ITIS 3200: Introduction to Information Security and Privacy Dr. Weichao Wang

2 Chap 6: Integrity Policies More details about two types of policies –In previous chapter, we say that there are two types of policies: confidentiality and integrity policies. Here we will provide more details for integrity policies –There are many applications in which the integrity is more important than confidentiality

3 Chapter 6: Integrity Policies Overview Requirements –Very different from confidentiality policies Biba’s models Clark-Wilson model

4 Requirements of Integrity Commercial systems focus on development, test, and switch: Users will not write their own programs, but will use existing production programs and databases. Programmers will develop and test programs on a non-production system; if they need access to actual data, they will be given production data via a special process, but will use it on their development system. A special process must be followed to install a program from the development system onto the production system. The special process in requirement 3 must be controlled and audited. The managers and auditors must have access to both the system state and the system logs that are generated.

5 The requirements suggest several operation principles –Separation of duty: multiple steps of a critical function should be performed by different people. (SDE, SDET, STE) –Separation of function: the development system and production system Both system development and data manipulation –Auditing: enable recovery and accountability (checkpoint, and who has caused the problem)

6 Biba Integrity Model: –If you remember, the B-L confidentiality model says “no read up” and “no write down” –The basic idea of Biba model is No read down: a subject should not be mislead by data with a low integrity level No write up: a low integrity subject should not corrupt a trustworthy data The information flow is always downward

7 Example: Pres. O is planning to attack Mars –His plan should be based on verified information but not some Internet gossip (no read down) –A terrorist should not be granted the right to change the plan (no write up)

8 Intuition for Integrity Levels The higher the level, the more confidence –That a program will execute correctly –That data is accurate and/or reliable Note relationship between integrity and trustworthiness Important point: integrity levels are not security levels

9 Biba Integrity Model Set of subjects S, objects O, integrity levels I (the levels are ordered) The relation “≤” is defined b/w two integrity levels: the second dominates the first i(s) or i(o) will return the integrity level of a subject or an object

10 Biba’s Model The rules of Biba: 1. s  S can read o  O iff i(s) ≤ i(o) 2. s  S can write to o  O iff i(o) ≤ i(s) 3. s 1  S can execute s 2  S iff i(s 2 ) ≤ i(s 1 ) What we get from the three rules: –s can read only more trustworthy data: s will not be misled by low integrity information –s cannot mess up high integrity data –Prevent a less trusted invoker to control the execution of more trusted subjects

11

12 Clark-Wilson Integrity Model Focus on transactions instead of access rights: closer to the real operations of commercial systems Integrity defined by a set of constraints –Example: Bank D today’s deposits, W withdrawals, YB yesterday’s balance, TB today’s balance Integrity constraint: YB + D – W ?= TB Integrity of data: well-formed transactions move a system from one consistent state to another Integrity of operations: who examines and certifies that transactions are performed correctly?

13 Clark-Wilson contains two sets of rules: –Certification rules: security requirements that the system should uphold –Enforcement rules: security requirements that should be supported by the protection mechanisms

14 Entities CDIs: constrained data items –Data subject to integrity controls UDIs: unconstrained data items –Data not subject to integrity controls IVPs: integrity verification procedures –Procedures that test the CDIs conform to the integrity constraints TPs: transformation procedures –Procedures that take the system from one valid state to another

15 Certification Rules 1 and 2 CR1When any IVP is run, it must ensure all CDIs are in a valid state CR2For some associated set of CDIs, a TP must transform those CDIs in a valid state into a (possibly different) valid state –Defines relation certified that associates a set of CDIs with a particular TP –A TP can corrupt a CDI if it is not certified to work on that CDI –Example: TP balance, CDIs accounts, in bank example

16 Enforcement Rules 1 and 2 ER1The system must maintain the certified relations and must ensure that only TPs certified to run on a CDI manipulate that CDI. ER2The system must associate a user with each TP and set of CDIs. The TP may access those CDIs on behalf of the associated user. The TP cannot access that CDI on behalf of a user if she/he is not associated with that TP and CDI. –System must maintain, enforce certified relation –System must also restrict access based on user ID (allowed relation) –Now we have human, and we have to enforce separation of duty and authentication

17 Users and Rules CR3The allowed relations must meet the requirements imposed by the principle of separation of duty. ER3The system must authenticate each user attempting to execute a TP –Type of authentication undefined, and depends on the instantiation –Authentication not required before use of the system, but is required before manipulation of CDIs –User can manipulate CDI only through TP

18 Logging CR4All TPs must append enough information to reconstruct the operation to an append-only CDI. –This CDI is the log –Auditor needs to be able to determine what happened during reviews of transactions

19 Handling Untrusted Input CR5Any TP that takes as input a UDI may perform only valid transformations, or no transformations, for all possible values of the UDI. The transformation either rejects the UDI or transforms it into a CDI. –In bank, numbers entered at keyboard are UDIs, so cannot be input to TPs. TPs must validate numbers (to make them a CDI) before using them; if validation fails, TP rejects UDI –Now we can communicate with outside world

20 Separation of Duty In Model ER4Only the certifier of a TP may change the list of entities associated with that TP. No certifier of a TP, or of an entity associated with that TP, may ever have execute permission with respect to that entity. –Enforces separation of duty with respect to certified and allowed relations –You can not be player and rule-maker at the same time

21 Comparison to Biba Biba –No notion of certification rules. Therefore, we have to make sure that magically trusted subjects ensure actions obey rules untrusted data examined before being made trusted Clark-Wilson –Explicit requirements that actions must meet –Trusted entity must certify method to upgrade untrusted data (and not certify the data itself)

22 Key Points Integrity policies deal with trust –As trust is hard to quantify, these policies are hard to evaluate completely –Look for assumptions and trusted users to find possible weak points in their implementation Biba based on multilevel integrity Clark-Wilson focuses on separation of duty and transactions