February 6, 2014 Outline

Reading: text, §7
Assignment due: Homework #2, due February 11, 2014
  1. Chinese Wall Policy
    1. Low-level entities are objects; all objects concerning the same corporation form a CD (company dataset); CDs whose corporations are in competition are grouped into COIs (Conflict of Interest classes)
    2. Intuitive goal: keep one subject from reading different CDs in the same COI, or reading one CD and writing to another in same COI
    3. Simple Security Property: Read access granted if the object:
      1. is in the same CD as an object already accessed by the subject; or
      2. is in a CD in an entirely different COI.
    4. Theorems:
      1. Once a subject has accessed an object, only other objects in that CD are available within that COI;
      2. Subject has access to at most 1 dataset in each COI class
    5. Exceptions: sanitized information
    6. *-Property: Write access is permitted only if:
      1. Read access is permitted by the simple security property; and
      2. No object in a different CD in that COI can be read, unless it contains sanitized information
    7. Key result: information can only flow within a CD or from sanitized information
    8. Comparison to BLP
    9. Comparison to Clark-Wilson

You can also obtain a PDF version of this. Version of February 4, 2014 at 2:04PM