1. Introduction to Computer Security Review
Sunday, October 17, 2004
Courtesy of Professors Prasant Krisnamurthy, Chris Clifton & Matt Bishop
INFSCI 2935: Introduction of Computer Security

2. Mathematical Induction
Proof technique - to prove some mathematical property
E.g. want to prove that M(n) holds for all natural numbers
Base case:
Prove that M(1) holds – called
Induction Hypothesis:
Assert that M(n) holds for n = 1 to k
Induction Step:
Prove that if M(k) holds then M(k+1) holds
Exercise: prove that sum of first n natural numbers is
1 + … + n = n(n + 1)/2
IS 2935 / TEL 2810: Introduction to Computer Security

3. IS 2935 / TEL 2810: Introduction to Computer Security
Lattice
Let S, a set
Cartesian product: S x S
Binary relation R on S is a subset of S x S
IF (a, b)  R we write aRb
Example, R is “less than equal to” ()
If S = {1, 2, 3} then R is {(1, 1), (1, 2), (1, 3), ????)
(1, 2)  R is another way of writing 1  2
Properties of relations
Reflexive: is aRa for all a  S
Antis-symmetric: if aRb and bRa implies a = b for all a, b  S
Transitive: if aRb and bRc imply that aRc for all a, b, c  S
Which properties hold for “less than equal to” ()?
IS 2935 / TEL 2810: Introduction to Computer Security

4. IS 2935 / TEL 2810: Introduction to Computer Security
Lattice
Total ordering: when the relation orders all elements
E.g., “less than equal to” () on natural numbers
Partial ordering (poset): when the relation orders only some elements not all
E.g. “less than equal to” () on complex numbers; Consider (2 + 4i) and (3 + 2i)
Upper bound (u, a, b  S)
u is an upper bound of a and b means aRu and bRu
Least upper bound : lub(a, b) closest upper bound
Lower bound (u, a, b  S)
l is a lower bound of a and b means lRa and lRb
Greatest lower bound : glb(a, b) closest lower bound
IS 2935 / TEL 2810: Introduction to Computer Security

5. IS 2935 / TEL 2810: Introduction to Computer Security
Lattice
A lattice is the combination of a set of elements S and a relation R meeting the following criteria
R is reflexive, antisymmetric, and transitive on the elements of S
For every s, t  S, there exists a greatest lower bound
For every s, t  S, there exists a lowest upper bound
What about S = {1, 2, 3} and R = ?
What about S = {2+4i; 1+2i; 3+2i, 3+4i} and R = ?
IS 2935 / TEL 2810: Introduction to Computer Security

6. Take-Grant Protection Model
System is represented as a directed graph
Subject:
Object:
Labeled edge indicate the rights that the source object has on the destination object
Four graph rewriting rules (“de jure”, “by law”, “by rights”)
The graph changes as the protection state changes according to
1. Take rule: if t γ, the take rule produces another graph with a transitive edge α  β added.
Either: γ α β ├ x z y
x takes (α to y) from z
IS 2935 / TEL 2810: Introduction to Computer Security

7. Take-Grant Protection Model
2. Grant rule: if g γ, the take rule produces another graph with a transitive edge α  β added. α
z grants (α to y) to x γ β γ β ├ x z y x z y
x creates (α to new vertex) y α ├
3. Create rule: x y x
x removes (α to) y β
β -α ├
4. Remove rule: x y x y
IS 2935 / TEL 2810: Introduction to Computer Security

8. Take-Grant Protection Model: Sharing
Given G0, can vertex x obtain α rights over y?
Can_share(α,x, y,G0) is true iff
G0├* Gn using the four rules, &
There is an α edge from x to y in Gn
tg-path: v0,…,vn with t or g edge between any pair of vertices vi, vi+1
Vertices tg-connected if tg-path between them
Theorem: Any two subjects with tg-path of length 1 can share rights
IS 2935 / TEL 2810: Introduction to Computer Security

9. Any two subjects with tg-path of length 1 can share rights
Can_share(α, x, y,G0)
Four possible length 1 tg-paths
1. Take rule
2. Grant rule
3. Lemma 3.1
4. Lemma 3.2 x z y
{t}
β  α
{g}
β  α
{t}
β  α
{g}
β  α
IS 2935 / TEL 2810: Introduction to Computer Security

10. Any two subjects with tg-path of length 1 can share rights
Can_share(α, x, y,G0)
Lemma 3.1
Sequence:
Create
Take
Grant
{t}
β  α y x z α
{t}
β  α tg g α
IS 2935 / TEL 2810: Introduction to Computer Security

11. IS 2935 / TEL 2810: Introduction to Computer Security
Other definitions
Island: Maximal tg-connected subject-only subgraph
Can_share all rights in island
Proof: Induction from previous theorem
Bridge: tg-path between subjects v0 and vn with edges of the following form:
t→*, t←*
t→*, g→, t←*
t→*, g←, t←* t g t v0 vn
IS 2935 / TEL 2810: Introduction to Computer Security

12. IS 2935 / TEL 2810: Introduction to Computer Security
Bridge t g t v0 vn α
By lemma 3.1 α α
By grant
By take α
IS 2935 / TEL 2810: Introduction to Computer Security

13. Theorem: Can_share(α,x,y,G0) (for subjects)
Subject_can_share(α, x, y,G0) is true iff if x and y are subjects and
there is an α edge from x to y in G0
OR if:
 a subject s  G0 with an s-to-y α edge, and
 islands I1, …, In such that x  I1, s  In, and there is a bridge from Ij to Ij+1 x s α y I1 I2 In
IS 2935 / TEL 2810: Introduction to Computer Security

14. What about objects? Initial, terminal spans
x initially spans to y if x is a subject and there is a tg-path between them with t edges ending in a g edge (i.e., t→*g→)
x can grant a right to y
x terminally spans to y if x is a subject and there is a tg-path between them with t edges (i.e., t→*)
x can take a right from y
IS 2935 / TEL 2810: Introduction to Computer Security

15. Theorem: Can_share(α,x,y,G0)
Can_share(α,x, y,G0) iff there is an α edge from x to y in G0 or if:
 a vertex s  G0 with an s to y α edge,
 a subject x’ such that x’=x or x’ initially spans to x,
 a subject s’ such that s’=s or s’ terminally spans to s, and
 islands I1, …, In such that x’  I1, s’  In, and there is a bridge from Ij to Ij+1 s x’ s’ α In α I2 I1 α y x α
x’ can grant a right to x
s’ can take a right from s
IS 2935 / TEL 2810: Introduction to Computer Security

16. Theorem: Can_share(α,x,y,G0) (for subjects)
Subject_can_share(α, x, y,G0) is true iff x and y are subjects and
there is an α edge from x to y in G0
OR if:
 a subject s  G0 with an s-to-y α edge, and
 islands I1, …, In such that x  I1, s  In, and there is a bridge from Ij to Ij+1 x s α y I1 I2 In
IS 2935 / TEL 2810: Introduction to Computer Security

17. What about objects? Initial, terminal spans
x initially spans to y if x is a subject and there is a tg-path associated with word {t→*g→} between them
x can grant a right to y
x terminally spans to y if x is a subject and there is a tg-path associated with word {t→*} between them
x can take a right from y
IS 2935 / TEL 2810: Introduction to Computer Security

18. Theorem: Can_share(α,x,y,G0)
Can_share(α,x, y,G0) iff there is an α edge from x to y in G0 or if:
 a vertex s  G0 with an s to y α edge,
 a subject x’ such that x’=x or x’ initially spans to x,
 a subject s’ such that s’=s or s’ terminally spans to s, and
 islands I1, …, In such that x’  I1, s’  In, and there is a bridge from Ij to Ij+1 s x’ s’ α α In α I2 I1 α y x α
x’ can grant a right to x
s’ can take a right from s
IS 2935 / TEL 2810: Introduction to Computer Security

19. Theorem: Can_share(α,x,y,G0)
Corollary: There is an O(|V|+|E|) algorithm to test can_share: Decidable in linear time!!
Theorem:
Let G0 contain exactly one vertex and no edges,
R a set of rights.
G0 ├* G iff G is a finite directed acyclic graph, with edges labeled from R, and at least one subject with no incoming edge.
Only if part: v is initial subject and G0 ├* G;
No rule allows the deletion of a vertex
No rule allows an incoming edge to be added to a vertex without any incoming edges. Hence, as v has no incoming edges, it cannot be assigned any
IS 2935 / TEL 2810: Introduction to Computer Security

20. Theorem: Can_share(α,x,y,G0)
If part : G meets the requirement
Assume v is the vertex with no incoming edge and apply rules
Perform “v creates (α  {g} to) new xi” for all 2<=i <= n, and α is union of all labels on the incoming edges going into xi in G
For all pairs x, y with x α over y in G, perform “v grants (α to y) to x”
If β is the set of rights x has over y in G, perform “v removes (α  {g} - β) to y”
IS 2935 / TEL 2810: Introduction to Computer Security

21. IS 2935 / TEL 2810: Introduction to Computer Security
Example
IS 2935 / TEL 2810: Introduction to Computer Security

22. Take-Grant Model: Sharing through a Trusted Entity
Let p and q be two processes
Let b be a buffer that they share to communicate
Let s be third party (e.g. operating system) that controls b rw rw u u g g rw
Witness
S creates ({r, w}, to new object) b
S grants ({r, w}, b) to p
S grants ({r, w}, b) to q rw b s s g g rw rw rw v v q q
IS 2935 / TEL 2810: Introduction to Computer Security

23. Theft in Take-Grant Model
Can_steal(α,x,y,G0) is true if there is no α edge from x to y in G0 and  sequence G1, …, Gn s. t.:
 α edge from x to y in Gn,,
 rules ρ1,…, ρn that take Gi-1├ ρi Gi , and
 v,w  Gi, 1≤i<n, if  α edge from v to y in G0 then ρi is not “v grants (α to y) to w”
Disallows owners of α rights to y from transferring those rights
Does not disallow them to transfer other rights
This models a Trojan horse
IS 2935 / TEL 2810: Introduction to Computer Security

24. IS 2935 / TEL 2810: Introduction to Computer Security
A witness to theft
u grants (t to v) to s
s takes (t to u) from v
s takes (α to w) from u t v t g s u α w
IS 2935 / TEL 2810: Introduction to Computer Security

25. IS 2935 / TEL 2810: Introduction to Computer Security
Conspiracy
Theft indicates cooperation: which subjects are actors in a transfer of rights, and which are not?
Next question is
How many subjects are needed to enable Can_share(α,x,y,G0)?
Note that a vertex y
Can take rights from any vertex to which it terminally spans
Can pass rights to any vertex to which it initially spans
Access set A(y) with focus y (y is subject) is union of
set of vertices y,
vertices to which y initially spans, and
vertices to which y terminally spans
IS 2935 / TEL 2810: Introduction to Computer Security

26. IS 2935 / TEL 2810: Introduction to Computer Security
Conspiracy
Deletion set δ(y,y’): All z  A(y) ∩ A(y’) for which
y initially spans to z and y’ terminally spans to z
y terminally spans to z and y’ initially spans to z
z=y & z=y’
Conspiracy graph H of G0:
Represents the paths along which subjects can transfer rights
For each subject in G0, there is a corresponding vertex h(x) in H
if δ(y,y’) not empty, edge from h(y) to h(y’)
IS 2935 / TEL 2810: Introduction to Computer Security

27. IS 2935 / TEL 2810: Introduction to Computer Security
Example t g g t x a b c d g r e z t t g g g y f h i j
IS 2935 / TEL 2810: Introduction to Computer Security

28. IS 2935 / TEL 2810: Introduction to Computer Security
Theorems
I(p) =
contains the vertex h(p) and the se t of all vertices h(p’) such that p’ initially spans to p
T(q) =
contains the vertex h(q) and the se t of all vertices h(q’) such that q’ terminally spans to q
Theorem 3-13:
Can_share(α,x,y,G0) iff there is a path from som h(p) in I(x) to some h(q) in T(y)
Theorem 3-14:
Let L be the number of vertices on a shortest path between h(p) and h(q) (as in theorem 3-13), then L conspirators are necessary and sufficient to produce a witness to Can_share(α,x,y,G0)
IS 2935 / TEL 2810: Introduction to Computer Security

29. Schematic Protection Model
Key idea is to use the notion of a protection type
Label that determines how control rights affect an entity
Take-Grant:
subject and object are different protection types
TS and TO represent subject type set and object set
(X) is the type of entity X
A ticket describes a right
Consists of an entity name and a right symbol: X/z
Possessor of the ticket X/z has right r over entity X
Y has tickets X/r, X/w -> Y has tickets X/rw
Each entity X has a set dom(X) of tickets Y/z
(X/r:c) = (X)/r:c is the type of a ticket
IS 2935 / TEL 2810: Introduction to Computer Security

30. Schematic Protection Model
Inert right vs. Control right
Inert right doesn’t affect protection state, e.g. read right
take right in Take-Grant model is a control right
Copy flag c
Every right r has an associated copyable right rc
r:c means r or rc
Manipulation of rights
A link predicate
Determines if a source and target of a transfer are “connected”
A filter function
Determines if a transfer is authorized
IS 2935 / TEL 2810: Introduction to Computer Security

31. IS 2935 / TEL 2810: Introduction to Computer Security
Transferring Rights
dom(X) : set of tickets that X has
Link predicate: linki(X,Y)
conjunction or disjunction of the following terms
X/z  dom(X); X/z  dom(Y);
Y/z  dom(X); Y/z  dom(Y)
true
Determines if X and Y “connected” to transfer right
Examples:
Take-Grant: link(X, Y) = Y/g  dom(X) v X/tdom(Y)
Broadcast: link(X, Y) = X/b dom(X)
Pull: link(X, Y) = Y/p dom(Y)
Universal: link(X, Y) = true
Scheme: a finite set of link predicates is called a scheme
IS 2935 / TEL 2810: Introduction to Computer Security

32. IS 2935 / TEL 2810: Introduction to Computer Security
Filter Function
Filter function:
Imposes conditions on when tickets can be transferred
fi: TS x TS → 2TxR (range is copyable rights)
X/r:c can be copied from dom(Y) to dom(Z) iff i s. t. the following are true:
X/rc  dom(Y)
linki(Y, Z)
(X)/r:c fi((Y), (Z))
Examples:
If fi((Y), (Z)) = T x R then any rights are transferable
If fi((Y), (Z)) = T x RI then only inert rights are transferable
If fi((Y), (Z)) = Ө then no tickets are transferable
One filter function is defined for each link predicate
IS 2935 / TEL 2810: Introduction to Computer Security

33. IS 2935 / TEL 2810: Introduction to Computer Security
SPM Example2
Take-Grant Protection Model
TS = { subjects }, TO = { objects }
RC = {tc, gc}, RI = {rc, wc}
Note that all rights can be copied in T-G model
link(p, q) = p/t  dom(q) v q/t dom(p)
f(subject, subject) = { subject, object }  { tc, gc, rc, wc }
Note that any rights can be transferred in T-G model
IS 2935 / TEL 2810: Introduction to Computer Security

34. IS 2935 / TEL 2810: Introduction to Computer Security
Create Operation
Need to handle
type of the created entity, &
tickets added by the creation
Relation can•create(a, b)  TS x T
A subject of type a can create an entity of type b
Rule of acyclic creates
Limits the membership in can•create(a, b)
If a subject of type a can create a subject of type b, then none of the descendants can create a subject of type a
IS 2935 / TEL 2810: Introduction to Computer Security

35. Create operation Distinct Types
create rule cr(a, b) specifies the
tickets introduced when a subject of type a creates an entity of type b
B object: cr(a, b)  { b/r:c  RI }
Only inert rights can be created
A gets B/r:c iff b/r:c  cr(a, b)
B subject: cr(a, b) has two parts
crP(a, b) added to A, crC(a, b) added to B
A gets B/r:c if b/r:c in crP(a, b)
B gets A/r:c if a/r:c in crC(a, b)
IS 2935 / TEL 2810: Introduction to Computer Security

36. IS 2935 / TEL 2810: Introduction to Computer Security
Examples
Owner-based policy
Users can create files: cc(user, file) holds
Creator can give itself any inert rights: cr(user, file) = {file/r:c| r  RI}
Take-Grant model
A subject can create a subject or an object
cc(subject, subject) and cc(subject, object) hold
Subject can give itself any rights over the vertices it creates but the subject does not give the created subject any rights (although grant can be used later)
crC(a, b) = Ө; crP(a, b) = {sub/tc, sub/gc, sub/rc, sub/wc}
Hence,
cr(sub, sub) = {sub/tc, sub/gc, sub/rc, sub/wc} | Ө
cr(sub, obj) = {obj/tc, obj/gc, obj/rc, obj/wc} | Ө
IS 2935 / TEL 2810: Introduction to Computer Security

37. Expressing Constraints
Entities are classes, methods
Class: set of objects that an access constraint constrains
Method: set of ways an operation can be invoked
Operations
Instantiation: s creates instance of class c: s ├ c
Invocation: s1 executes object s2: s1 |→ s2
Access constraints
deny(s op x) when b
when b is true, subject s cannot perform op on (subject or class) x; empty s means all subjects
IS 2935 / TEL 2810: Introduction to Computer Security

38. IS 2935 / TEL 2810: Introduction to Computer Security
Sample Constraints
Downloaded program cannot access password database file on UNIX system
Program’s class and methods for files:
class File {
public file(String name);
public String getfilename();
public char read(); ….
Constraint:
deny(|→ file.read) when
(file.getfilename() == “/etc/passwd”)
IS 2935 / TEL 2810: Introduction to Computer Security

39. IS 2935 / TEL 2810: Introduction to Computer Security
Users and Levels
Subjects
Security Level
(same as before)
Integrity Level
Ordinary users
(SL, { SP })
(ISL, { IP })
Application developers
(SL, { SD })
(ISL, { ID })
System programmers
(SL, { SSD })
System managers and auditors
(AM, { SP, SD, SSD })
(ISP, )
System controllers
(SL, { SP, SD }) and downgrade privilege
(ISP, {IP, ID})
Repair
IS 2935 / TEL 2810: Introduction to Computer Security

40. Objects and Classifications
Security Level
(earlier category)
Integrity Level
Development code/test data
(SL, { SD }) (D, T)
(ISL, { ID} )
Production code
(SL, { SP }) (PC)
(IO, { IP }) ?
Production data
(SL, { SP }) (PC, PD)
(ISL, { IP }) ?
Software tools
(SL,  ) (T)
(IO, { ID })
System programs
(SL,  ) 
(ISP, { IP, ID })
System programs in modification
(SL, { SSD }) (SD, T)
(ISL, { ID })
System and application logs
(AM, { appropriate })
(ISL,  )
Repair
(SL, {SP})
(ISP, { IP })
IS 2935 / TEL 2810: Introduction to Computer Security

41. S: Application programmers O: Development Code/Data
S: System Managers
O: Audit Trail
(AM, { SP, SD, SSD })
(ISL, )
(SL, { SP, SD }) and downgrade privilege
S: System Control
(ISP, {IP, ID})
(SL, { SP })
(SL, { SSD})
(SL, { SD })
(ISL, {IP})
(ISL, {ID})
(ISL, {ID})
S: Repair
S: Production Users
O: Production data
S: Application programmers
O: Development Code/Data
S: System programmers
O: System code in
Development
(SL, { SP })
(SL, { SP })
(SL, )
(ISP, {IP})
(IO, {IP})
(IO, {ID})
O: Repair Code
O: Production Code
O: Tools
(SL, )
(ISP, {IP, ID})
O: System programs
IS 2935 / TEL 2810: Introduction to Computer Security

42. Additional constraints
Production users can execute production users only
No individual can be both an application programmer and a production users
In contradiction to the *property- system controllers are allowed to write down.
IS 2935 / TEL 2810: Introduction to Computer Security