Background
Evaluating the Risk of Information
Leakage in Security-Sensitive
Software Process
9th COE Postdoctoral and Doctoral Researchers
Technical Presentation
December 22nd , 2004

Some software development process have securitysensitive information.
Example of security-sensitive information:
 Secret Source code Personal data included in work products (e.g. test data)
 Secret keys of DRM (Digital Rights Management)
application
A slipshod management of secret information causes
leakage of personal data[1] or source code[2].

Yuichiro Kanzaki
Software Engineering Laboratory,
Graduate School of Information Science,
Nara Institute of Science and Technology[1] “Firms struggling to plug customer information leaks”, Mainichi Shimbun, March 2, 2004.
[2] “Microsoft's code leakage”, Conrante TechNews.,http://www.corante.com/openmind/archives/001884.php

Information leakage in Software Process

Goal and Approach

Information leakage in a software process can incur theproblems.

GoalTo propose a framework to evaluate the risk of theinformation leakage in software developing process
quantitatively.

Information Leakage (in a software process):knowledge transfer with irrelevant work products
Requirement……
……
Secret InfoSpecification
P1
DesignSpec・・・・・・・・・・・・・
EncodedSecret Info・・・・・・・・・・

Approach

CodeP2
Coding……
……

We formulate the problem of information leakage byintroducing a formal software process model.
 We present a method to compute a probability thateach developer knows each product.
……
……

Confidential

Alice

2/14

Alice Bob Chris

The probability reflects the risk that someone leaked
the product to the developer.

Specification
Secret Info ?

There are no methods to evaluate the risk of
information leakage.

3/14

4/14

Definition: Software Process Model

Definition: Knowledge of Developers

The model is based on the conventional
process-centered software engineering
environment[1].

knowledge： idea , mechanism or the product's document
itselfFunctions:

SubSpec2

SubSpec1
SubDesign1

SubDesign2

Knowledge of developers changes when a sub-process isperformed.
knowledge acquisition：
All developers ∈AS(P) know both I(P) and O(P).

{Dan}{Alice,Bob}
SubDesign1

Alice

SubDesign2
ProductX
P{Alice,Bob}

CombineSubdesign{Bob,Charles}

ProductY…

…

I(p) :input products of pO(p) :output products of pAS(p): developers engaging in p

{Alice}…

A software process consists ofa series of sub-processes．
Each sub-process has a set of
input products and a set ofoutput products.
Each sub-process has a set ofdevelopers.

ReqDocRequirement
Analysis

5/14

Bob
ProductX
ProductY

knowledge leakage：
All developers ∈ AS(P) tell others theknowledge of product in a certain probability.
Alice

Process Model Example[1] P. K. Garg and M. Jazayeri, Process-Centered Software Engineering Environments,
IEEE Computer Society Press, 1995.

ProductA
ProductX
ProductY

ProductA
ProductX
ProductY

Bob
ProductA
ProductX
ProductY

6/141

Knowledge Transfer Example

Product Knowledge

Developers’ Product Knowledge
SecretInfoAliceRequirement
DesignProduct Knowledge Pkn(u,p,w):
Probability that a developer u knows a work
product w at the completion of a process p

Chris

Requirement{Alice}SecretInfoSpecification
CodingBob

Specificati
on{Alice, Bob}

Code

Code{Bob, Chris}

Test…

Software Process Example: know
: have a chance to know
We want to derive a probability that eachdeveloper knows each product.

Know(u,p) : A set of product that u knows at the completion ofa process p
predu(p): A process that u performed just before performing pleak(ui, w, u): Probability that ui leaks w to uC(u,p) = 1 iff u ∈ AS(p), otherwise C(u,p) = 0

7/14

Example(1/3)

8/14

Example(2/3)
DesignSpec

Developer = { A, B, C, D, E}
Product = { DesignSpec, Rev-Spec, SecretInfo,
ModuleSpec, S-ModuleSpec, MainModule,
SecurityModule, ObjectCode }SubProcess = {Review, SecAnalysis, S-Design,
Coding1, Coding2, Integrate }{A}
Rev-Spec

DesignSpec

SecAnalysis

I(Review)={DesignSpec}
I(SecAnalysis)={Rev-Spec}I(S-Design)={SecretInfo}
I(Coding1)={ModuleSpec}
I(Coding2)={S-ModuleSpec}I(Integrate)={MainModule, SecurityModule}

ModuleSpec{A, B}{A,B}

O(Review)={Rev-Spec}
O(SecAnalysis)={ModuleSpec,SecretInfo}
O(S-Design) = {S-ModuleSpec}O(Coding1)={MainModule}
O(Coding2)={SecurityModule}
O(Integrate)={ObjectCode}Coding1{A, C}{B}
Main
ModuleAS(Review)={A}
AS(SecAnalysis)={A, B}
AS(S-Design)= {A, B}
AS(Coding1)={A, C}
AS(Coding2)={B}
AS(Integrate)={C, D, E}{C, D, E} :

A

B

C

1.00

0.01990.01 0.01

D

1.00

1.00

0.01

S-Design

SecretInfo

1.00

1.00

0.01 0.0001 0.0001

S-ModuleSpec

Module
Spec

1.00

1.00

1.00

Coding2

SModule
Spec

1.00

1.00

0.01 0.0001 0.0001

Security
ModuleMain
Module1.00

Security
ModuleIntegrate

Petri-Net Representation

1.00

ObjectCode

Rev-Spec

0.0001 0.0001

SecretInfo0.0001 0.0001

0.01

SecAnalysis
Module
Spec

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

{B}
Main
ModuleDesignSpec

1.00

0.0199 0.01

0.0001 0.0001

RevSpec

1.00

1.00

0.01

0.0001 0.0001

Secret
Info

1.00

1.00

0.01 0.0001 0.0001

1.00

0.01

Module
Spec

1.00

1.00

E

ObjectCode
10/141.00

1.00

0.01 0.0001 0.0001

Main
Module

1.00

0.00

1.00

1.00






1.00

Security
Module

0.00

1.00

1.00

1.00

1.00

Object
Code

0.00

0.00

1.00

1.00

1.00

Review

Rev-Spec
The processes performed by 5
developers (A, B, C, D, E)
ModuleOnly developers A and B areSpec
authorized to access SecretInfo
All processes must be performedby the effort of the total 10
Coding1
developers
At most 2 developers canconduct each process
Leak = 0.01
Main

An optimal assignment is anassignment that Risk isminimized.
Risk =
11/14

DesignSpecAssumption

0.01

SModuleSpec

Integrate

9/14

The probability reflects thepossibility that someone
leaked the knowledge of the
product to the developer.

Coding2
Security
Module{C, D, E} :We find an optimal assignmentof developers.

D

S-Design
S-ModuleSpec{A, C}

Product Knowledge (leak=0.01）
C

SecretInfo{A,B}

Case Study(1/2)

B{A, B}

Coding1

0.01

Example(3/3)
A

Review{A}

E

RevSpec

ObjectCode

Software Process Example

DesignSpec

Product Knowledge (leak=0.01)
Review

SecretInfo
S-Design
S-Module
Spec
Coding2
Security
ModuleModule∑ Pkn(u, integrate, SecretInfo)u∈{C , D , E }SecAnalysis:

Integrate
ObjectCode12/142

Case Study(2/2)
DesignSpec{A, C}

Conclusion and Future Work
DesignSpec

Review{A, B}

Rev-Spec
ModuleSpec{B}

SecAnalysis
SecretInfo
S-Design

ModuleSpec{C}
Main
Module{A}

Security
ModuleIntegrate

SecretInfo
S-Design{B, D}
Main
ModuleWe formulated the leakage as an unexpected transfer ofproduct knowledge.
 We proposed a method to derive the probability thateach developer knows each work product.

Coding2
Security
Module{A, C} :Future WorkIntegrateoptimal assignment (Risk = 0.00)

We have presented a method to evaluate the risk ofinformation leakage in software development process.
S-ModuleSpec

Coding1

Coding2



SecAnalysis{B}
S-ModuleSpec{A, E}

Coding1{D, E} :Conclusion

Rev-Spec{A, B}{A, B}

Review

Further evaluation with more practical processes
Investigation of the emerging application domainrisky assignment (Risk = 0.03)

More collaboration among authorized and unauthorizeddevelopers causes the higher risk of information leakage.

13/14

14/14

3