Characterizing dynamics of information leakage in security-sensitive software process

Authors:
Yuichiro Kanzaki;Hiroshi Igaki;Masahide Nakamura;Akito Monden;Ken-ichi Matsumoto
Affiliations:
Nara Institute of Science and Technology, Takayama, Ikoma, Nara, Japan;Nara Institute of Science and Technology, Takayama, Ikoma, Nara, Japan;Nara Institute of Science and Technology, Takayama, Ikoma, Nara, Japan;Nara Institute of Science and Technology, Takayama, Ikoma, Nara, Japan;Nara Institute of Science and Technology, Takayama, Ikoma, Nara, Japan
Venue:
ACSW Frontiers '05 Proceedings of the 2005 Australasian workshop on Grid computing and e-research - Volume 44
Year:
2005

Citing 6
Cited 1

Role-Based Access Control Models

Computer
The unified software development process

The unified software development process
Process-Centered Software Engineering Environments

Process-Centered Software Engineering Environments
Modelling with Generalized Stochastic Petri Nets

Modelling with Generalized Stochastic Petri Nets
Task-Based Authorization Controls (TBAC): A Family of Models for Active and Enterprise-Oriented Autorization Management

Proceedings of the IFIP TC11 WG11.3 Eleventh International Conference on Database Securty XI: Status and Prospects
Digital Rights Management for the Mobile Internet

Wireless Personal Communications: An International Journal

Modeling data flow in socio-information networks: a risk estimation approach

Proceedings of the 16th ACM symposium on Access control models and technologies

Quantified Score

Hi-index	0.00

Visualization

Abstract

Minimizing information leakage is a crucial problem in DRM software development processes, where security information (e.g., device keys and S-BOX of CPRM systems) must be rigorously managed.This paper presents a method to evaluate the risk of information leakage in a software process for security-sensitive applications. A software process is modeled as a series of sub-processes, each of which produces new work products from input products. Since a process is conducted usually by multiple developers, knowledge of work products is shared among the developers. Through the collaboration, a developer may tell others the knowledge of products that are not related to the process. We capture the transfer of such irrelevant product knowledge as the information leakage in a software process.In this paper, we first formulate the problem of information leakage by introducing a formal software process model. Then, we propose a method to derive the probability that each developer d knows each work product p at a given process of software development. The probability reflects the possibility that someone leaked the knowledge of p to d, unless it is equal to 1.0. We also conduct a quantitative case study to demonstrate how the information leakage varies depending on the assignment of developers.