- Greetings and Felicitations
- Please remember to give me write-ups of your vulnerabilities, both what worked and what didn't, in the format discussed earlier

- Take-Grant
- Show bridges (as a combination of terminal and initial spans)
- Show islands (maximal subject-only tg-connected subgraphs)
- can*share(
*r*,**x**,**y**,*G*_{0}) iff there is an edge from**x**to**y**labelled*r*in*G*_{0}, or all of the following hold: (1) there is a vertex**y''**with an edge from**y'**to**y**labelled*r*; (2) there is a subject**y'**which terminally spans to**y''**, or**y'**=**y''**; (3) there is a subject**x'**which initially spans to**x**, or**x'**=**x**; and (4) there is a sequence of islands*I*_{1}, ...,*I*connected by bridges for which_{n}**x'**is in*I*_{1}and**y'**is in*I*._{n} - Describe can*steal; don't state theorem

- Lattice models
- poset, <= the relation
- highest and lowest
- Set of classes SC is a partially ordered set under relation <= with GLB (greatest lower bound), LUB (least upper bound) operators
- Note: is reflexive, transitive, antisymmetric
- Examples: (
*A*,*C*) <= (*A*',*C*') iff*A*<=*A*' and*C*is a subset of*C*'; LUB((*A*,*C*), (*A*',*C*')) = (max(*A*,*A*'), union(*C*,*C*')) GLB((*A*,*C*), (*A*',*C*')) = (min(*A*,*A*'), intersection(*C*,*C*'))

- Bell-LaPadula (informal)
- Go through security levels, categories, compartments
- Describe simple security property (no reads up) and *-property (no writes down)
- State Basic Security Theorem: if it's secure and transformations follow these rules, it's still secure

Notes by Jeff Rowe:

You can get this document in Postscript, ASCII text, or Framemaker version 5.1.

Send email to cs253@csif.cs.ucdavis.edu.

Department of Computer Science

University of California at Davis

Davis, CA 95616-8562