Outline for May 14, 1997

1. Greetings and Felicitations
   1. All UC students: please get me homework #1 by tomorrow if you've not done so, so I can turn them all back by Friday, and homework #2s by Monday. NTU students: add one week, please.
2. BLP
   1. Add in discretionary security policy
3. BLP: formally
   1. Elements of system: s_i subjects, o_i objects,
   2. State space V = B×M×F where:
      • B set of current accesses (i.e., access modes each subject has currently to each object);
      • M access permission matrix;
      • F consists of 3 functions: f_s is security level associated with each subject, f_o security level associated with each object, and f_c current security level for each subject
   3. Set of requests is R
   4. Set of decisions is D
   5. W subset of R×D×V×V is motion from one state to another.
   6. System SIGMA(R, D, W, z₀) subset of X×Y×Z such that (x, y, z) element of SIGMA(R, D, W, z₀) iff (x_t, y_t, z_t, z_t-1) element of W for each i element of T; latter is an action of system
   7. THM: SIGMA(R, D, W, z₀) satisfies the simple security property for any initial state z₀ that satisfies the simple security property iff W satisfies the following conditions for each action (R_i, D_i, (b', M', f'), (b, M, f)):
      1. each (s, o, x) in b' - b satisfies the simple security condition relative to f' (i.e., x is not read, or x is read and f_s(s) dominates f_o(o); and
      2. if (s, o, x) in b does not satisfy the simple security condition relative to f', then (s, o, x) not in b'.
   8. THM: SIGMA(R, D, W, z₀) satisfies the *-property relative to S', a subset of S, for any initial state z₀ that satisfies the *-property relative to S' iff W satisfies the following conditions for each action (R_i, D_i, (b', M', f'), (b, M, f)):
      1. for each s in S', any (s, o, x) in b' - b satisfies the *-property with respect to f'
      2. for each s in S', if (s, o, x) in b does not satisfy the *-property with respect to f', then (s, o, x) not in b'.
   9. THM: SIGMA(R, D, W, z₀) satisfies the ds-property iff the initial state z₀ satisfies the ds-property and W satisfies the following conditions for each action (R_i, D_i, (b', M', f'), (b, M, f)):
      1. if (s_k, o_i, x) in b'-b, then x in M_ki';
      2. if (s_k, o_i, x) in b and x not in M_ki then (s_k, o_i, x) not in b'
   10. THM: Basic Security Theorem: A system SIGMA(R, D, W, z₀) is secure iff z₀ is a secure state and W satisfies the conditions of the above three theorems for each action.
4. Biba
   1. Integrity levels and trust
   2. No reads down
   3. No writes up
5. Clark-Wilson
   1. Theme: military model does not provide enough controls for commercial fraud, etc. because it does not cover the right aspects of integrity
   2. Data items: "Condtrained Data Items" (CDI) to which the model applies, "Unconstrained Data Items (UDIs) to which no integrity checks are applied, "Integrity Verification Procedures" (IVP) that verify conformance to the integrity spec when IVP is run, "Transaction Procedures" (TP) takes system from one well-formed state to another
   3. Certification and enforcement rules:
      • C1. All IVPs must ensure that all CDIs are in a valid state when the IVP is run.
      • C2. All TPs must be certified to be valid, and each TP is assocated with a set of CDIs it is authorized to manipulate.
      • E1. The system must maintain these lists and must ensure only those TPs mannipulate those CDIs;
      • E2: The system must maintain a list of User IDs, TP, and CDIs that that TP can manipulate on behalf of that user, and must ensure only those executions are performed.
      • C3. The list of relations in E2 must be certified to meet the separation of duty requirement.
      • E3. The sysem must authenticate the identity of each user attempting to execute a TP.
      • C4. All TPs must be certified to write to an append-only CDI (the log) all information necessary to resonstruct the operation.
      • C5. Any TP taking a UDI as an input must be certified to perform only valid transformations, else no transformations, for any possible value of the UDI. The transformation should take the input from a UDI to a CDI, or the UDI is rejected (typically, for edits as the keyboard is a UDI).
      • E4. Only the agent permitted to certify entities may change the list of such entities associated with a TP. An agent that can certify an entity may not have any execute rights with respect to that entity