detecting cognitive causes of confidentiality leaks
Download
Skip this Video
Download Presentation
Detecting Cognitive Causes of Confidentiality Leaks

Loading in 2 Seconds...

play fullscreen
1 / 19

Detecting Cognitive Causes of Confidentiality Leaks - PowerPoint PPT Presentation


  • 265 Views
  • Uploaded on

Detecting Cognitive Causes of Confidentiality Leaks. Rimvydas Rukšėnas , Paul Curzon (Queen Mary, University of London) Ann Blandford (University College London). The topic.

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'Detecting Cognitive Causes of Confidentiality Leaks' - Donna


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
detecting cognitive causes of confidentiality leaks

Detecting Cognitive Causes of Confidentiality Leaks

Rimvydas Rukšėnas, Paul Curzon

(Queen Mary, University of London)

Ann Blandford

(University College London)

FMIS 2006, Macau

the topic
The topic
  • Ensuring (by formal modelling and verification) secure information flow from the user to a secure device / application.

FMIS 2006, Macau

the context
The context
  • Security of software systems (technical aspects):
    • the implementation of a system does not leak confidential information.
  • User-centred security (social dimensions):
    • work practices;
    • the relationships between system users;
    • security threats exploiting social engineering techniques.

FMIS 2006, Macau

our focus
Our focus
  • Potential leaks of information caused by the combination of human cognition and interface designs.

FMIS 2006, Macau

outline
Outline
  • Formal user model.
  • An example.
  • Conclusion.

FMIS 2006, Macau

formal user modelling
Formal user modelling
  • Even behaving rationally, humans systematically make errors when performing tasks with interactive systems.
  • The erroneous actions are unintentional. They emerge from a combination of specific design decisions and human cognition.
  • A formal model of cognitively plausible behaviour is helpful in detecting such design flaws.

FMIS 2006, Macau

abstract cognitive principles
Abstract cognitive principles
  • Non-determinism: any cognitively plausible action might be taken.
  • Distinction between mental and physical actions.
  • User goals: preconceived knowledge of the task and task dependent sub-goals.
  • Reactive behaviour: people respond to interface prompts, if these seem relevant to their task.
  • Goal based task completion: users tend to finish interactions once their goal has been achieved.
  • No-option based termination.

FMIS 2006, Macau

generic user model in sal
UserModel {goals,acts,…} =

TRANSITION

([]i: Goal_Commit: … )

[] ([]i: React_Commit: … )

[] ([]i: Goal_Transition: … )

[] ([]i: React_Transition: … )

[] Exit: …

[] Abort: …

[] Idle: …

Goal_Transition:

gcommit[i] = committed

Transition(i,goals);

gcommit’[i] = done;

gcommitted’ = FALSE

Generic user model in SAL

FMIS 2006, Macau

user goals knowledge
Enter user name.

Enter password.

seen[InputName]

value\' [InputName] = in.name

User goals (knowledge)

FMIS 2006, Macau

reactive behaviour
Enter user name.

Enter password.

Press Enterbutton.

Acknowledge a message.

seen[InputName] mem.failed 

mem.entered[InputName]

value\'[InputName] = in.name

Reactive behaviour

FMIS 2006, Macau

user perception interpretation
User perception & interpretation
  • By label:

(i,j): label[i] = NameLabel  label[j] = PassLabel  InputName = i InputPass = j

  • By habit:

(i,j): precedes(i,j) InputName = i InputPass = j

  • Random:

(label[i] = label[j] ((i,j): precedes(i,j))) 

InputName  InputPass

FMIS 2006, Macau

correctness properties
Correctness properties
  • Usability:System F(LoginMsg)
  • Security: System [] Tester G(SecurityBreach)
    • Testermodule:

[](j:Inbox): level[j] = Low  value[j] = env.password

SecurityBreach\' = TRUE

FMIS 2006, Macau

confidentiality leakage
Confidentiality leakage
  • precedes(InputName,InputPass)

FMIS 2006, Macau

secure design
Secure design
  • precedes(InputName,InputPass)

FMIS 2006, Macau

conclusions
Conclusions
  • We investigated the formal modelling of cognitive aspects of confidentiality leaks.
  • We extended our approach, based on usability verification, to address some aspects of information-flow security.
  • We presented a simple example where the layout of input fields can result in security breaches: www.dcs.qmul.ac.uk/~rimvydas/usermodel/fmis06.zip

FMIS 2006, Macau

future work
Future work
  • Other (more complex) security properties.
  • Generic user interpretation model.
  • Scaling-up.

FMIS 2006, Macau

ad