Basic Security Theorem, Step 2

•      If a system is initially in a secure state, and every transition of the system satisfies the simple security condition, step 2, and the *-property, step 2, then every state of the system is secure

–    Proof: induct on the number of transitions

–    In actual Basic Security Theorem, discretionary access control treated as third property, and simple security property and *-property phrased to eliminate discretionary part of the definitions — but simpler to express the way done here.

Problem

•      Colonel has (Secret, {NUC, EUR}) clearance

•      Major has (Secret, {EUR}) clearance

–   Major can talk to colonel (“write up” or “read down”)

–   Colonel cannot talk to major (“read up” or “write down”)

•      Clearly absurd!

Solution

•      Define maximum, current levels for subjects

–    maxlevel(s) dom curlevel(s)

•      Example

–    Treat Major as an object (Colonel is writing to him/her)

–    Colonel has maxlevel (Secret, { NUC, EUR })

–    Colonel sets curlevel to (Secret, { EUR })

–    Now L(Major) dom curlevel(Colonel)

•    Colonel can write to Major without violating “no writes down”

–    Does L(s) mean curlevel(s) or maxlevel(s)?

•    Formally, we need a more precise notation

Chapter 5: Confidentiality Policies

Overview

•      Goals of Confidentiality Model

•      Bell-LaPadula Model

•      Goal: prevent the unauthorized disclosure of information

–   Deals with information flow

–   Integrity incidental

•      Multi-level security models are best-known examples

–   Bell-LaPadula Model basis for many, or most, of these

Bell-LaPadula Model, Step 1

•      Security levels arranged in linear ordering

–   Top Secret: highest

–   Secret

–   Confidential

–   Unclassified: lowest

•      Levels consist of security clearance L(s)

–   Objects have security classification L(o)

Example

Reading Information

•      Information flows up, not down

–   “Reads up” disallowed, “reads down” allowed

•      Simple Security Condition (Step 1)

–   Subject s can read object o iff L(o) ¡Â L(s) and s has permission to read o

•   Note: combines mandatory control (relationship of security levels) and discretionary control (the required permission)

–   Sometimes called “no reads up” rule

Writing Information

•      Information flows up, not down

–   “Writes up” allowed, “writes down” disallowed

•      *-Property (Step 1)

–   Subject s can write object o iff L(s) ¡Â L(o) and s has permission to write o

•   Note: combines mandatory control (relationship of security levels) and discretionary control (the required permission)

–   Sometimes called “no writes down” rule

Basic Security Theorem, Step 1

•      If a system is initially in a secure state, and every transition of the system satisfies the simple security condition, step 1, and the *-property, step 1, then every state of the system is secure

–   Proof: induct on the number of transitions

Bell-LaPadula Model, Step 2

•      Expand notion of security level to include categories

•      Security level is (clearance, category set)

•      Examples

–   ( Top Secret, { NUC, EUR, ASI } )

–   ( Confidential, { EUR, ASI } )

–   ( Secret, { NUC, ASI } )

Levels and Lattices

•      (A, C) dom (A¢, C¢) iff A¢ ¡Â A and C¢ Í C

•      Examples

–    (Top Secret, {NUC, ASI}) dom (Secret, {NUC})

–    (Secret, {NUC, EUR}) dom (Confidential,{NUC, EUR})

–    (Top Secret, {NUC}) Ødom (Confidential, {EUR})

•      Let C be set of classifications, K set of categories. Set of security levels L = C ´ K, dom form lattice

–    lub(L) = (max(A), C)

–    glb(L) = (min(A), Æ)

Levels and Ordering

•      Security levels partially ordered

–   Any pair of security levels may (or may not) be related by dom

•      “dominates” serves the role of “greater than” in step 1

–   “greater than” is a total ordering, though

Reading Information

•      Information flows up, not down

–   “Reads up” disallowed, “reads down” allowed

•      Simple Security Condition (Step 2)

–   Subject s can read object o iff L(s) dom L(o) and s has permission to read o

•   Note: combines mandatory control (relationship of security levels) and discretionary control (the required permission)

–   Sometimes called “no reads up” rule

Writing Information

•      Information flows up, not down

–   “Writes up” allowed, “writes down” disallowed

•      *-Property (Step 2)

–   Subject s can write object o iff L(o) dom L(s) and s has permission to write o

•   Note: combines mandatory control (relationship of security levels) and discretionary control (the required permission)

–   Sometimes called “no writes down” rule