Notes for November 18, 1998
- Greetings and Felicitations!
- Puzzle of the Day
- Capability-based addressing: show picture of accessing object
- Show process limiting access by not inheriting all parent's capabilities
- Revocation: use of a global descriptor table
- Lock and Key
- Associate with each object a lock; associate with each process that
has access to object a key (it's a cross between ACLs and C-Lists)
- Example: use crypto (Gifford).
X object enciphered with key K.
Associate an opener R with X.
OR-Access: K can be recovered with any Di
in a list of n deciphering transformations, so
R = (E1(K), E2(K), ...,
and any process with access to any of the Di's
can access the file
AND-Access: need all n deciphering functions to get K:
R = (E1(E2(...En(K)...))
- Mandatory vs. Discretionary
- security levels
- Bell-LaPadula Model
- Simple Security Property: no reads up
- Star Property: no writes down
- Discretionary Security Property:
if mandatory controls say it's okay, check discretionary controls.
- Basic Security Theorem:
A system is secure if its initial state is secure and
no action violates the above rules.
- Lattice Model
- Set of classes
SC is a partially ordered set under relation SUBSET with GLB (x),
- Note: ¾ is reflexive, transitive, antisymmetric
- Application to MLS: forms a lattice with elements being the
Cartesian product of the linear lattice of levels and the subset
lattics of categories
- Examples: (A, C) ¾ (A', C') iff A ¾ A' and C SUBSET C';
(A, C) + (A', C') = (max(A, A'), C u C')
(A, C) x (A', C') = (min(A, A'), C n C')
- Biba: mathematical dual of BLP
- P may read O if L(P) ¾ L(O) and C(P) SUBSET C(O)
- P may write O if L(O) ¾ L(P) and C(O) SUBSET C(P)
- Combined with BLP: continue example
- Theme: military model does not provide enough controls for commercial
fraud, etc. because it does not cover the right aspects of integrity
- Data items: "Constrained Data Items" (CDI) to which the
model applies, "Unconstrained Data Items (UDIs) to which no
integrity checks are applied, "Integrity Verification
Procedures" (IVP) that verify conformance to the integrity spec
when IVP is run, "Transaction Procedures" (TP) takes system
from one well-formed state to another
- Certification and enforcement rules:
C1. All IVPs must ensure that all CDIs are in a valid state when the IVP
C2. All TPs must be certified to be valid, and each TP is assocated
with a set of CDIs it is authorized to manipulate
E1. The system must maintain these lists and must ensure only those TPs
manipulate those CDIs
E2: The system must maintain a list of User IDs, TP, and CDIs that that
TP can manipulate on behalf of that user, and must ensure only those
executions are performed.
C3. The list of relations in E2 must be certified to meet the separation of
E3. The sysem must authenticate the identity of each user attempting to execute
C4. All TPs must be certified to write to an append-only CDI (the log) all
information necessary to resonstruct the operation.
C5. Any TP taking a UDI as an input must be certified to perform only
valid transformations, else no transformations, for any possible value
of the UDI. The transformation should take the input from a UDI to a
CDI, or the UDI is rejected (typically, for edits as the keyboard is a
E4. Only the agent permitted to certify entities may change the list of
such entities associated with a TP. An agent that can certify an
entity may not have any execute rights with respect to that entity.
You can also see this document
in its native format,
in ASCII text.
Send email to
Department of Computer Science
University of California at Davis
Davis, CA 95616-8562
Page last modified on 11/24/98