Notes for February 9, 1998
- Greetings and felicitations!
- Reading: Pfleeger, pp. 176-198, 277-280; Garfinkel & Spaddord,
pp. 327-340
- Puzzle
- Capabilities
- C-Lists
- copy right (copy flag)
- Lattice Model
- Set of classes SC is a partially ordered set under relation <=
with GLB ([[circlemultiply]]), LUB ([[circleplus]])
- Note: <= is reflexive, transitive, antisymmetric
- Application to MLS: forms a lattice with elements being the Cartesian
product of the linear lattice of levels and the subset lattics of categories
- Examples: (A, C) <= (A', C') iff A <= A' and C Í C';
(A, C)
[[circleplus]] (A', C") = (max(A, A'), C [[union]] C')
(A, C)
[[circlemultiply]] (A', C') = (min(A, A'), C [[intersection]] C')
- ORCON (Originator Controlled; Graubert)
- Document/information can be passed on with approval of originator; real
world justification is that originator of document trusts recipients not to
release documents which they should not.
- Untrusted subject x marks object O ORCON on behalf of
organization X and indicates it is releasable to subjects acting on
behalf of organization Y.
not releasable to subjects acting on
behalf of other organizations without X's permission
any copies
made have the same restriction
c. DAC: can't do this as the restriction would not copy over (y
reads O into C, puts its own ACL on C)
- MAC: separate category withO, x, y. y wants to
read O, copy to C; MAC means C has same category as
O, x, y, so can't give z access to C.
Say
a new organization w wants to provide data in B to y but
not to be shared with x or z. Can't use O's category.
Hence you get explosion of categories.
Real world parallel: individuals are
"briefed" into a category and those represent a formal "need to know" policy
that is standard across the entity; ORCON has no central clearinghouse to
categorize data; originator makes rules.
- Solution?
- owner of object can't change ACL's relationship with object (MAC
characteristic)
- on copy, ACL is copied as well (MAC characteristic)
- access control restrictions can be tailored on a subject/object basis (DAC
characteristic)
- Malicious logic
- Quickly review Trojan horses, viruses, bacteria
- Logic Bombs
- Worms (Schoch and Hupp)
- Review trust and TCB
- Notion is informal
- Assume trusted components called by untrusted programs
[ ended here ]
You can also see this document
in its native format,
in Postscript,
in PDF,
or
in ASCII text.
Send email to
cs153@csif.cs.ucdavis.edu.
Department of Computer Science
University of California at Davis
Davis, CA 95616-8562
Page last modified on 2/14/98