Outline for January 28, 1999
- Greetings and felicitations!
- Typo in problem 2 of the homework: it should say d = 17, not e = 17. Oh,
- Change in office hours: now TuTh11-12 (this matches what I have on my
- Why is it different than confidentiality?
- How do you decide how trustworthy something is?
- Users will not write their own programs, but will use existing production
programs and databases.
- Programmers will develop and test programs on a non-production system; if
they need access to actual data, they will be given production data via a
special process, but will use it on their development system.
- A special process must be followed to install a program from the development
system onto the production system.
- The special process must be controlled and audited.
- The management and auditors must have access to both the system state and to
the system logs that are generated.
- Theme: military model does not provide enough controls for commercial fraud,
etc. because it does not cover the right aspects of integrity
- Data items: "Condtrained Data Items" (CDI) to which the model applies,
"Unconstrained Data Items (UDIs) to which no integrity checks are applied,
"Integrity Verification Procedures" (IVP) that verify conformance to the
integrity spec when IVP is run, "Transaction Procedures" (TP) takes system from
one well-formed state to another
- Certification and enforcement rules:
C1. All IVPs must ensure that all
CDIs are in a valid state when the IVP is run
C2. All TPs must be certified
to be valid, and each TP is assocated with a set of CDIs it is
authorized to manipulate
E1. The system must maintain these lists and must
ensure only those TPs manipulate those CDIs
E2: The system must
maintain a list of User IDs, TP, and CDIs that that TP can manipulate
on behalf of that user, and must ensure only those executions are
C3. The list of relations in E2 must be certified to meet the
separation of duty requirement.
E3. The sysem must authenticate
the identity of each user attempting to execute a TP.
C4. All TPs
must be certified to write to an append-only CDI (the log) all
information necessary to resonstruct the operation.
C5. Any TP taking a UDI
as an input must be certified to perform only valid transformations,
else no transformations, for any possible value of the UDI. The
transformation should take the input from a UDI to a CDI, or the UDI is
rejected (typically, for edits as the keyboard is a UDI).
E4. Only the
agent permitted to certify entities may change the list of such
entities associated with a TP. An agent that can certify an entity may not
have any execute rights with respect to that entity
You can get this document in
Framemaker+SGML version 5.5,
PDF (for Acrobat 3.0 or later),
Send email to
Department of Computer Science
University of California at Davis
Davis, CA 95616-8562
Page last modified on 2/3/99