivalent to the notion of ‘Input-Output Labelled Transition System’ used by Clark and Hunt in the non-quantitative setting in [11]).

Definition 10**.**

A deterministic finite-state transducer (DFST) is a 7-tuple $\mathcal{T}=(Q,q_{0},F,\Sigma,\Gamma,\delta,\sigma)$, where $Q$ is a finite set of states, $q_{0}\in Q$ is the initial state, $F\subseteq Q$ is the set of accepting states, $\delta:Q\times\Sigma\rightarrow Q$ is the transition function and $\sigma:Q\times\Sigma\rightarrow\Gamma\cup\{\epsilon\}$ is the output function.

A pair $(a_{1}a_{2}\ldots a_{k},b_{1}b_{2}\ldots b_{l})\in\Sigma^{*}\times\Gamma^{*}$ is accepted by $\mathcal{T}$ if there exists a sequence of states $q_{1}\ldots q_{k}\in Q^{*}$ such that $q_{k}\in F$, for every $0\leq i<k$ we have $q_{i+1}=\delta(q_{i},a_{i+1})$ and $b_{1}\ldots b_{l}=\sigma(q_{0},a_{1})\sigma(q_{1},a_{2})\ldots\sigma(q_{k-1},a_{k})$. We will write $L(\mathcal{T})$ for the subset of $\Sigma^{*}\times\Gamma^{*}$ accepted by $\mathcal{T}$; such a set is a deterministic finite-state transduction, which we will also abbreviate by DFST.

This definition is not quite convenient for our purposes, because we assume that the agents are able to observe the passage of time. Hence even at a timestep where the machine does nothing, there should be a record in the trace of the fact that time has passed. We ensure this by requiring that there should be an output at each step, and apply the non-standard term ‘synchronised’ to describe this property (such a transducer is also sometimes called ‘letter-to-letter’).

Definition 11**.**

A DFST $\mathcal{T}=(Q,q_{0},F,\Sigma,\Gamma,\delta,\sigma)$ is synchronised if $\sigma(Q,\Sigma)\subseteq\Gamma$ (that is, we do not have $\sigma(q,a)=\epsilon$ for any $q\in Q$ and $a\in\Sigma$). In this case we say that $\mathcal{T}$ is a synchronised deterministic finite-state transducer (SDFST).

Note that this definition almost corresponds with the original definition of a Mealy machine ([12]), except that we allow for a set of final states $F\neq Q$. It is clear that if $\mathcal{T}$ is synchronised then $(a_{1}\ldots a_{k},b_{1}\ldots b_{l})\in\Sigma^{*}\times\Gamma^{*}$ is accepted by $\mathcal{T}$ only if $l=k$. We shall therefore apply the ‘zip’ operation and view $\mathcal{T}$ as accepting elements of $(\Sigma\times\Gamma)^{*}$.

We are interested in SDFSTs of a special kind, representing the fact that the system communicates separately with Alice and Bob. We will consider SDFSTs whose input and output alphabets $\Sigma$ and $\Gamma$ are of the form $\Sigma_{A}\times\Sigma_{B}$ and $\Gamma_{A}\times\Gamma_{B}$ respectively. The pairs $(\Sigma_{A},\Gamma_{A})$ and $(\Sigma_{B},\Gamma_{B})$ represent the input and output alphabets used for communication with Alice and Bob respectively.

A simple example of such a transducer is the system which simply relays messages between the two agents (with $\Sigma_{A}=\Sigma_{B}=\{a,b\}$ and $\Gamma_{A}=\Gamma_{B}=\{a^{\prime},b^{\prime}\}$). This is shown in Figure 1.

III-B Strategies and information flow

In order to apply the framework of the previous section, we must define the spaces $\mathcal{X}_{A},\mathcal{X}_{B}$ of strategies for Alice and Bob, the space $Y$ of outcomes visible to Bob, and the matrix $p_{Y|X_{A},X_{B}}$ governing which outcomes occur. Since we are considering deterministic specifications, the matrix $p_{Y|X_{A},X_{B}}$ will be 0-1-valued.

Alice and Bob must each decide on an action based on the trace they have seen thus far, so a strategy for Alice is a function

[TABLE]

and similarly a strategy for Bob is a function $x_{B}:(\Sigma_{B}\times\Gamma_{B})^{*}\rightarrow\Sigma_{B}$.

Recall that by Theorem 9 it suffices to consider deterministic strategies for Alice and Bob: in the language of Section II-D, we have $T=(\Sigma_{A}\times\Gamma_{A})^{*}\cup(\Sigma_{B}\times\Gamma_{B})^{*}$ and $\Sigma=\Sigma_{A}\cup\Sigma_{B}$. We will have that the function $\phi(g_{A},g_{B},y)$ ignores the values of $g_{A}$ on $(\Sigma_{B}\times\Gamma_{B})^{*}$ and the values of $g_{B}$ on $(\Sigma_{A}\times\Gamma_{A})^{*}$, and treats all elements of $\Sigma_{B}$ in the image of $g_{A}$ as equivalent to some fixed $a\in\Sigma_{A}$ and similarly all elements of $\Sigma_{A}$ in the image of $g_{B}$ as equivalent to some fixed $b\in\Sigma_{B}$. By Theorem 9 it suffices to consider deterministic strategies for Alice and Bob and so it is more convenient to refer to the sets of deterministic strategies directly as $\mathcal{X}_{A}$ and $\mathcal{X}_{B}$, and to $\phi(x_{A},x_{B})(y)$ directly as the channel matrix $p_{Y|X_{A},X_{B}}(y|x_{A},x_{B})$.

Given an SDFST $\mathcal{T}$, and strategies $x_{A}$ and $x_{B}$ for Alice and Bob respectively, what output or outputs can be shown to Bob? We consider first the case where $F=Q$, postponing for later the issues that arise when $F\subsetneq Q$.

Definition 12**.**

We will say that a word

[TABLE]

(so $a_{i}\in\Sigma_{A},a_{i}^{\prime}\in\Sigma_{B},b_{i}\in\Gamma_{A}$ and $b_{i}^{\prime}\in\Gamma_{B}$) is consistent with SDFST $\mathcal{T}$ and strategies $x_{A},x_{B}$ if

1. (i)

$w\in L(\mathcal{T})$, and 2. (ii)

for every $1\leq i\leq k$ we have

[TABLE]

and

[TABLE]

A word $(a^{\prime}_{1},b^{\prime}_{1})\ldots(a^{\prime}_{k},b^{\prime}_{k})\in(\Sigma_{B}\times\Gamma_{B})^{*}$ is consistent with $\mathcal{T},x_{A}$ and $x_{B}$ if there exist $a_{1},\ldots,a_{k}\in\Sigma_{A}$ and $b_{1},\ldots,b_{k}\in\Gamma_{A}$ such that $(((a_{1},a_{1}^{\prime}),(b_{1},b_{1}^{\prime}))\ldots\allowbreak((a_{k},a_{k}^{\prime}),(b_{k},b_{k}^{\prime})))$ is consistent with $\mathcal{T},x_{A}$ and $x_{B}$.

We will sometimes refer to limb (ii) of the above Definition as ‘being consistent with $x_{A},x_{B}$’; then being consistent with $\mathcal{T},x_{A},x_{B}$ means being an element of $L(\mathcal{T})$ and being consistent with $x_{A},x_{B}$.

Could we choose to have $Y=(\Sigma_{B}\times\Gamma_{B})^{*}$, and say that $p_{Y|X_{A},X_{B}}(y|x_{A},x_{B})=1$ if $y$ is consistent with $\mathcal{T},x_{A}$ and $x_{B}$?

No, because such a $y$ may not be unique, and so the matrix $p_{Y|X_{A},X_{B}}(y|x_{A},x_{B})$ would not in general be stochastic. For example, if $\mathcal{T}$ is the identity transduction and $x_{A}$ and $x_{B}$ are both constant $a$, we have that $(a,a)^{k}$ is consistent with $\mathcal{T},x_{A}$ and $x_{B}$ for all $k$. But prefixes are the only way this can happen.

Proposition 13**.**

Let $\mathcal{T}$ be an SDFST as above and let $x_{A},x_{B}$ be strategies for Alice and Bob. Then there exists some $w_{0}\in(\Sigma\times\Gamma)^{\omega}$ such that for any $w\in L(\mathcal{T})$ we have that $w$ is consistent with $x_{A}$ and $x_{B}$ if and only if $w\leq w_{0}$.

Proof.

Define the infinite word

[TABLE]

by

[TABLE]

where $q_{0}$ is the initial state and the sequence $q_{0}q_{1}\ldots$ is defined by $q_{i}=\delta(q_{i-1},(a_{i},a^{\prime}_{i}))$ for $i\geq 1$.

Clearly if $w\leq w_{0}$ then $w$ satisfies limb (ii) of Definition 12, and so if also $w\in L(\mathcal{T})$ then $w$ is consistent with $\mathcal{T},x_{A}$ and $x_{B}$.

Conversely suppose that $w\not\leq w_{0}$. Then we have that $w=w^{\prime}(a,b)w^{\prime\prime}$ for some $w^{\prime}=((a_{1},a^{\prime}_{1}),(b_{1},b^{\prime}_{1}))\ldots\allowbreak((a_{k},a^{\prime}_{k}),(b_{k},b^{\prime}_{k}))\leq w_{0}$, some $w^{\prime\prime}\in\Sigma\times\Gamma^{*}$ and some $(a,b)\in\Sigma\times\Gamma$ with $(a,b)\neq((a_{k+1},a^{\prime}_{k+1}),(b_{k+1},b^{\prime}_{k+1}))$. But if $a\neq(a_{k+1},a^{\prime}_{k+1})$ then without loss of generality we have $\operatorname{fst}(a)\neq a_{k+1}=x_{A}((a_{1},b_{1})\ldots(a_{k},b_{k}))$ and so $w$ is not consistent with $x_{A},x_{B}$.

On the other hand if $b\neq(b_{k+1},b^{\prime}_{k+1})=\sigma(q_{k},(a_{k},a^{\prime}_{k}))$ then $w\notin L(\mathcal{T})$. Either way we have that $w$ is not consistent with $\mathcal{T},x_{A}$ and $x_{B}$. ∎

The intuition here is that having fixed $x_{A}$ and $x_{B}$, these uniquely determine the actions of Alice and Bob at each step given the outputs they are shown, and $\mathcal{T}$ determines those outputs uniquely based on the actions up to the current time.

Projecting $w_{0}$ onto $(\Sigma_{B}\times\Gamma_{B})^{\omega}$ gives

Corollary 14**.**

Let $\mathcal{T},x_{A}$ and $x_{B}$ be as above. There exists some $w_{0}\in(\Sigma_{B}\times\Gamma_{B})^{\omega}$ such that if $w\in(\Sigma_{B}\times\Gamma_{B})^{*}$ is consistent with $\mathcal{T},x_{A}$ and $x_{B}$ then $w\leq w_{0}$.

So can we have $Y=(\Sigma_{B}\times\Gamma_{B})^{\omega}$, and $p_{Y|X_{A},X_{B}}(y|x_{A},x_{B})=1$ for $y=w_{0}$ as in Corollary 14?

One reason why not is that this is not at all realistic: it corresponds to Bob being able to conduct an experiment lasting for an infinite time. Moreover it would allow Bob to acquire an infinite (or at least unbounded) amount of information, and it is not clear how this should be interpreted.

For this reason we will consider Bob’s interaction with the system not as a single experiment, but as a family of experiments, parametrised by the amount of time allowed; that is, by the length of traces which we consider as outcomes. Assuming for the moment that $F=Q$, we then have that the matrix $p_{Y|X_{A},X_{B}}$ is stochastic.

Proposition 15**.**

Let $\mathcal{T}$ be an SDFST with $F=Q$, and let $Y=(\Sigma_{B}\times\Gamma_{B})^{k}$ for some $k\in\mathbb{N}$. Let the matrix $p_{Y|X_{A},X_{B}}$ be defined by $p_{Y|X_{A},X_{B}}(y|x_{A},x_{B})=1$ if $y$ is compatible with $\mathcal{T},x_{A}$ and $x_{B}$, and 0 otherwise. Then $p_{Y|X_{A},X_{B}}$ is stochastic; that is, we have

[TABLE]

for all $x_{A}\in\mathcal{X}_{A}$ and $x_{B}\in\mathcal{X}_{B}$.

Proof.

By Corollary 14, we have that for fixed $x_{A},x_{B}$ there is at most one $y\in(\Sigma_{B}\times\Gamma_{B})^{k}$ which is consistent with $\mathcal{T},x_{A}$ and $x_{B}$. On the other hand it is clear from the definitions that if $F=Q$ then all prefixes of the infinite word $w_{0}$ from Proposition 13 are accepted by $\mathcal{T}$. Hence projecting $w_{0}$ onto $(\Sigma_{B}\times\Gamma_{B})^{k}$ gives a suitable $y$. ∎

Truncating at length $k$ also means that strategies $x_{A},x_{B}$ can be viewed as drawn from the spaces of functions $(\Sigma_{A}\times\Gamma_{A})^{<k}\rightarrow\Sigma_{A}$ and $(\Sigma_{B}\times\Gamma_{B})^{<k}\rightarrow\Sigma_{B}$ respectively. This means that the spaces $\mathcal{X}_{A}$ and $\mathcal{X}_{B}$ of possible strategies for Alice and Bob are also finite.

We can now apply Theorem 4 to calculate the information flow as the size of the largest possible set of outcomes that can consistently be seen by Bob, and for convenience we will adopt this as a definition.

Definition 16**.**

Let $\mathcal{T}$ be an SDFST over input and output alphabets $\Sigma_{A}\times\Sigma_{B}$, and let $\mathcal{X}_{A},\mathcal{X}_{B}$ be the spaces of functions $(\Sigma_{A}\times\Gamma_{A})^{*}\rightarrow\Sigma_{A}$ and $(\Sigma_{B}\times\Gamma_{B})^{*}\rightarrow\Sigma_{B}$ respectively. Define

[TABLE]

Observe that if $F=Q$ then by Theorem 4 we have that $\mathcal{L}_{k}(\mathcal{T})=\mathcal{L}_{\infty}(\mathcal{C})$, where $\mathcal{C}$ is the interactive channel defined by the matrix of conditional probabilities in the statement of Proposition 15.

What about the case where $F\subsetneq Q$? The treatment of this depends on what we consider to be the meaning of a run ending in a non-accepting state. One interpretation is that it represents a catastrophically bad outcome (say, the intruder being detected) which must be avoided. By Corollary 3 we may assume that Bob is employing a pure (i.e. non-random) strategy, and so Alice can ensure that non-accepting runs are avoided by avoiding particular $x_{A}$. This means that Definition 16 is exactly right for this interpretation.

Another possible interpretation is that a run ending in a non-accepting state produces some kind of ‘error’ output, where all errors are indistinguishable. This essentially increases the number of possible observations by Bob by either 1 or 0, depending on whether or not the extremal $x_{B}$ allows for non-accepting runs. This means that the amount of information is either $\mathcal{L}_{k}(\mathcal{T})$ or $\log(1+2^{\mathcal{L}_{k}(\mathcal{T})})$, which we consider to be a trivial difference.

A third possiblity of course is that we reject the very notion of a non-accepting run, and consider only SDFSTs with $F=Q$. Note that many kinds of behaviour which may involve the system going into an ‘error’ state and producing only a fixed ‘dummy’ output symbol can straightforwardly be modelled as an SDFST with $F=Q$.

Which of these three options the reader considers most satisfactory is, to some extent, a matter of personal taste. However, since as noted above all are modelled adequately by Definition 16, that is what we shall adopt as the basic definition for the remainder of this analysis.

Definition 16 is in some sense an intensional definition, in the sense that it involves directly considering all possible strategies for Alice and Bob. It will be helpful to have a more extensional version. Definition 16 can be recast as

[TABLE]

where $\mathcal{F}\subseteq\mathcal{P}((\Sigma_{B}\times\Gamma_{B})^{k})$ is the family of sets $X$ such that there exists some $x_{B}\in\mathcal{X}_{B}$ such that

[TABLE]

So having an extensional characterisation of $\mathcal{L}_{k}(\mathcal{T})$ amounts to having a condition for a set $X$ to be a member of $\mathcal{F}$.

Theorem 17**.**

Let $\mathcal{T},\mathcal{X}_{A}$ and $\mathcal{X}_{B}$ be as above. Let $\mathcal{F}\subseteq\mathcal{P}\left((\Sigma_{B}\times\Gamma_{B})^{*}\right)$ be defined by $Y\in\mathcal{F}$ if and only if there exists some $x_{B}\in\mathcal{X}_{B}$ such that

[TABLE]

Let $X\subseteq(\Sigma_{B}\times\Gamma_{B})^{*}$ be arbitrary. Then $X\subseteq X^{\prime}$ for some $X^{\prime}\in\mathcal{F}$ if and only if

1. (i)

$X\subseteq\left.L(\mathcal{T})\right\rvert_{(\Sigma_{B}\times\Gamma_{B})^{*}}$, and 2. (ii)

$X$* does not contain two elements which first differ by an element of $\Sigma_{B}$. That is, we do not have $w_{1},w_{2}\in X$ such that $w_{1}=w(a,b)w^{\prime}$ and $w_{2}=w(a^{\prime},b^{\prime})w^{\prime\prime}$ with $w,w^{\prime},w^{\prime\prime}\in(\Sigma_{B}\times\Gamma)^{*},a,a^{\prime}\in\Sigma_{B}$ and $b,b^{\prime}\in\Gamma_{B}$ with $a\neq a^{\prime}$,*

where the notation $\left.L(\mathcal{T})\right\rvert_{(\Sigma_{B}\times\Gamma_{B})^{*}}$ means the projection of $L(\mathcal{T})\subseteq((\Sigma_{A}\times\Sigma_{B})\times(\Gamma_{A}\times\Gamma_{B}))^{*}$ onto the set $(\Sigma_{B}\times\Gamma_{B})^{*}$.

Proof.

The ‘only if’ direction is straightforward. Part (i) is immediate from the definitions, and for part (ii) we must have $a=x_{B}(w)=a^{\prime}$ (for the relevant $x_{B}$).

For the ‘if’ direction, suppose that $X$ satisfies the two conditions in the statement of the theorem. Define the partial function $x:(\Sigma_{B}\times\Gamma_{B})^{*}\rightharpoondown\Sigma_{B}$ by $x(w^{\prime})=a$ whenever $w^{\prime}(a,b)\leq w$ for some $w\in X$ and some $b\in\Gamma_{B}$. This is well-defined by condition (ii). Define $x_{B}:(\Sigma_{B}\times\Gamma_{B})^{*}\rightarrow\Sigma_{B}$ to be $x$, extended arbitrarily where $x$ is undefined. We claim that

[TABLE]

Indeed, let $w\in X$ be arbitrary. Plainly $w$ is consistent with $x_{B}$. Since $w\in\left.L(\mathcal{T})\right\rvert_{(\Sigma_{B}\times\Gamma_{B})^{*}}$, there exists some $w^{\prime}\in L(\mathcal{T})$ such that $\left.w^{\prime}\right\rvert_{(\Sigma_{B}\times\Gamma_{B})^{*}}=w$. Define the partial function $x^{\prime}:(\Sigma_{A}\times\Gamma_{A})^{*}\rightharpoondown\Sigma_{A}$ by $x^{\prime}(w^{\prime\prime})=a$ whenever $w^{\prime\prime}(a,b)\leq w^{\prime}$ for some $b\in\Gamma_{A}$. Let $x_{A}:(\Sigma_{A}\times\Gamma_{A})^{*}\rightarrow\Sigma_{A}$ be an arbitrary total extension of $x^{\prime}$. Then plainly $w^{\prime}$ is consistent with $x_{A}$, and is also consistent with $x_{B}$ since $w$ was. Hence $w$ is consistent with $\mathcal{T},x_{A}$ and $x_{B}$, as required. ∎

Truncating to length $k$, and observing that

[TABLE]

gives

Corollary 18**.**

Let $\mathcal{T},\mathcal{X}_{A}$ and $\mathcal{X}_{B}$ be as above. Then we have

[TABLE]

where $\mathcal{F}^{\prime}_{k}\subseteq\mathcal{P}\left(\left.L(\mathcal{T})_{=k}\right\rvert_{(\Sigma_{B}\times\Gamma_{B})^{k}}\right)$ is the collection of sets which do not contain two words which first differ by an element of $\Sigma_{B}$ (and this has the same meaning as in part (ii) of Theorem 17).

III-C Reduction to automata

In this section, we show how to reduce the problem of computing $\mathcal{L}_{k}(\mathcal{T})$ from a problem about transducers to a problem which mentions only automata. The first step is to produce an automaton whose language is in correspondence with Bob’s interface with $\mathcal{T}$.

Definition 19**.**

Let $\mathcal{T}=(Q,q_{0},F,\Sigma_{A}\times\Sigma_{B},\Gamma_{A}\times\Gamma_{B},\delta,\sigma)$ be an SDFST. Define the nondeterministic finite automaton $\mathcal{A}_{\mathcal{T}}=(Q\cup(Q\times\Gamma_{B}),q_{0},F,\Sigma_{B}\cup\Gamma_{B},\Delta)$, where

[TABLE]

for all $q\in Q$ and $a^{\prime}\in\Sigma_{B}$, $\Delta(q,b^{\prime})=\emptyset$ for all $b^{\prime}\in\Gamma_{B}$, and

[TABLE]

for all $(q,b^{\prime})\in Q\times\Gamma_{B}$ and $x\in\Sigma_{B}\cup\Gamma_{B}$.

Informally, we introduce an auxiliary state for each pair $(q,b^{\prime})\in Q\times\Gamma_{B}$ to represent the behaviour ‘emit the event $b^{\prime}$ and then go into state $q$’. For states $q,q^{\prime}\in Q$ and events $a^{\prime}\in\Sigma_{B},b^{\prime}\in\Gamma_{B}$ we have a transition from $q$ to $(q^{\prime},b^{\prime})$ if and only there exist some $a\in\Sigma_{A}$ and $b\in\Gamma_{A}$ such that $\delta(q,(a,a^{\prime}))=q^{\prime}$ and $\sigma(q,(a,a^{\prime}))=(b,b^{\prime})$. In the language of Communicating Sequential Procceses, this corresponds to treating Alice’s behavious as nondeterministic and hiding all of her events: that is, the familiar lazy abstraction formulation of noninterference [13].

The following lemma is immediate from the definitions, and expresses the fact that the words accepted by $\mathcal{A}_{\mathcal{T}}$ are in precise correspondence with the words accepted by $\mathcal{T}$, projected onto $\Sigma_{B}\times\Gamma_{B}$.

Lemma 20**.**

Let $f:(\Sigma_{B}\times\Gamma_{B})^{*}\rightarrow(\Sigma_{B}\cup\Gamma_{B})^{*}$ be the flattening operation defined by $f((a_{1},b_{1})\ldots(a_{k},b_{k}))=a_{1}b_{1}\ldots a_{k}b_{k}$. Then we have

[TABLE]

Note that since elements of $\Sigma_{B}$ appear at odd-numbered positions in traces of $\mathcal{A}_{\mathcal{T}}$ and elements of $\Gamma_{B}$ appear at even-numbered positions, we may assume without loss of generality that $\Sigma_{B}$ and $\Gamma_{B}$ are disjoint. Then combining Lemma 20 with Corollary 18 gives

Theorem 21**.**

Let $\mathcal{T}$ be an SDFST as above such that $\Sigma_{B}$ and $\Gamma_{B}$ are disjoint. Then

[TABLE]

where $\mathcal{F}_{k}\subseteq\mathcal{P}\left(L\left(\mathcal{A}_{\mathcal{T}}\right)_{=2k}\right)$ is the collections of sets which do not contain two words which first differ by an element of $\Sigma_{B}$; that is, for $X\in\mathcal{F}_{k}$ we do not have $w_{1},w_{2}\in X$ with $w_{1}=waw^{\prime},w_{2}=wa^{\prime}w^{\prime\prime}$, with $w,w^{\prime},w^{\prime\prime}\in(\Sigma_{B}\cup\Gamma_{B})^{*}$ and $a\neq a^{\prime}\in\Sigma_{B}$.

Note that an alternative notation for this theorem (and, mutatis mutandis, Corollary 18) would be to define a single family $\mathcal{F}\subseteq\mathcal{P}\left((\Sigma_{B}\cup\Gamma_{B})^{*}\right)$ consisting of the sets which do not contain words first differing on an element of $\Sigma_{B}$, and then say that

[TABLE]

We have therefore reduced computing the information flow permitted by a deterministic interactive system to an instance of a more general problem over finite automata, which we call the $\Sigma$-deterministic subset growth problem.

Definition 22**.**

Let $\Sigma,\Gamma$ be disjoint finite sets. A set $X\subseteq(\Sigma\cup\Gamma)^{*}$ is $\Sigma$-deterministic if it does not contain two words which first differ by an element of $\Sigma$; that is, we do not have $w_{1},w_{2}\in X$ with $w_{1}=waw^{\prime},w_{2}=wa^{\prime}w^{\prime\prime}$, with $w,w^{\prime},w^{\prime\prime}\in(\Sigma\cup\Gamma)^{*}$ and $a\neq a^{\prime}\in\Sigma$.

For a nondeterministic finite automaton $\mathcal{A}$ over alphabet $\Sigma\cup\Gamma$, define

[TABLE]

where $\mathcal{F}_{k}$ consists of the $\Sigma$-deterministic subsets of $L(\mathcal{A})_{=k}$.

Problem 23** ($\Sigma$-deterministic subset growth).**

Given a nondeterministic finite automaton $\mathcal{A}$ over $\Sigma\cup\Gamma$, determine the growth rate of $D_{k}(\mathcal{A})$.

Of course, the statement of this problem is somewhat informal, in that the meaning of ‘determine the growth rate’ is not precisely specified. This is in some sense inevitable, considering that $D_{k}(\mathcal{A})$ is an infinite collection of values, so many types of results are possible. Below we will obtain results on the asymptotic growth of $D_{k}(\mathcal{A})$ as $k\rightarrow\infty$.

III-D Antichains

In this section we will see that Problem 23 can be further reduced, to that of computing the ‘width’ of $L(\mathcal{A})$.

Definition 24**.**

Let $X$ be a set, and let $\leq$ be a partial order on $X$. Then the lexicographic order induced by $\leq$ on $X^{*}$, denoted $\preceq$, is defined by

[TABLE]

Observe that $\preceq$ defines a partial order. Indeed, suppose that $w_{1},w_{2}\in X^{*}$ are of minimum total length such that $w_{1}\preceq w_{2},w_{2}\preceq w_{1}$ but $w_{1}\neq w_{2}$. Trivially if $w_{1}=\epsilon$ then also $w_{2}=\epsilon=w_{1}$ (and vice versa). Otherwise we have $w_{1}=xw,w_{2}=yw^{\prime}$, and either $x<y$ or $x=y$ and $w\preceq w^{\prime}$, and on the other hand either $y<x$ or $y=x$ and $w^{\prime}\preceq w$. Hence we have $y=x$ and both $w\preceq w^{\prime}$ and $w^{\prime}\preceq w$, so by induction $w=w^{\prime}$. Hence $w_{1}=w_{2}$, a contradiction, so indeed $\preceq$ is antisymmetric.

Similarly suppose that $w_{1},w_{2},w_{3}\in X^{*}$ are of minimum total length such that $w_{1}\preceq w_{2}$ and $w_{2}\preceq w_{3}$ but $w_{1}\not\preceq w_{3}$. Since $w_{1}\not\preceq w_{3}$ we have $w_{1}\neq\epsilon$, and plainly $w_{1}\neq w_{2}$ and $w_{2}\neq w_{3}$ and so $w_{2},w_{3}\neq\epsilon$. Write $w_{1}=xw,w_{2}=yw^{\prime}$ and $w_{3}=zw^{\prime\prime}$. If $x<y$ then (since $y\leq z$) we have $x<z$ and so $w_{1}\preceq w_{3}$. Similarly if $y<z$ then (since $x\leq y$) we have $x<x$ so $w_{1}\preceq w_{3}$. Hence we have $x=y=z$ and $w\preceq w^{\prime}$ and $w^{\prime}\preceq w^{\prime\prime}$. But then by induction we have $w\preceq w^{\prime\prime}$ and so $w_{1}\preceq w_{3}$, a contradiction. Hence indeed $\preceq$ is transitive and so (since we have also shown it is antisymmetric, and it is trivially reflexive) it is a partial order.

The study of partially ordered sets is often concerned with chains (sets wherein any two elements are comparable) and antichains (sets where no two elements are comparable).

Definition 25**.**

Let $X$ be a partially ordered set, partially orderd by $\leq$. A set $Y\subseteq X$ is a chain if for any $x,y\in Y$ we have $x\leq y$ or $y\leq x$. $Y$ is an antichain if for any $x,y\in Y$ such that $x\leq y$ we have $x=y$. Let $Y\subseteq X$ be an antichain of maximum size. Then $|Y|$ is the width of $X$, denoted $w(X)$.

An example of the relevance of the width of a partially ordered set to its structure is given by the celebrated theorem of Robert Dilworth [14].

Theorem 26** (Dilworth, 1950).**

Let $X$ be a partially ordered set. Let $k$ be minimal such that $X=Y_{1}\cup\ldots\cup Y_{k}$ with each $Y_{k}$ a chain. Then $k=w(X)$.

The relevance of these ideas to Problem 23 is established by the following theorem.

Theorem 27**.**

Let $\Sigma,\Gamma$ be disjoint sets. Define the partial order $\leq$ on $\Sigma\cup\Gamma$ by setting $\left.\leq\right\rvert_{\Sigma}$ to be an arbitrary linear order on $\Sigma$, and setting $x\not\leq y,y\not\leq x$ for all $x\in\Gamma$ and all $y\in\Sigma\cup\Gamma$ with $y\neq x$.

Let $X\subseteq(\Sigma\cup\Gamma)^{k}$ be arbitrary. Then $X$ is $\Sigma$-deterministic if and only if it is an antichain with respect to the lexicographic order induced by $\leq$.

Proof.

If $w_{1},w_{2}\in(\Sigma\cup\Gamma)^{k}$ first differ by an element of $\Sigma$, say $w_{1}=waw^{\prime}$, $w_{2}=wa^{\prime}w^{\prime\prime}$ with $a\neq a^{\prime}\in\Sigma$. Then without loss of generality $a<a^{\prime}$, so $w_{1}\preceq w_{2}$. Conversely, if $w_{1}\preceq w_{2}$, then write $w_{1}=wxw^{\prime},w_{2}=wyw^{\prime\prime}$ for some $x\neq y\in\Sigma\cup\Gamma$. But then we must have $x<y$, and hence $x,y\in\Sigma$ and so $w_{1},w_{2}$ first differ by an element of $\Sigma$. ∎

We have thus reduced Problem 23 to the problem of calculating the growth rate of the width of a regular language, with respect to this partial order, a special case of the following problem.

Problem 28** (Antichain growth for NFA).**

Given a nondeterministic finite automaton $\mathcal{A}$ over a finite partially ordered set $(\Sigma,\leq)$, determine the growth rate of $w\left(L(\mathcal{A})_{=k}\right)$, with respect to the lexicographic order.

The structure of the reductions in the preceding sections is shown in Figure 3.

Problem 28 is solved in [2], the relevant results of which are summarised in Theorem 29 (Theorems 16, 18, 25 and 28 of [2]).

Theorem 29**.**

Let $\mathcal{A}$ be an NFA over a partially ordered set $(\Sigma,\leq)$. Then we have the following:

1. (i)

The antichain growth of $L(\mathcal{A})$ is either polynomial or exponential. That is, we have either $w(L(\mathcal{A})_{=n})=O(n^{k})$ for some $k$ or $w(L(\mathcal{A})_{=n})=\Omega(2^{\epsilon n})$ for some $\epsilon>0$. 2. (ii)

There is a polynomial-time algorithm to determine whether a given $\mathcal{A}$ has polynomial or exponential antichain growth. 3. (iii)

In the case of polynomial antichain growth, we have that $w(L(\mathcal{A})_{=n})=\Theta(n^{k})$ for some integer $k$, and there is a polynomial-time algorithm to compute $k$ for a given automaton.

Combining Theorem 29 with the reduction shown in Figure 3 yields the main theorem of this work, that any SDFST has either logarithmic or linear min-entropy capacity, and there is a polynomial-time algorithm to distinguish the two cases (and determine the constant for logarithmic capacity).

Theorem 30**.**

Let $\mathcal{T}=(Q,q_{0},F,\Sigma_{A}\times\Sigma_{B},\Gamma_{A}\times\Gamma_{B},\delta,\sigma)$ be an SDFST. Then we have the following:

1. (i)

The min-entropy capacity $\mathcal{L}_{n}(\mathcal{T})$ is either logarithmic or linear. That is, we have either $\mathcal{L}_{n}(\mathcal{T})=O(\log n)$ or $\mathcal{L}_{n}(\mathcal{T})=\Theta(n)$. 2. (ii)

There is a polynomial-time algorithm to determine whether a given $\mathcal{T}$ has logarithmic or linear capacity growth. 3. (iii)

In the case of logarithmic capacity, we have that $\mathcal{L}_{n}(\mathcal{T})\sim k\log n$ for some integer $k$, and there is a polynomial-time algorithm to compute $k$ for a given SDFST.

Note in particular that the information flow capacity is bounded if and only if $w(L(\mathcal{A})_{=n})$ has polynomial growth of order 0.

Returning to the relay system shown in Figure 1 at the beginning of this section, it is easy to see that the corresponding automaton shown in Figure 2 has exponential antichain growth, since in particular its language contains the exponential antichain $(aa^{\prime}+ab^{\prime})^{*}$. We conclude that the system allows linear information flow, which is as expected since in $n$ steps Alice can transmit $n$ independent bits to Bob.

We claim that the cases of linear and logarithmic information flow can in some sense be interpreted as ‘dangerous’ and ‘safe’ respectively. That linear information flow is dangerous should require no explanation: it offers an adversary an exponential speedup over exhaustive guessing of a secret (for instance a cryptographic key). On the other hand, if the information flow in time $n$ is only proportional to $\log n$, then this offers the adversary at most a polynomial speedup over exhaustive guessing.

Of course it will not be appropriate in every situation to regard logarithmic antichain growth as ‘safe’, and for instance we may sometimes be more interested in the precise amount of information flow that can occur in a fixed time $n$. This is given by $w(L(\mathcal{A}_{\mathcal{T}})_{=n})$, which can be computed by a straightforward dynamic programming algorithm at the cost of determinising $\mathcal{A}_{\mathcal{T}}$; see p.89 of the author’s PhD thesis [15] for details. Whether there is an algorithm which is polynomial in $n$ and the size of $\mathcal{A}_{\mathcal{T}}$ (as an NFA) is an open problem.

III-E Example: a simple scheduler

We now illustrate the theory of the preceding two sections by applying it to analyse a simple scheduler. A resource is shared between Alice and Bob, and at each step Alice can transmit $a$, signifying that she wishes to use the resource, or $b$, signifying that she does not. She receives back either an $a^{\prime}$, signifying that she was succesful, or a $b^{\prime}$, signifying that she was not (if she did not ask to use the resource then she always receives a $b^{\prime}$). The interface for Bob is similar but with primed and unprimed alphabets reversed.

Initially, Bob has priority over the use of the system, and for as long as Alice transmits $b$ he retains it. However, as soon as Alice seeks to use the system by transmitting an $a$ she obtains priority and retains it for as long as she uses it continuously. As soon as she transmits a $b$ priority shifts back to Bob, who retains it for the remainder of the execution.

The transducer $\mathcal{T}$ corresponding to this system is depicted in Figure 4 (where missing arguments mean that the input from that user is ignored).

We can now apply Definition 19 to construct the corresponding automaton $\mathcal{A}$, which is shown in Figure 5. By Theorems 21 and 27 we have that $\mathcal{L}_{n}(\mathcal{T})=w(L(\mathcal{A})_{=k})$, where $L(\mathcal{A})$ is given the lexicographic order with the primed letters linearly ordered and the unprimed letters incomparable.

By the criteria in Theorems 16 and 28 of [2], this automaton has polynomial antichain growth of order 2, and so the system has logarithmic information flow, with $\mathcal{L}_{n}(\mathcal{T})\sim 2\log n$ (see Section 6.5.2 of [15] for a more detailed discussion). Note that this makes intuitive sense: Alice can choose when to start using the resource and when to stop, which she can do in $\binom{n}{2}=\Theta(n^{2})$ ways.

IV Nondeterministic, multi-agent and probabilistic

systems

In this section we describe some open problems relating to various generalisations of the deterministic, two-agent systems considered in Section III.

IV-A Nondeterministic systems

In Section III we considered only deterministic systems. More generally, however, we may be interested in systems which are nondeterministic:

Definition 31**.**

A synchronised nondeterministic finite-state transducer (SNDFST) is a 6-tuple $\mathcal{T}=(Q,q_{0},F,\Sigma,\Gamma,\Delta)$, where $Q,q_{0}$ and $F$ are as in the definition of DFST, and $\Delta\subseteq Q\times\Sigma\times Q\times\Gamma$ is the transition relation.

Similarly to before we say that $(a_{1}a_{2}\ldots a_{k},b_{1}b_{2}\ldots b_{k})\in\Sigma^{*}\times\Gamma^{*}$ is accepted by $\mathcal{T}$ if there exists a sequence of states $q_{1}\ldots q_{k}\in Q^{*}$ such that $q_{k}\in F$ and for every $0\leq i<k$ we have $(q_{i},a_{i},q_{i+1},b_{i})\in\Delta$. As before we will consider systems for which $\Sigma=\Sigma_{A}\times\Sigma_{B}$ and $\Gamma=\Gamma_{A}\times\Gamma_{B}$, representing the inputs and outputs of Alice and Bob respectively.

The question then arises of how the nondeterminism in the system should be interpreted. One option is to consider it is essentially ‘demonic’—that is, under the control of Alice and available to be used to convey information to Bob. This precisely corresponds to Definition 16, which can be adopted wholesale, and a construction similar to that in Definition 19 can be used to produce an NFA $\mathcal{A}_{\mathcal{T}}$ such that the capacity of $\mathcal{T}$ is equivalent to the antichain growth of $\mathcal{A}$. We therefore have that Theorem 30 holds also for nondeterministic systems interpreted in this way.

However, the assumption of demonic nondeterminism may in some circumstances be too pessimistic. In particular, it may sometimes be reasonable to assume that the way the nondeterminism is resolved depends only on the previous events, and not on Alice’s secret. Equivalently, we may imagine that the resolution of the nondeterminism is controlled by an ‘innocent’ third party who is isolated from both Alice and Bob (but is able to see their inputs and outputs). We thus have that if we can handle deterministic systems with multiple agents then we will be able to handle nondeterministic systems with this interpretation.

IV-B Multi-agent systems

We will model multi-agent systems as SDSFTs, as before, but now with

[TABLE]

for some $k$, where the $\Sigma_{i}$ and $\Gamma_{i}$ represent the inputs and outputs respectively to the $i$th ‘innocent’ agent. We will call such a system a $k$-SDSFT.

We will now require that the $k$ innocent agents choose distributions over strategies. An argument similar to Proposition 2 shows that we may assume that the innocent agents select deterministic strategies, and so we adopt a definition analagous to Definition 16.

Definition 32**.**

Let $\mathcal{T}$ be a $k$-SDFST. We define

[TABLE]

where $\mathcal{X}_{i}$ is the set of functions $(\Sigma_{i}\times\Gamma_{i})\rightarrow\Sigma_{i}$, and consistency is defined similarly to Definition 12.

Our first open problem is to compute the min-entropy capacity of a $k$-SDFST. We conjecture that there should still be a dichotomy between polynomial and exponential growth.

IV-C Probabilistic systems

We may also wish to handle systems whose behaviour is probabilistic. We model such systems as probabilistic finite-state transducers.

Definition 33**.**

A probabilistic finite-state transducer is a tuple $\mathcal{T}=(Q,q_{0},\Sigma,\Gamma,\Delta)$, where $Q$ is a finite set of states, $q_{0}\in Q$ is the initial state and $\Delta:Q\times\Sigma\times Q\times\Gamma\rightarrow\mathbb{R}^{\geq 0}$ is the transition function, such that for all $q\in Q$ and all $a\in\Sigma$ we have

[TABLE]

We interpret $\Delta(q,a,q^{\prime},b)$ as the probability that on receiving the input $a$ in state $q$, the system outputs $b$ and moves to state $q^{\prime}$.

As before we require that $\Sigma$ and $\Gamma$ are of the form $\Sigma_{A}\times\Sigma_{B}$ and $\Gamma_{A}\times\Gamma_{B}$ respectively (although of course it would also be possible to consider multi-agent probabilistic systems), and the sets $\mathcal{X}_{A}$ and $\mathcal{X}_{B}$ are as before. For fixed $x_{A}$ and $x_{B}$, the output $Y$ produced to Bob after $n$ steps is a sequence $y\in(\Sigma_{B}\times\Gamma_{B})^{n}$, where $y=((a^{\prime}_{1},b^{\prime}_{1}),\ldots,(a^{\prime}_{n},b^{\prime}_{n}))$ occurs with probability

[TABLE]

where $Z$ is the set of $((a_{1},b_{1}),\ldots,(a_{n},b_{n}))\in(\Sigma_{A}\times\Gamma_{A})^{n}$ such that $((a_{1},a^{\prime}_{1}),(b_{1},b^{\prime}_{1}))\ldots\allowbreak((a_{n},a^{\prime}_{n}),(b_{n},b^{\prime}_{n}))$ is consistent with $x_{A}$ and $x_{B}$.

This defines an interactive channel $\mathcal{C}_{n}$, and so our second open problem is to compute the growth of $\mathcal{L}_{\infty}(\mathcal{C}_{n})$. This seems to be a rather formidable challenge since we lack a way to reduce to a possibilistic view of Alice’s actions, and so we may genuinely have to quantify over probability distributions for $X_{A}$.

V Related work

So far as we are aware this is the first quantitative study which is able to analyse interactive systems in full generality, that is to say where inputs may be provided by both parties, according to distributions chosen adversarially so as to maximise information flow, rather than being specified as part of the system.

Mardziel, Alvim, Hicks and Clarkson in [16] consider interactive systems in essentially the same model as we use in Section III of this paper: they represent the system by a probabilistic finite automaton, which is executed in a ‘context’ consisting of the strategy functions for the high and low users. They then employ probabilistic programming to analyse particular systems with respect to particular contexts, demonstrating for instance that allowing an adaptive adversary can greatly increase information flow. However, they acknowledge that they are not able to analyse the maximum leakage over all possible contexts, instead observing that ‘We consider such worst-case reasoning challenging future work’. The present work addresses this question for the case where the system is deterministic.

Köpf and Basin in [17] show how to calculate information leakage for a particular model relating to side-channel attacks in which the attacker is repeatedly permitted to make queries drawn from some fixed set. They give an exhaustive algorithm to compute the maximum amount of information leakege after $n$ queries.

Boreale and Pampaloni in [18] consider the case of repeated queries issued by the attacker (possibly adaptively) to a stateless system and show that under certain reasonable assumptions the problem of computing the maximum leakage after $n$ queries is NP-hard. In [19], the same authors together with Paolini study the asymptotics of the leakage resulting from $n$ independent uses of a single channel for large $n$. This is in some sense dual to the situation we have considered, of the asymptotics of a single, long execution of a stateful system.

In [20], Andrés, Palamidessi, van Rossum and Smith compute the leakage of what they term ‘interactive information-hiding systems’ (IIHS), which are essentially automata over (secret) inputs and (observed) outputs. However, they assume an essentially passive attacker: apart from the values of the secret (whose distribution they sometimes allow to be chosen so as to maximise information flow), the system is assumed to follow known probabilistic behaviour. In follow-up work [21], Alvim, Andrés and Palamidessi demonstrate interesting connections between the mutual information capacity of such systems and the directed information capacity of channels with feedback, although this is of limited practical significance since it is now recognised that mutual information is not generally an appropriate measure of information flow.

An interesting alternative algorithmic approach is taken by Kawamoto and Given-Wilson in [22], although for a completely different problem from that addressed in this work. In [22], the authors consider a purely passive observer who is shown the outputs of two channels, interleaved according to some scheduler; the goal is to find a scheduler which minimises the information leakage. They show that this can be expressed as a linear programming problem, and therefore solved in time polynomial in the number of possible interleavings, which unfortunately is exponential in the number of possible traces.

VI Conclusions

In [3], Ryan, McLean, Millen and Gligor write the following:

Even at a theoretical level where timings are not available, and a bit per millisecond is not distinguishable from a bit per fortnight or a bit per century, a channel that compromises an unbounded amount of information is substantially different from one that cannot. Characterization of unbounded channels is suggested as the kind of goal that would advance the study of this subject

In Theorem 30 we have achieved this goal for deterministic systems, and in fact slightly more: we have shown that even among unbounded channels there is a dichotomy between ‘safe’ and ‘dangerous’ information flow, and this can be determined for a given system in polynomial time.

Having characterised the notion of safe versus dangerous information flow, one may ask about the question of enforcement of the safety criterion. In one sense this question is already answered by Theorem 30, since it includes a polynomial-time algorithm to determine whether the condition is satisfied for a given system. However, the development of automated tools implementing this algorithm, which preferably would allow realistic systems to be specified using more convenient notation than the rather abstract mathematical formalism of finite-state transducers, is certainly an important area for future work.

Acknowledgements

The author is grateful to Catuscia Palamidessi for helpful comments on an earlier version of this work, and to Dimiter Ostrev for comments on the final version.