Model for Quantifying the Quality of Secure Service

Abstract

Although not common today, communications networks could adjust security postures based on changing mission security requirements, environmental conditions, or adversarial capability, through the coordinated use of multiple channels. This will require the ability to measure the security of communications networks in a meaningful way. To address this need, in this paper, we introduce the Quality of Secure Service (QoSS) model, a methodology to evaluate how well a system meets its security requirements. This construct enables a repeatable and quantifiable measure of security in a single- or multi-channel network under static configurations. In this approach, the quantification of security is based upon the probabilities that adversarial listeners and disruptors may gain access to or manipulate transmitted data. The initial model development, albeit a snap-shot of the network security, provides insights into what may affect end-to-end security and to what degree. The model was compared against the performance and expected security of several point-to-point networks, and three simplified architectures are presented as examples. Message fragmentation and duplication across the available channels provides a security performance trade-space, with an accompanying comprehensive measurement of the QoSS. The results indicate that security may be improved with message fragmentation across multiple channels when compared to the number of adversarial listeners or disruptors. This, in turn, points to the need, in future work, to build a full simulation environment with specific protocols and networks to validate the initial modeled results.

1. Introduction

Communication networks rely on a series of wired or wireless channels between intermediate nodes. In addition to noise, these channels may be affected by any combination of three malicious attack vectors: Denial of Service (DoS), data injection, or eavesdropping. A DoS attack may involve cutting a wire or overpowering a particular frequency (jamming). A data injection, or spoofing attack, involves the adversary sending fabricated data that takes the place of actual data. Finally, and the most difficult to discover, is an eavesdropping attack, which involves an adversary intercepting and extracting useful information from the channel. Managing those threats requires an ability to accurately gauge the likelihood or severity of the threat, and adapt the security features available in the system to meet it.

This paper describes a mathematical model for quantifying the Quality of Secure Service (QoSS) deployed in static communications networks. Just as Quality of Service (QoS) metrics describe measurable aspects of the available network, QoSS describes, in measurable and repeatable terms, the security available to an end-user, facilitating meaningful comparisons.

Even when security is momentarily adequate in a communication system, security mechanisms tend to be static, implemented at installation or while running [1], and cannot be adjusted dynamically based on changing environmental conditions or adversarial capability. This document illustrates the mathematical framework and analysis to define the design requirements for networks and provides a foundation for subsequent work analyzing dynamic network security performance in the presence of varied environmental characteristics1. The final model demonstrates the probability of data surviving intact against multiple forms of adversarial actions.

2. Goals and Approach

The current literature suggests three primary characteristics that define the security of traditional Information Technology (IT) systems. These are confidentiality, integrity, and availability, i.e., the CIA triad [2,3]. To quantify an overall level of security, we must have objective metrics to represent each of these individual characteristics. While objective metrics for availability are well established as QoS metrics, confidentiality and integrity [4] remain rather subjective and without commonly accepted quantifiable definitions. In addition, the user requirements for security may change based on changing operational conditions. Then, what are the appropriate measures for communication security?

To address the need, we propose a model to quantify the security characteristics of point-to-point communication between two devices2. The model is patterned after existing quantification models [5,6], and helps to define security requirements that, in the presence of adversarial actions, would enable communications to be successful. By comparison, this model does not rely on the application of security controls [7], but rather the analysis of the system architecture and probabilistic aspects of the network.

3. Components of a Security Model

According to Lundin [1], an equation to describe the tunable security for a communication system could be

$$TS:T\times Env\to R$$

(1)

where $TS$ is the tunable security, which may be dynamically adjusted based on the user security requirements. The transmitter capabilities3 are represented by T, the environmental descriptions are represented by $Env$, and the overall system security requirements are represented by R. The goal is to map the tunable security services to the system security requirements. To achieve this, the tunable security services must first be decomposed into the constituent parts, such as the available number of channels, the use or disuse of encryption, and the amount of fragmentation across the network. In many cases, the environmental descriptions are directly reflected in the traditional QoS measurements available from the service provider.

This initial version of the QoSS model is a static snap-shot, reflecting the system security at one point in time. The multiplication operator in Equation (1) does not adequately address the numerous non-linear relationships between system capability and environmental aspects. Instead, QoSS captures those factors as an array of features or values and then relates the transmitter capabilities and the environmental description to the CIA triad, where confidentiality, C, and integrity, I, replace the transmitter capabilities, and availability, A, replaces the environmental descriptors.

Security measures are typically subjective. To achieve objectivity, we substitute measurements of confidentiality and integrity with the probability of each, designated as $P(C)$ and $P(I)$, respectively, as discussed in subsequent sections. Although it is unconventional to consider a DoS attack as impacting data integrity (described in subsequent sections), doing so has the added benefit of collecting all adversarial influences into the metrics for confidentiality and integrity, leaving only the system and network capabilities to be considered as availability. Availability is a specific set of objective performance metrics, or QoS, provided by the transmitter, e.g., data or bit rate, jitter, bandwidth, transmission frequency, or power. The resulting QoSS equation is

$$QoSS:[P(C),P(I),A]\to SecurityRequirements$$

(2)

representing a snapshot of QoSS metrics mapped to the security requirements. If the array of metrics does not directly map to the security requirements, then the QoSS for that network is inadequate, and the system must be redesigned. The array of metrics also provides a foundation to perform one-to-one comparisons between two networks.

3.1. Probability of Confidentiality

Numerous researchers have attempted to quantify confidentiality with varying success [8,9]. Confidentiality is the aspect of a network that protects against unauthorized message receipt, i.e., preventing an eavesdropper from either receiving or decoding messages. One approach to quantifying confidentiality is to redefine it as a probability so that

$$P(C)=1-P(l)$$

(3)

where $P(C)$ is the probability of confidentiality and $P(l)$ is the probability of leakage. Leakage refers to an untrusted listener having access to an “information flow from secret inputs to public outputs” [10]. Inspired by Perfectly Secure Message Tranmission (PSMT) [11], the set of all adversarial listeners, $A_L$, maps to a set of wires (channels), $\sigma$, that the listeners have access to; if one of the members of $A_L$ has access to the information, then the probability of leakage exists.

For leakage to occur, a listener must intercept the message, decrypt it (if applicable), and then decode the data contained in the message. The probability of interception, $P(int)$, quantifies the probability that a listener with channel access will receive the message. The probability of decryption, $P(dcr)$, quantifies the probability that the adversary will decrypt it4. Finally, the probability of decoding, $P(dco)$, quantifies the probability that an adversary will decode the message5.

Consider the relationship between the probabilities of interception, decryption, and decoding. For data leakage to occur, an adversary must be able to achieve all three actions, i.e., decryption is irrelevant if the adversary is unable to receive any messages. Conversely, receiving every transmission ever sent is irrelevant if an adversary is unable to decrypt or decode the messages. The logical binary relationship of how $P(l)$ relates to $P(int)$, $P(dcr)$, and $P(dco)$ is captured in

Table 1. Logical binary relationship for the probability of leakage.

P(int)	P(dcr)	P(dco)	P(l)
0	0	0	0
0	0	1	0
0	1	0	0
0	1	1	0
1	0	0	0
1	0	1	0
1	1	0	0
1	1	1	1

. The proposed equation to describe $P(l)$ in terms of $P(int)$, $P(dcr)$, and $P(dco)$ is

$$P(l)=P(int)\times P(dcr)\times P(dco).$$

(4)

3.2. Probability of Integrity

Quantifying integrity is equally challenging. Integrity is a measure of the consistency, accuracy, and trustworthiness of data. Integrity implies that data has not been changed by unauthorized users in transit. One method of quantifying integrity is the “prevention of unauthorized modification of information” [10]. Under this assumption, unauthorized modification is corruption, resulting in

$$P(I)=1-P(c)$$

(5)

where $P(I)$ is the probability of integrity and $P(c)$ is the probability of corruption. Corruption here captures any damage to integrity yielding “two notions of corruption ” where the “first leads us to a measure that we call contamination” and the “second leads us to ... suppression” [10]. Contamination may arise from adversarial action, injection, or non-adversarial input, noise. Further, an adversary may carefully inject portions of false data (a spoofing attack), inject massive amounts of false data to disable communications (the traditional DoS attack), or overtly jam a message with a false signal (traditional RF jamming).

Therefore, we choose to classify DoS attacks as being an attack on the integrity of the data or message, not as an attack on the availability of the network. Again, inspired by PSMT [11], the set of all adversarial disruptors, $A_D$, maps to a number of wires, $\rho$, that the disruptors have access to; if one of the members of $A_D$ has access to the information, then the probability of corruption exists.

We, therefore, posit that corruption has three components: noise, data suppression, and data injection. The probability of noise occurring in a message, $P(n)$, is the probability that a message will be adversely affected by noise. Noise is a natural phenomenon that happens regardless of the transmitter’s capability. The probability of suppression, $P(s)$, quantifies the probability that an adversary will suppress or jam the message, thus, preventing the receiver from obtaining the message6. Finally, the probability of injection, $P(inj)$, quantifies the probability that an adversary will inject false data into the message. $P(inj)$ requires the ability to insert malicious data into a data stream, a much more sophisticated activity than that of jamming7. Since noise is a natural phenomenon, it is consistently present and may influence $P(s)$ and $P(inj)$. Noise works cooperatively with $P(s)$ since both cause the receiver to incorrectly receive the intended message. Based on these probabilities, the logical binary relationship for $P(c)$ is shown in

Table 2. Logical binary relationship for the probability of corruption.

P(n)	P(s)	P(inj)	P(c)
0	0	0	0
0	0	1	1
0	1	0	1
0	1	1	1
1	0	0	1
1	0	1	1
1	1	0	1
1	1	1	1

and reflected as

$$1-P(c)=\left(1-P(n)\right)\times \left(1-P(s)\right)\times \left(1-P(inj)\right).$$

(6)

Equation (6) does not adequately capture the behavior of the system. Noise may be detrimental to data injection, making the injected data unusable. Due to the interaction between $P(n)$ and $P(inj)$, namely that noise affects both intended and malicious transmissions, a more comprehensive equation is

$$\begin{array}{cc}\hfill P(c)=& \left(\left(1-P(n)\right)\times P(inj)\right)+\left(P(n)+P(s)\right)-\left(P(n)\times P(s)\right)\hfill \\ \hfill & -\left(\left(1-P(n)\right)\times P(inj)\times \left(P(n)+P(s)\right)\right).\hfill \end{array}$$

(7)

While less elegant than Equation (6), Equation (7) provides realistic results that account for all probabilities between 0 and 1 for each of the factors.

3.3. Availability

Methods exist for assessing and improving the performance of a system based on QoS measures [12]. For the QoSS model, the metrics used to describe availability are already conveyed in the QoS metrics. This is reflected as $A=QoS$, where QoS is the set of metrics that include cost, jitter, latency, bandwidth, and bit rate, which already provide a repeatable method of measuring availability.

3.4. Multiple Channels

Using multiple channels can improve the performance of data-in-transit in diverse ways. A straightforward example is directly increasing the data rate, such that additional channels provide more bandwidth, e.g., channel bonding within IEEE 802.11 [13,14,15,16]. Another example is frequency hopping through multiple channels, which is one of several techniques known as the spread spectrum and which provides protection from noise or jamming as the signal is “spread across a channel greater than that necessary to transmit the information” [17]. This technique is currently used in Bluetooth, and such transmission diversity is also a key element of 5G wireless [18,19].

An example of data-at-rest performance improvement through multiple channels is found in the Redundant Array of Inexpensive Disks (RAID) architecture. Developed in 1987, RAID demonstrated that by utilizing redundancy, an array could be more reliable than any one disk drive while allowing greater data throughput (In a RAID array, data is split across various disks so that if one disk should fail, the data may be fully recovered despite not having all the original blocks of data. Various combinations of nested RAID levels may be used to reduce the vulnerabilities of simultaneous disk failures [20]. The data may also be encrypted before or after splitting, or both, as a manner of increasing confidentiality.). Despite significant overhead, the ability to survive disk failures has made it very attractive in critical server environments.

Many applications in control systems maintain separate channels for data and control. For example, in SS78, the signaling path is separate and distinct from the voice channels that carry the telephone conversation. Having different channels, at different frequencies and differing bandwidths, allows for greater flexibility and higher-speed communications between network assets without the need to rely upon the availability or limitations of analog voice channels (In reality, these two channels are not entirely separated. The dual-tone, multi-frequency (DTMF) digits dialed by a caller begin within the voice channel, but are recognized by the control channel and are an example of the signaling messages, including dialing a phone number, entering control functions like call-forwarding, or advanced billing information [21,22]).

An abstract form of multi-channel communication is two-factor authentication (2FA), a subset of multi-factor authentication. This is an authentication methodology that requires a user to present two or more pieces of evidence to confirm the user’s identity via separate delivery paths9 [23]. By using multiple authentication factors sent via divergent paths, the likelihood that both messages are intercepted decreases. Even if a malicious actor intercepts one factor, full authentication by the malicious actor cannot occur without intercepting the other. Numerous other forms of 2FA also exist [24].

Central to the theme of this paper, multiple channel architecture may also be used to improve security through data fragmentation across heterogeneous channels [25,26,27,28]. This security focused capability, in concert with the performance advantages of multi-channel communications, is the motivation for creating a tunable multi-channel communication protocol and associated analysis techniques to determine the appropriate trade-offs under varying security and performance requirements.

4. The Quality of Secure Service Model

Although a communication network typically uses only one network channel between two given nodes, the possibility exists to utilize multiple paths between nodes, as shown in Figure 1. This figure shows an arbitrary network with eight individual channels, any of which may be used to transport data. A message sent through the network in Figure 1 may travel across one of the channels influenced by the set of adversarial listeners, $A_L$, or the set of adversarial disruptors, $A_D$.

The relationship between listeners, disruptors, and the total number of needed channels is described by PSMT, which “abstract[s] away the network entirely and concentrate[s] on solving the Secure Message Transmission Problem” for a single transmitter and receiver pair [11]. Additional articles explore multi-channel architectures [29,30], while others strive to prove the general case and optimize the statistical reliability and secrecy [31,32].

In our model, $\sigma$ represents the number of wires (channels) between the transmitter and receiver available to the adversarial listener set, $A_L$, and $\rho$ is the number of channels between the transmitter and receiver available to the adversarial disruptor set, $A_D$10. Communication is two-way between the transmitter and receiver and, following PSMT, the number of channels that must exist between transmitter and receiver is given by

$$n\ge max\{\sigma +\rho +1;2\rho +1\}.$$

(8)

With this equation, we know how many channels must be used to maintain secure and reliable communication. If a channel is unavailable, then it must not be counted as part of n. If we assume the number of channels accessible to a listener or disruptor, then we can arrive at a specific quantification of n. For example, when $n=8$ and $\sigma =3$, the probability that any one channel of the eight could be listened to is $0.375$. The probability of leakage for each channel within a multi-channel architecture becomes

$$P(l)=\frac{P(int)·P(dcr)·P(dco)·\sigma }{n}.$$

(9)

Similarly, the probability of corruption for each channel within multi-channel architecture becomes

$$P(c)=\frac{\left(\begin{array}{c}\hfill \left(1-P(n)\right)P(inj)+\left(P(n)+P(s)\right)-\left(P(n)P(s)\right)\\ \hfill -\left(1-P(n)\right)\left(P(n)+P(s)\right)P(inj)\end{array}\right)\rho }{n}.$$

(10)

Therefore, the more channels there are in a network, the lower the probability of adversarial interference of the data11. This, then, follows the premise of PSMT: to have more channels than the combined set of listeners and disruptors $A_L$∪$A_D$.

In the same manner that multiple channels may thwart adversarial interference, message fragmentation may also thwart eavesdropping. Message fragmentation is the splitting of data across the available channels, effectively parallelizing the data. Fragmentation describes how many portions the original message is divided into. Various methods of fragmentation are possible, including uniform or non-uniform fragmentation from 1-bit to the total m-bits in message M. Research has been published on particular approaches to fragmentation [28,33]; however, in this paper, we focuse on the security effects and apply the assumption that fragments are of equal size across the network. If $C_n$ is the set of n channels, and $F_M$ is the set of k fragments of $1\le |f_i|\le m$-bits of the message M, then

$$F_M=\{f_{(M,1)},f_{(M,2)},f_{(M,3)},\cdots ,f_{(M,k)}\}$$

(11)

$$f_{(M,i)}\subseteq Mfor1\le i\le k$$

(12)

where each fragment is unique. The channel load, L, is the percentage of M on a particular channel j, such that

$$L_{(j,M)}=\frac{{\sum }_{i=1}^n\left|f_i\right|for{f}_i\in C_{(j,M)}}{\left|M\right|}$$

(13)

and the Average Loading (AL) for the set of channels is

$$A{L}_M=\frac{{\sum }_{i=1}^n{L}_{(j,M)}}{n}.$$

(14)

For example, $F_M=\{f_1,f_2,f_3,f_4,f_5,f_6,f_7,f_8\}$ is the set of eight fragments of message M on a network that has $n=8$ channels, and each channel transmits two fragments. Therefore, $AL=0.25$. Message fragmentation also allows for duplicating data across channels. The Duplication Factor (DF) measures the average number of times a given fragment is transmitted, indicating the network redundancy. The DF may increase as compensatory tuning for known adversarial interactions. For the previous example, $DF=2$, since each fragment is sent across two channels and, thus, duplicated twice. For these calculations of DF and AL, the fragment sizes are uniform.

The AL and DF directly affect $P(C)$ and $P(I)$. Of the constituent parts of $P(C)$, $P(int)$ is only affected by DF in aggregation across all channels because the probability of interception of a single channel is not necessarily improved by duplication or fragmentation. However, $P(int)$ may be increased by the message M being duplicated across multiple channels, offering an adversary more opportunities to intercept portions of the message.

Therefore, DF is only multiplied by $P(int)$ when averaging all the channels into a composite probability of leakage. For the constituent parts of $P(I)$, duplication directly affects $P(s)$ because sending fragments multiple times decreases the probability of lost data through suppression. $P(n)$ and $P(inj)$ are not directly influenced by duplication. Thus, $P(s)$ is divided by $DF$ for each channel, giving

$$P(c)=\frac{\left(\begin{array}{c}\hfill \left(1-P(n)\right)P(inj)+\left(P(n)+\frac{P(s)}{DF}\right)-\left(P(n)\frac{P(s)}{DF}\right)\\ \hfill -\left(1-P(n)\right)\left(P(n)+\frac{P(s)}{DF}\right)P(inj)\end{array}\right)\rho }{n}.$$

(15)

Fragmentation does not necessarily increase or decrease $P(s)$ except that it allows for duplication. However, fragmentation does directly affect $P(inj)$ since each fragment sent needs to be modified by the adversary in order to have malicious data accepted at the receiver. Thus, $P(inj)$ is multiplied by AL for each channel, giving

$$P(c)=\frac{\left(\begin{array}{c}\hfill \left(1-P(n)\right)P(inj)AL+\left(P(n)+\frac{P(s)}{DF}\right)-\left(P(n)\frac{P(s)}{DF}\right)\\ \hfill -\left(1-P(n)\right)\left(P(n)+\frac{P(s)}{DF}\right)P(inj)AL\end{array}\right)\rho }{n}.$$

(16)

Applying the PSMT and decomposing the network into constituent channels yields

$$QoSS:\left[\begin{array}{ccc}{P}_1(C),& P_1(I),& Qo{S}_1\\ P_2(C),& P_2(I),& Qo{S}_2\\ ⋮& ⋮& ⋮\\ P_n(C),& P_n(I),& Qo{S}_n\end{array}\right]\to SecReqs,$$

(17)

which highlights that each channel has its own characteristics. From the end-user perspective, only the aggregated QoSS for the entire network is apparent. With insight into each channel’s QoSS, an analyst may suggest a different quantity of channels, different fragmentation or duplication, or a different encoding or encryption algorithm if adversarial actors attempt to influence communications.

5. Case Studies of Multi-Channel QoSS

The three example networks presented here are used to highlight the initial estimates and are intended to be refined as the network understanding is increased. For simplicity, the probabilities used in the following examples are discrete values; however, any value between 0 and 1 is possible. In developing the QoSS model, estimating the intermediate values is a challenge. As a starting point, 0 may be used for a network that has absolutely no encryption, 0.5 may be used for a system that has minimal or sub-standard encryption, and 1 may be used for a system that employs strong encryption.

Incremental changes may be employed as desired or as needed after a baseline understanding is developed, much like understanding the incremental difference between AES-128 and AES-256, or the difference between DES, triple-DES, and AES. The primary goal of the initial model development is to apply estimates for each of the constituent elements as implied by [34]. Further refinement of those estimates may be applied after more thorough system analyses.

During the early stages of analysis, the difference between a probability of 0.76 and 0.77 remains undefined and the numbers tend to be more arbitrary. This serves to assign a starting point for analysis, thus, establishing a baseline. Given the three example networks that follow and some initial probabilistic estimates for the various characteristics, the QoSS model is applied. Each case has a realistic configuration that allows for one-to-one comparison.

5.1. Single-Channel Network

The first example is a network that utilizes a single wireless channel to provide a realistic baseline. With $n=1$, there is $\sigma =1$ listener, and $\rho =1$ disruptor. $AL=1$ because the message cannot be split, and $DF=1$ since, for this architecture, the message is only sent once.

Table 3. Input and output values for a single-channel network.

Channel	$\mathit{P}(\mathit{int})$	$\mathit{P}(\mathit{dcr})$	$\mathit{P}(\mathit{dco})$	$\mathit{P}(\mathit{l})$	$\mathit{P}(\mathit{C})$	$\mathit{P}(\mathit{n})$	$\mathit{P}(\mathit{s})$	$\mathit{P}(\mathit{inj})$	$\mathit{P}(\mathit{c})$	$\mathit{P}(\mathit{I})$
1	0.5	1	1	0.5	0.5	0.25	1	0.33	0.9381	0.0619

shows notional probabilities for a network that has no encryption, standard data encoding, and a moderate probability of interception because it uses a standard broadcast frequency and a moderately strong broadcast signal, which also results in a low probability of noise.

We assign a high probability of suppression under the assumption of an omnidirectional receiver, susceptible to jamming. The probability for injection is moderately high, though not as high as the probability of suppression, because injection is more challenging than suppression. These values serve as a baseline to demonstrate the effects of multiple channels in the subsequent examples.

Based on these constraints, the single-channel network has a high probability of leakage, with a corresponding probability of confidentiality. The probability of corruption is also very high, with a correspondingly low probability of integrity. These probabilities may be improved by using encryption and by using directional receivers or a wired connection.

5.2. Three-Channel Network

The second example applies PSMT to the communication architecture, and demonstrates the initial application of multiple channels. In this example, the communication network uses three discrete, heterogeneous channels to communicate between the transmitter and the receiver. For this example, $n=3$, $\sigma =1$ listener, and $\rho =1$ disruptor. One difference between the single channel case and the three-channel case is the AL. The original message is fragmented into three equal portions, $f_1$, $f_2$, and $f_3$, which are each transmitted twice as follows: $\{f_1,f_2\}$ on Channel 1, $\{f_2,f_3\}$ on Channel 2, and $\{f_3,f_1\}$ on Channel 3. For this case $AL=0.66$, and $DF=2$ (because each fragment is sent twice).

Table 4. Input and output values for a three-channel network.

$\mathit{Channel}(\mathit{n})$	${\mathit{P}}_{\mathit{n}}(\mathit{int})$	${\mathit{P}}_{\mathit{n}}(\mathit{dcr})$	${\mathit{P}}_{\mathit{n}}(\mathit{dco})$	${\mathit{P}}_{\mathit{n}}(\mathit{l})$	${\mathit{P}}_{\mathit{n}}(\mathit{C})$	${\mathit{P}}_{\mathit{n}}(\mathit{n})$	${\mathit{P}}_{\mathit{n}}(\mathit{s})$	${\mathit{P}}_{\mathit{n}}(\mathit{inj})$	${\mathit{P}}_{\mathit{n}}(\mathit{c})$	${\mathit{P}}_{\mathit{n}}(\mathit{I})$
1	0.5	1	1	0.1667	0.8333	0.25	1	0.33	0.2219	0.7781
2	0.75	1	1	0.2500	0.7500	0.25	1	0.4	0.2248	0.7752
3	0.25	1	1	0.0833	0.9167	0.25	1	0.26	0.2191	0.7809
Avg	0.5	1	1	0.1667	0.8333	0.25	1	0.33	0.2219	0.7781

shows the theorized characteristics for a network with various probability of interception and fixed values for probability of decryption and decoding. Additionally, Table 4 shows that the network has various probabilities of injection with fixed values for probability of noise and suppression.

Channel 1 has identical input factors to the single-channel network as demonstrated in Table 3; however, the message is fragmented across multiple channels, which causes the probability of confidentiality and probability of integrity to increase, not only for Channel 1, but for each channel in the network12. The average probability of confidentiality is 0.83 even without encryption, indicating that fracturing data across the multiple channels improves the probability of confidentiality and over-all QoSS, partially mitigating the lack of encryption.

5.3. Eight-Channel Network

The third example presents a communication network with eight discrete, heterogeneous channels. In this example, $n=8$, $\sigma =3$ listeners, and $\rho =3$ disruptors. The original message is fragmented into eight equal portions, $\{f_1,f_2,...,f_8\}$, of which $\{f_1,f_2\}$ are transmitted on Channel 1, $\{f_2,f_3\}$ on Channel 2, $\{f_3,f_4\}$ on Channel 3, and so on. Here, $AL=0.25$, and $DF=2$ because each fragment is sent twice.

Table 5. Input and output values for an eight-channel network.

$\mathit{Channel}(\mathit{n})$	${\mathit{P}}_{\mathit{n}}(\mathit{int})$	${\mathit{P}}_{\mathit{n}}(\mathit{dcr})$	${\mathit{P}}_{\mathit{n}}(\mathit{dco})$	${\mathit{P}}_{\mathit{n}}(\mathit{l})$	${\mathit{P}}_{\mathit{n}}(\mathit{C})$	${\mathit{P}}_{\mathit{n}}(\mathit{n})$	${\mathit{P}}_{\mathit{n}}(\mathit{s})$	${\mathit{P}}_{\mathit{n}}(\mathit{inj})$	${\mathit{P}}_{\mathit{n}}(\mathit{c})$	${\mathit{P}}_{\mathit{n}}(\mathit{I})$
1	0.5	1	1	0.1875	0.8125	0.25	1	0.33	0.2402	0.7598
2	0.75	1	1	0.2813	0.7188	0.25	1	0.4	0.2414	0.7586
3	0.25	1	1	0.0938	0.9063	0.25	1	0.26	0.2389	0.7611
4	0.2	1	1	0.0750	0.9250	0.25	1	0.05	0.2353	0.7647
5	0.35	1	1	0.1313	0.8688	0.25	1	0.1	0.2361	0.7639
6	0.4	1	1	0.1500	0.8500	0.25	1	0.2	0.2379	0.7621
7	0.7	1	1	0.2625	0.7375	0.25	1	0.6	0.2449	0.7551
8	0.85	1	1	0.3188	0.6813	0.25	1	0.7	0.2467	0.7533
Avg	0.5	1	1	0.1875	0.8125	0.25	1	0.33	0.2402	0.7598

shows the theorized input for the eight-channel network.

Of particular note, Table 5 has the same input as Table 4 for Channels 1–3, and other values for Channels 4–8, although with different results13. The only difference from the three-channel case is that, with eight channels, the message is fragmented across more channels, causing the confidentiality and integrity to increase. The average values for $P(int)$, $P(dcr)$, and $P(dco)$ are the same for the single-channel, three-channel, and eight-channel networks, although the average $P(l)$ and $P(C)$ are notably different.

As expected, the single-channel network has the lowest theorized QoSS values. With a slightly higher percentage of listeners, the eight-channel network has a slightly higher $P(l)$ and correspondingly lower $P(C)$ than the three-channel network14. Similarly, the average values for $P(n)$, $P(s)$, and $P(inj)$ are the same for the single-channel, three-channel, and eight-channel networks, yet the $P(c)$ and $P(I)$ are significantly different.

5.4. Implications of Results

The most difficult aspect of developing the QoSS metrics is making assumptions about the network characteristics. For these examples, we began with an assumption that $P(dcr)=1$ was a baseline value that an adversary would be able to access all critical data. What does this mean for $P(dcr)=1$? Perhaps the assumption implies that no encryption is used, despite the fact that the use of encryption is strongly encouraged for all communications systems.

Similarly, is this possible for $P(dcr)=0$? This assumption implies that the encryption is unbreakable at this time and under these communication and environmental conditions. The fact that we do not know the adversary’s fullest capabilities, nor do we know the adversary’s intentions, are considerations that must be included, within a range, in the estimate for the probabilistic aspect of our metrics. More accurately, we estimate what is possible within the current state-of-the-art and under a set of operational characteristics.

Adversarial intention is much more difficult to estimate; intentions may change rapidly or may vary on a case-by-case basis. In light of that, we have attempted to reflect all the adversarial intentions, whether it is jamming, spoofing, or eavesdropping, within the generalized probability of confidentiality and probability of integrity. With these estimations, both adversarial capability and intention are difficult to concretely quantify in the initial pass, and they are, thus, cast in probabilistic terms.

This version of the QoSS model is a single snap-shot in time; a time-varying QoSS model is in development in which the model estimations may be updated based on new research, information, or changing environmental and systemic conditions. As the QoSS model becomes more mature and broadly adopted, future iterations will benefit from increased understanding of these probabilistic approaches and an initial coarse estimate for design requirements may converge to refined security requirements if applied in an iterative manner.

These iterations point directly to the eventual need for a simulation environment and all the supporting protocols that allow for the verification and validation of the security metrics. To achieve that end, the network performance will need to be influenced by a simulated adversarial actor, and the amount of data leakage or corruption will be directly quantified based on the amount of transmitted data. Only with that final step of validation will we be certain that the model portrays a realistic version of a communication network.

6. Conclusions and Future Work

This manuscript represents an initial model intended to be used in developing an understanding of how real-world networks function in the presence of adversarial influence. The current analysis does not address the nuances of specific communication scenarios, and there is no existing network to validate our model. Quantifying security in real-world communication networks is difficult and mostly subjective. Without a metric for confidentiality and integrity, it is nearly impossible to state how secure one network is compared to another.

Using a probabilistic model that considers data leakage and data corruption in place of confidentiality and integrity, a set of metrics may be used to quantify the QoSS. This model allows the direct and repeatable quantification of the security available in a single- or multi-channel network under static configurations. The quantification of security is based directly upon the probabilities that adversarial listeners and disruptors are able to gain access to or change the original message.

Traditional measurements of QoS provide a foundation, and message fragmentation and duplication across the available channels provide demonstrably improved theoretical performance. A fully developed simulation would be useful in validating the modeled results. However, at this time, there is no existing network or simulation of a real network to validate the theoretical QoSS model. A simulation environment is in the process of development in order to include the ability to estimate an adversary’s influence, as are the experiments and the network prototype that will be used to test the theoretical QoSS model.

Two additional manuscripts are nearing completion that will address two of the many thorny issues contained within real networks—in particular, multi-hop networks and the changes to the QoSS metrics that occur over time. This future work may require building specific data-handling protocols, and would monitor how the network end-points respond. With the simulation environment developed, the modeled results may be verified and the QoSS model may be validated or improved with additional data and insight.