Quantification of Integrity

TLDR

Contamination measures the amount of untrusted information reaching trusted outputs, while suppression quantifies information lost from outputs, with only contamination having a confidentiality dual. The study examines the relationship between quantitative integrity, confidentiality, and database privacy. The authors introduce contamination and suppression integrity measures, with suppression further split into program suppression—loss of correct output information due to attacker influence and implementation errors—and channel suppression—loss of input information in noisy channel outputs.

Abstract

Two kinds of integrity measures-contamination and suppression-are introduced. Contamination measures how much untrusted information reaches trusted outputs; it is the dual of information-flow confidentiality. Suppression measures how much information is lost from outputs; it does not have a confidentiality dual. Two forms of suppression are considered: programs and channels. Program suppression measures how much information about the correct output of a program is lost because of attacker influence and implementation errors. Channel suppression measures how much information about inputs to a noisy channel is missing from channel outputs. The relationship between quantitative integrity, confidentiality, and database privacy is examined.