Computer Security: Art and Science, 2nd Edition

Computer Security: Art and Science, 2nd Edition
Foundational Results Chapter 3 Version 1.0 Computer Security: Art and Science, 2nd Edition

Overview Safety Question HRU Model Take-Grant Protection Model SPM, ESPM Multiparent joint creation Expressive power Typed Access Matrix Model Comparing properties of models Version 1.0 Computer Security: Art and Science, 2nd Edition

What Is “Secure”? Adding a generic right r where there was not one is “leaking” In what follows, a right leaks if it was not present initially Alternately: not present in the previous state (not discussed here) If a system S, beginning in initial state s0, cannot leak right r, it is safe with respect to the right r Otherwise it is called unsafe with respect to the right r Version 1.0 Computer Security: Art and Science, 2nd Edition

Safety Question Is there an algorithm for determining whether a protection system S with initial state s0 is safe with respect to a generic right r? Here, “safe” = “secure” for an abstract model Version 1.0 Computer Security: Art and Science, 2nd Edition

Mono-Operational Commands
Answer: yes Sketch of proof: Consider minimal sequence of commands c1, …, ck to leak the right. Can omit delete, destroy Can merge all creates into one Worst case: insert every right into every entry; with s subjects and o objects initially, and n rights, upper bound is k ≤ n(s+1)(o+1) Version 1.0 Computer Security: Art and Science, 2nd Edition

General Case Answer: no Sketch of proof: Reduce halting problem to safety problem Turing Machine review: Infinite tape in one direction States K, symbols M; distinguished blank b Transition function (k, m) = (k, m, L) means in state k, symbol m on tape location replaced by symbol m, head moves to left one square, and enters state k Halting state is qf; TM halts when it enters this state Version 1.0 Computer Security: Art and Science, 2nd Edition

Mapping 1 2 3 4 s1 s2 s3 s4 A B C D … s1 A own head s2 B own s3 C k own Current state is k s4 D end Version 1.0 Computer Security: Art and Science, 2nd Edition

Mapping 1 2 3 4 s1 s2 s3 s4 A B X D … s1 A own head s2 B own s3 X own After (k, C) = (k1, X, R) where k is the current state and k1 the next state s4 D k1 end Version 1.0 Computer Security: Art and Science, 2nd Edition

Command Mapping (k, C) = (k1, X, R) at intermediate becomes command ck,C(s3,s4) if own in A[s3,s4] and k in A[s3,s3] and C in A[s3,s3] then delete k from A[s3,s3]; delete C from A[s3,s3]; enter X into A[s3,s3]; enter k1 into A[s4,s4]; end Version 1.0 Computer Security: Art and Science, 2nd Edition

Mapping 1 2 3 4 s1 s2 s3 s4 s5 A B X Y … s1 A own head s2 B own s3 X own After (k1, D) = (k2, Y, R) where k1 is the current state and k2 the next state s4 Y own s5 b k2 end Version 1.0 Computer Security: Art and Science, 2nd Edition

Command Mapping (k1, D) = (k2, Y, R) at end becomes command crightmostk,C(s4,s5) if end in A[s4,s4] and k1 in A[s4,s4] and D in A[s4,s4] then delete end from A[s4,s4]; delete k1 from A[s4,s4]; delete D from A[s4,s4]; enter Y into A[s4,s4]; create subject s5; enter own into A[s4,s5]; enter end into A[s5,s5]; enter k2 into A[s5,s5]; end Version 1.0 Computer Security: Art and Science, 2nd Edition

Rest of Proof Protection system exactly simulates a TM Exactly 1 end right in ACM 1 right in entries corresponds to state Thus, at most 1 applicable command If TM enters state qf, then right has leaked If safety question decidable, then represent TM as above and determine if qf leaks Implies halting problem decidable Conclusion: safety question undecidable Version 1.0 Computer Security: Art and Science, 2nd Edition

Other Results Set of unsafe systems is recursively enumerable Delete create primitive; then safety question is complete in P-SPACE Delete destroy, delete primitives; then safety question is undecidable Systems are monotonic Safety question for biconditional protection systems is decidable Safety question for monoconditional, monotonic protection systems is decidable Safety question for monoconditional protection systems with create, enter, delete (and no destroy) is decidable. Version 1.0 Computer Security: Art and Science, 2nd Edition

Take-Grant Protection Model
A specific (not generic) system Set of rules for state transitions Safety decidable, and in time linear with the size of the system Goal: find conditions under which rights can be transferred from one entity to another in the system Version 1.0 Computer Security: Art and Science, 2nd Edition

System ¡ objects (files, …) l subjects (users, processes, …) Ä don't care (either a subject or an object) G ⊢x G apply a rewriting rule x (witness) to G to get G G ⊢* G apply a sequence of rewriting rules (witness) to G to get G R = { t, g, r, w, … } set of rights Version 1.0 Computer Security: Art and Science, 2nd Edition

Rules    l l ⊢ take t  t         grant ⊢  g g  l l Version 1.0 Computer Security: Art and Science, 2nd Edition

More Rules create l ⊢  l  ⊢   –  remove   l l l These four rules are called the de jure rules Version 1.0 Computer Security: Art and Science, 2nd Edition

Symmetry  4. x takes ( to y) from v y x y x  l  l ⊢  3. z grants ( to y) to v v tg 1. x creates (tg to new) v t t   l l g 2. z takes (g to v) from x z z Similar result for grant Version 1.0 Computer Security: Art and Science, 2nd Edition

Islands tg-path: path of distinct vertices connected by edges labeled t or g Call them “tg-connected” island: maximal tg-connected subject-only subgraph Any right one vertex has can be shared with any other vertex Version 1.0 Computer Security: Art and Science, 2nd Edition

Initial, Terminal Spans
initial span from x to y x subject tg-path between x, y with word in { t*g }  {  } Means x can give rights it has to y terminal span from x to y tg-path between x, y with word in { t* }  {  } Means x can acquire any rights y has    Version 1.0 Computer Security: Art and Science, 2nd Edition

Bridges bridge: tg-path between subjects x, y, with associated word in { t*, t*, t*g t*, t*g t* } rights can be transferred between the two endpoints not an island as intermediate vertices are objects         Version 1.0 Computer Security: Art and Science, 2nd Edition

Example s t r p l s l q g t t g g t l l l u v w x y islands { p, u } { w } { y, s } bridges uvw; wxy initial span p (associated word ) terminal span ss (associated word t )  Version 1.0 Computer Security: Art and Science, 2nd Edition

can•share Predicate Definition: can•share(r, x, y, G0) if, and only if, there is a sequence of protection graphs G0, …, Gn such that G0 ⊢* Gn using only de jure rules and in Gn there is an edge from x to y labeled r. Version 1.0 Computer Security: Art and Science, 2nd Edition

can•share Theorem can•share(r, x, y, G0) if, and only if, there is an edge from x to y labeled r in G0, or the following hold simultaneously: There is an s in G0 with an s-to-y edge labeled r There is a subject x = x or initially spans to x There is a subject s = s or terminally spans to s There are islands I1,…, Ik connected by bridges, and x in I1 and s in Ik Version 1.0 Computer Security: Art and Science, 2nd Edition

Outline of Proof s has r rights over y s acquires r rights over y from s Definition of terminal span x acquires r rights over y from s Repeated application of sharing among vertices in islands, passing rights along bridges x gives r rights over y to x Definition of initial span Version 1.0 Computer Security: Art and Science, 2nd Edition

Example Interpretation
ACM is generic Can be applied in any situation Take-Grant has specific rules, rights Can be applied in situations matching rules, rights Question: what states can evolve from a system that is modeled using the Take-Grant Model? Version 1.0 Computer Security: Art and Science, 2nd Edition

Take-Grant Generated Systems
Theorem: G0 protection graph with 1 vertex, no edges; R set of rights. Then G0 ⊢* G iff: G finite directed graph consisting of subjects, objects, edges Edges labeled from nonempty subsets of R At least one vertex in G has no incoming edges Version 1.0 Computer Security: Art and Science, 2nd Edition

Outline of Proof : By construction; G final graph in theorem Let x1, …, xn be subjects in G Let x1 have no incoming edges Now construct G as follows: Do “x1 creates (  { g } to) new subject xi” For all (xi, xj) where xi has a rights over xj, do “x1 grants ( to xj) to xi” 3. Let  be rights xi has over xj in G. Do “x1 removes ((  { g } –  to) xj” Now G is desired G Version 1.0 Computer Security: Art and Science, 2nd Edition

Outline of Proof : Let v be initial subject, and G0 ⊢* G Inspection of rules gives: G is finite G is a directed graph Subjects and objects only All edges labeled with nonempty subsets of R Limits of rules: None allow vertices to be deleted so v in G None add incoming edges to vertices without incoming edges, so v has no incoming edges Version 1.0 Computer Security: Art and Science, 2nd Edition

Example: Shared Buffer
p s q v u rw g s grants ( {r, w} to b) to p rw 2. b s creates ( {r, w} to new object) b rw rw s grants ( {r, w} to b) to q 3. Goal: p, q to communicate through shared buffer b controlled by trusted entity s Version 1.0 Computer Security: Art and Science, 2nd Edition

can•steal Predicate Definition: can•steal(r, x, y, G0) if, and only if, there is no edge from x to y labeled r in G0, and the following hold simultaneously: There is edge from x to y labeled r in Gn There is a sequence of rule applications 1, …, n such that Gi–1 ⊢ Gi using i For all vertices v, w in Gi–1, if there is an edge from v to y in G0 labeled r, then i is not of the form “v grants (r to y) to w” Version 1.0 Computer Security: Art and Science, 2nd Edition

Example 1. u grants (t to v) to s t v l t 2. s takes (t to u) from v t g s l t can•steal(, s, w, G0): l 3. s takes ( to w) from u  u  w Version 1.0 Computer Security: Art and Science, 2nd Edition

can•steal Theorem can•steal(r, x, y, G0) if, and only if, the following hold simultaneously: There is no edge from x to y labeled r in G0 There exists a subject x such that x = x or x initially spans to x There exists a vertex s with an edge labeled  to y in G0 can•share(t, x, s, G0) holds Version 1.0 Computer Security: Art and Science, 2nd Edition

Outline of Proof : Assume conditions hold x subject x gets t rights to s, then takes  to y from s x object can•share(t, x, s, G0) holds If x has no  edge to y in G0, x takes ( to y) from s and grants it to x If x has a edge to y in G0, x creates surrogate x, gives it (t to s) and (g to x); then x takes ( to y) and grants it to x Version 1.0 Computer Security: Art and Science, 2nd Edition

Outline of Proof : Assume can•steal(, x, y, G0) holds First two conditions immediate from definition of can•steal, can•share Third condition immediate from theorem of conditions for can•share Fourth condition:  minimal length sequence of rule applications deriving Gn from G0; i smallest index such that Gi–1 ⊢ Gi by rule i and adding  from some p to y in Gi What is i? Version 1.0 Computer Security: Art and Science, 2nd Edition

Outline of Proof Not remove or create rule y exists already Not grant rule Gi first graph in which edge labeled  to y is added, so by definition of can•share, cannot be grant take rule: so can•share(t, p, s, G0) holds So is subject s such that s = s or terminally spans to s Sequence of islands with x  I1 and s  In Derive witness to can•share(t, x, s, G0) that does not use “s grants ( to y) to” anyone Version 1.0 Computer Security: Art and Science, 2nd Edition

Conspiracy Minimum number of actors to generate a witness for can•share(, x, y, G0) Access set describes the “reach” of a subject Deletion set is set of vertices that cannot be involved in a transfer of rights Build conspiracy graph to capture how rights flow, and derive actors from it Version 1.0 Computer Security: Art and Science, 2nd Edition

Example l x a b c d y f h i j e z t g r Version 1.0 Computer Security: Art and Science, 2nd Edition

Access Set Access set A(y) with focus y: set of vertices: { y } { x | y initially spans to x } { x | y terminally spans to x } Idea is that focus can give rights to, or acquire rights from, a vertex in this set Version 1.0 Computer Security: Art and Science, 2nd Edition

Example l x a b c d y f h i j e z t g r A(x) = { x, a } • A(e) = { e, d, i, j } A(b) = { b, a } • A(y) = { y } A(c) = { c, b, d } • A(f) = { f, y } A(d) = { d } • A(h) = { h, f, i } Version 1.0 Computer Security: Art and Science, 2nd Edition

Deletion Set Deletion set (y, y): contains those vertices in A(y)  A(y) such that: y initially spans to z and y terminally spans to z; y terminally spans to z and y initially spans to z; z = y z = y Idea is that rights can be transferred between y and y if this set nonempty Version 1.0 Computer Security: Art and Science, 2nd Edition

Example (x, b) = { a } • (d, e) = { d } (b, c) = { b } • (y, f) = { y } (c, d) = { d } • (h, f) = { f } (c, e) = { d } Version 1.0 Computer Security: Art and Science, 2nd Edition

Conspiracy Graph Abstracted graph H from G0: Each subject x  G0 corresponds to a vertex h(x)  H If (x, y) ≠ , there is an edge between h(x) and h(y) in H Idea is that if h(x), h(y) are connected in H, then rights can be transferred between x and y in G0 Version 1.0 Computer Security: Art and Science, 2nd Edition

Example l x a b c d y f h i j e z t g r l h(x) h(y) h(b) h(c) h(d) h(e) h(h) h(f) Version 1.0 Computer Security: Art and Science, 2nd Edition

Results I(x): h(x), all vertices h(y) such that y initially spans to x T(x): h(x), all vertices h(y) such that y terminally spans to x Theorem: can•share(, x, y, G0) iff there exists a path from some h(p) in I(x) to some h(q) in T(y) Theorem: l vertices on shortest path between h(p), h(q) in above theorem; l conspirators necessary and sufficient to witness Version 1.0 Computer Security: Art and Science, 2nd Edition

Example: Conspirators
h(x) h(y) h(b) h(c) h(d) h(e) h(h) I(x) = { h(x) }, T(z) = { h(e) } Path between h(x), h(e) so can•share(r, x, z, G0) Shortest path between h(x), h(e) has 4 vertices  Conspirators are e, c, b, x Version 1.0 Computer Security: Art and Science, 2nd Edition

Example: Witness a d t g b g c t l l l l r 1. e grants (r to z) to d 2. c takes (r to z) from d r 4. b grants (r to z) to a r r 3. c grants (r to z) to b x r 5. x takes (r to z) from a g l e z t t g g g l l l y f h i j Version 1.0 Computer Security: Art and Science, 2nd Edition

Key Question Characterize class of models for which safety is decidable Existence: Take-Grant Protection Model is a member of such a class Universality: In general, question undecidable, so for some models it is not decidable What is the dividing line? Version 1.0 Computer Security: Art and Science, 2nd Edition

Schematic Protection Model
Type-based model Protection type: entity label determining how control rights affect the entity Set at creation and cannot be changed Ticket: description of a single right over an entity Entity has sets of tickets (called a domain) Ticket is X/r, where X is entity and r right Functions determine rights transfer Link: are source, target “connected”? Filter: is transfer of ticket authorized? Version 1.0 Computer Security: Art and Science, 2nd Edition

Link Predicate Idea: linki(X, Y) if X can assert some control right over Y Conjunction of disjunction of: X/z  dom(X) X/z  dom(Y) Y/z  dom(X) Y/z  dom(Y) true Version 1.0 Computer Security: Art and Science, 2nd Edition

Examples Take-Grant: link(X, Y) = Y/g  dom(X) v X/t  dom(Y) Broadcast: link(X, Y) = X/b  dom(X) Pull: link(X, Y) = Y/p  dom(Y) Version 1.0 Computer Security: Art and Science, 2nd Edition

Filter Function Range is set of copyable tickets Entity type, right Domain is subject pairs Copy a ticket X/r:c from dom(Y) to dom(Z) X/rc  dom(Y) linki(Y, Z) (Y)/r:c  fi((Y), (Z)) One filter function per link function Version 1.0 Computer Security: Art and Science, 2nd Edition

Example f((Y), (Z)) = T  R Any ticket can be transferred (if other conditions met) f((Y), (Z)) = T  RI Only tickets with inert rights can be transferred (if other conditions met) f((Y), (Z)) =  No tickets can be transferred Version 1.0 Computer Security: Art and Science, 2nd Edition

Example Take-Grant Protection Model TS = { subjects }, TO = { objects } RC = { tc, gc }, RI = { rc, wc } link(p, q) = p/t  dom(q)  q/g  dom(p) f(subject, subject) = { subject, object }  { tc, gc, rc, wc } Version 1.0 Computer Security: Art and Science, 2nd Edition

Create Operation Must handle type, tickets of new entity Relation cc(a, b) [cc for can-create] Subject of type a can create entity of type b Rule of acyclic creates: Version 1.0 Computer Security: Art and Science, 2nd Edition

Types cr(a, b): tickets created when subject of type a creates entity of type b [cr for create-rule] B object: cr(a, b)  { b/r:c  RI } A gets B/r:c iff b/r:c  cr(a, b) B subject: cr(a, b) has two subsets crP(a, b) added to A, crC(a, b) added to B A gets B/r:c if b/r:c  crP(a, b) B gets A/r:c if a/r:c  crC(a, b) Version 1.0 Computer Security: Art and Science, 2nd Edition

Non-Distinct Types cr(a, a): who gets what? self/r:c are tickets for creator a/r:c tickets for created cr(a, a) = { a/r:c, self/r:c | r:c  R} Version 1.0 Computer Security: Art and Science, 2nd Edition

Attenuating Create Rule
cr(a, b) attenuating if: crC(a, b)  crP(a, b) and a/r:c  crP(a, b)  self/r:c  crP(a, b) Version 1.0 Computer Security: Art and Science, 2nd Edition

Example: Owner-Based Policy
Users can create files, creator can give itself any inert rights over file cc = { ( user , file ) } cr(user, file) = { file/r:c | r  RI } Attenuating, as graph is acyclic, loop free Version 1.0 Computer Security: Art and Science, 2nd Edition

Example: Take-Grant Say subjects create subjects (type s), objects (type o), but get only inert rights over latter cc = { ( s, s ), ( s, o ) } crC(a, b) =  crP(s, s) = {s/tc, s/gc, s/rc, s/wc } crP(s, o) = {s/rc, s/wc } Not attenuating, as no self tickets provided; subject creates subject Version 1.0 Computer Security: Art and Science, 2nd Edition

Safety Analysis Goal: identify types of policies with tractable safety analyses Approach: derive a state in which additional entries, rights do not affect the analysis; then analyze this state Called a maximal state Version 1.0 Computer Security: Art and Science, 2nd Edition

Definitions System begins at initial state Authorized operation causes legal transition Sequence of legal transitions moves system into final state This sequence is a history Final state is derivable from history, initial state Version 1.0 Computer Security: Art and Science, 2nd Edition

More Definitions States represented by h Set of subjects SUBh, entities ENTh Link relation in context of state h is linkh Dom relation in context of state h is domh Version 1.0 Computer Security: Art and Science, 2nd Edition

pathh(X,Y) X, Y connected by one link or a sequence of links Formally, either of these hold: for some i, linkih(X, Y); or there is a sequence of subjects X0, …, Xn such that linkih(X, X0), linkih(Xn,Y), and for k = 1, …, n, linkih(Xk–1, Xk) If multiple such paths, refer to pathjh(X, Y) Version 1.0 Computer Security: Art and Science, 2nd Edition

Capacity cap(pathh(X,Y))
Set of tickets that can flow over pathh(X,Y) If linkih(X,Y): set of tickets that can be copied over the link (i.e., fi((X), (Y))) Otherwise, set of tickets that can be copied over all links in the sequence of links making up the pathh(X,Y) Note: all tickets (except those for the final link) must be copyable Version 1.0 Computer Security: Art and Science, 2nd Edition

Flow Function Idea: capture flow of tickets around a given state of the system Let there be m pathhs between subjects X and Y in state h. Then flow function flowh: SUBh  SUBh  2TR is: flowh(X,Y) = i=1,…,m cap(pathih(X,Y)) Version 1.0 Computer Security: Art and Science, 2nd Edition

Properties of Maximal State
Maximizes flow between all pairs of subjects State is called * Ticket in flow*(X,Y) means there exists a sequence of operations that can copy the ticket from X to Y Questions Is maximal state unique? Does every system have one? Version 1.0 Computer Security: Art and Science, 2nd Edition

Formal Definition Definition: g ≤0 h holds iff for all X, Y  SUB0, flowg(X,Y)  flowh(X,Y). Note: if g ≤0 h and h ≤0 g, then g, h equivalent Defines set of equivalence classes on set of derivable states Definition: for a given system, state m is maximal iff h ≤0 m for every derivable state h Intuition: flow function contains all tickets that can be transferred from one subject to another All maximal states in same equivalence class Version 1.0 Computer Security: Art and Science, 2nd Edition

Maximal States Lemma. Given arbitrary finite set of states H, there exists a derivable state m such that for all h  H, h ≤0 m Outline of proof: induction Basis: H = ; trivially true Step: |H| = n + 1, where H = G  {h}. By IH, there is a g  G such that x ≤0 g for all x  G. Version 1.0 Computer Security: Art and Science, 2nd Edition

Outline of Proof M interleaving histories of g, h which: Preserves relative order of transitions in g, h Omits second create operation if duplicated M ends up at state m If pathg(X,Y) for X, Y  SUBg, pathm(X,Y) So g ≤0 m If pathh(X,Y) for X, Y  SUBh, pathm(X,Y) So h ≤0 m Hence m maximal state in H Version 1.0 Computer Security: Art and Science, 2nd Edition

Answer to Second Question
Theorem: every system has a maximal state * Outline of proof: K is set of derivable states containing exactly one state from each equivalence class of derivable states Consider X, Y in SUB0. Flow function’s range is 2TR, so can take at most 2|TR| values. As there are |SUB0|2 pairs of subjects in SUB0, at most 2|TR| |SUB0|2 distinct equivalence classes; so K is finite Result follows from lemma Version 1.0 Computer Security: Art and Science, 2nd Edition

Safety Question In this model: Is it possible to have a derivable state with X/r:c in dom(A), or does there exist a subject B with ticket X/rc in the initial state or which can demand X/rc and (X)/r:c in flow*(B,A)? To answer: construct maximal state and test Consider acyclic attenuating schemes; how do we construct maximal state? Version 1.0 Computer Security: Art and Science, 2nd Edition

Intuition Consider state h. State u corresponds to h but with minimal number of new entities created such that maximal state m can be derived with no create operations So if in history from h to m, subject X creates two entities of type a, in u only one would be created; surrogate for both m can be derived from u in polynomial time, so if u can be created by adding a finite number of subjects to h, safety question decidable. Version 1.0 Computer Security: Art and Science, 2nd Edition

Fully Unfolded State State u derived from state 0 as follows: delete all loops in cc; new relation cc mark all subjects as folded while any X  SUB0 is folded mark it unfolded if X can create entity Y of type y, it does so (call this the y-surrogate of X); if entity Y  SUBg, mark it folded if any subject in state h can create an entity of its own type, do so Now in state u Version 1.0 Computer Security: Art and Science, 2nd Edition

Surrogate Intuition: surrogate collapses multiple subjects of same type into single subject that acts for all of them Definition: given initial state 0, for every derivable state h define surrogate function :ENThENTh by: if X in ENT0, then (X) = X if Y creates X and (Y) = (X), then (X) = (Y) if Y creates X and (Y) ≠ (X), then (X) = (Y)-surrogate of (Y) Version 1.0 Computer Security: Art and Science, 2nd Edition

Implications ((X)) = (X) If (X) = (Y), then (X) = (Y) If (X) ≠ (Y), then (X) creates (Y) in the construction of u (X) creates entities X of type (X) = ((X)) From these, for a system with an acyclic attenuating scheme, if X creates Y, then tickets that would be introduced by pretending that (X) creates (Y) are in domu((X)) and domu((Y)) Version 1.0 Computer Security: Art and Science, 2nd Edition

Deriving Maximal State
Idea Reorder operations so that all creates come first and replace history with equivalent one using surrogates Show maximal state of new history is also that of original history Show maximal state can be derived from initial state Version 1.0 Computer Security: Art and Science, 2nd Edition

Reordering H legal history deriving state h from state 0 Order operations: first create, then demand, then copy operations Build new history G from H as follows: Delete all creates “X demands Y/r:c” becomes “(X) demands (Y)/r:c” “Y copies X /r:c from Y” becomes “(Y) copies (X)/r:c from (Y)” Version 1.0 Computer Security: Art and Science, 2nd Edition

Tickets in Parallel Lemma All transitions in G legal; if X/r:c  domh(Y), then (X)/r:c  domh((Y)) Outline of proof: induct on number of copy operations in H Version 1.0 Computer Security: Art and Science, 2nd Edition

Basis H has create, demand only; so G has demand only. s preserves type, so by construction every demand operation in G legal. 3 ways for X/r:c to be in domh(Y): X/r:c  dom0(Y) means X, Y  ENT0, so trivially (X)/r:c  domg((Y)) holds A create added X/r:c  domh(Y): previous lemma says (X)/r:c  domg((Y)) holds A demand added X/r:c  domh(Y): corresponding demand operation in G gives (X)/r:c  domg((Y)) Version 1.0 Computer Security: Art and Science, 2nd Edition

Hypothesis Claim holds for all histories with k copy operations History H has k+1 copy operations H initial sequence of H composed of k copy operations h state derived from H Version 1.0 Computer Security: Art and Science, 2nd Edition

Step G sequence of modified operations corresponding to H; g derived state G legal history by hypothesis Final operation is “Z copied X/r:c from Y” So h, h differ by at most X/r:c  domh(Z) Construction of G means final operation is (X)/r:c  domg((Y)) Proves second part of claim Version 1.0 Computer Security: Art and Science, 2nd Edition

Step H legal, so for H to be legal, we have:
X/rc  domh(Y) linkih(Y, Z) (X/r:c)  fi((Y), (Z)) By IH, 1, 2, as X/r:c  domh(Y), (X)/r:c  domg ((Y)) and linkig((Y), (Z)) As  preserves type, IH and 3 imply ((X)/r:c)  fi((((Y)), ((Z))) IH says G legal, so G is legal Version 1.0 Computer Security: Art and Science, 2nd Edition

Corollary If linkih(X, Y), then linkig((X), (Y)) Version 1.0 Computer Security: Art and Science, 2nd Edition

Main Theorem System has acyclic attenuating scheme
For every history H deriving state h from initial state, there is a history G without create operations that derives g from the fully unfolded state u such that (X,Y  SUBh)[flowh(X, Y)  flowg((X), (Y))] Meaning: any history derived from an initial state can be simulated by corresponding history applied to the fully unfolded state derived from the initial state Version 1.0 Computer Security: Art and Science, 2nd Edition

Proof Outline of proof: show that every pathh(X,Y) has corresponding pathg((X), (Y)) such that cap(pathh(X,Y)) = cap(pathg((X), (Y))) Then corresponding sets of tickets flow through systems derived from H and G As initial states correspond, so do those systems Proof by induction on number of links Version 1.0 Computer Security: Art and Science, 2nd Edition

Basis and Hypothesis Length of pathh(X, Y) = 1. By definition of pathh, linkih(X, Y), hence linkig((X), (Y)). As  preserves type, this means cap(pathh(X, Y)) = cap(pathg((X), (Y))) Now assume this is true when pathh(X, Y) has length k Version 1.0 Computer Security: Art and Science, 2nd Edition

Step Let pathh(X, Y) have length k+1. Then there is a Z such that pathh(X, Z) has length k and linkjh(Z, Y). By IH, there is a pathg((X), (Z)) with same capacity as pathh(X, Z) By corollary, linkjg((Z), (Y)) As  preserves type, there is pathg((X), (Y)) with cap(pathh(X, Y)) = cap(pathg((X), (Y))) Version 1.0 Computer Security: Art and Science, 2nd Edition

Implication Let maximal state corresponding to v be #u
Deriving history has no creates By theorem, (X,Y  SUBh)[flowh(X, Y)  flow#u((X), (Y))] If X  SUB0, (X) = X, so: (X,Y  SUB0)[flowh(X, Y)  flow#u(X, Y)] So #u is maximal state for system with acyclic attenuating scheme #u derivable from u in time polynomial to |SUBu| Worst case computation for flow#u is exponential in |TS| Version 1.0 Computer Security: Art and Science, 2nd Edition

Safety Result If the scheme is acyclic and attenuating, the safety question is decidable Version 1.0 Computer Security: Art and Science, 2nd Edition

Expressive Power How do the sets of systems that models can describe compare? If HRU equivalent to SPM, SPM provides more specific answer to safety question If HRU describes more systems, SPM applies only to the systems it can describe Version 1.0 Computer Security: Art and Science, 2nd Edition

HRU vs. SPM SPM more abstract Analyses focus on limits of model, not details of representation HRU allows revocation SMP has no equivalent to delete, destroy HRU allows multiparent creates SMP cannot express multiparent creates easily, and not at all if the parents are of different types because can•create allows for only one type of creator Version 1.0 Computer Security: Art and Science, 2nd Edition

Multiparent Create Solves mutual suspicion problem Create proxy jointly, each gives it needed rights In HRU: command multicreate(s0, s1, o) if r in a[s0, s1] and r in a[s1, s0] then create object o; enter r into a[s0, o]; enter r into a[s1, o]; end Version 1.0 Computer Security: Art and Science, 2nd Edition

SPM and Multiparent Create
cc extended in obvious way cc  TS  …  TS  T Symbols X1, …, Xn parents, Y created R1,i, R2,i, R3, R4,i  R Rules crP,i((X1), …, (Xn)) = Y/R1,1  Xi/R2,i crC((X1), …, (Xn)) = Y/R3  X1/R4,1  …  Xn/R4,n Version 1.0 Computer Security: Art and Science, 2nd Edition

Example Anna, Bill must do something cooperatively But they don’t trust each other Jointly create a proxy Each gives proxy only necessary rights In ESPM: Anna, Bill type a; proxy type p; right x  R cc(a, a) = p crAnna(a, a, p) = crBill(a, a, p) =  crproxy(a, a, p) = { Anna/x, Bill//x } Version 1.0 Computer Security: Art and Science, 2nd Edition

2-Parent Joint Create Suffices
Goal: emulate 3-parent joint create with 2-parent joint create Definition of 3-parent joint create (subjects P1, P2, P3; child C): cc((P1), (P2), (P3)) = Z  T crP1((P1), (P2), (P3)) = C/R1,1  P1/R2,1 crP2((P1), (P2), (P3)) = C/R2,1  P2/R2,2 crP3((P1), (P2), (P3)) = C/R3,1  P3/R2,3 Version 1.0 Computer Security: Art and Science, 2nd Edition

General Approach Define agents for parents and child Agents act as surrogates for parents If create fails, parents have no extra rights If create succeeds, parents, child have exactly same rights as in 3-parent creates Only extra rights are to agents (which are never used again, and so these rights are irrelevant) Version 1.0 Computer Security: Art and Science, 2nd Edition

Entities and Types Parents P1, P2, P3 have types p1, p2, p3 Child C of type c Parent agents A1, A2, A3 of types a1, a2, a3 Child agent S of type s Type t is parentage if X/t  dom(Y), X is Y’s parent Types t, a1, a2, a3, s are new types Version 1.0 Computer Security: Art and Science, 2nd Edition

can•create Following added to can•create: cc(p1) = a1 cc(p2, a1) = a2 cc(p3, a2) = a3 Parents creating their agents; note agents have maximum of 2 parents cc(a3) = s Agent of all parents creates agent of child cc(s) = c Agent of child creates child Version 1.0 Computer Security: Art and Science, 2nd Edition

Creation Rules Following added to create rule: crP(p1, a1) =  crC(p1, a1) = p1/Rtc Agent’s parent set to creating parent; agent has all rights over parent crPfirst(p2, a1, a2) =  crPsecond(p2, a1, a2) =  crC(p2, a1, a2) = p2/Rtc  a1/tc Agent’s parent set to creating parent and agent; agent has all rights over parent (but not over agent) Version 1.0 Computer Security: Art and Science, 2nd Edition

Creation Rules crPfirst(p3, a2, a3) =  crPsecond(p3, a2, a3) =  crC(p3, a2, a3) = p3/Rtc  a2/tc Agent’s parent set to creating parent and agent; agent has all rights over parent (but not over agent) crP(a3, s) =  crC(a3, s) = a3/tc Child’s agent has third agent as parent crP(a3, s) =  crP(s, c) = C/Rtc crC(s, c) = c/R3t Child’s agent gets full rights over child; child gets R3 rights over agent Version 1.0 Computer Security: Art and Science, 2nd Edition

Link Predicates Idea: no tickets to parents until child created Done by requiring each agent to have its own parent rights link1(A2, A1) = A1/t  dom(A2)  A2/t  dom(A2) link1(A3, A2) = A2/t  dom(A3)  A3/t  dom(A3) link2(S, A3) = A3/t  dom(S)  C/t  dom(C) link3(A1, C) = C/t  dom(A1) link3(A2, C) = C/t  dom(A2) link3(A3, C) = C/t  dom(A3) link4(A1, P1) = P1/t  dom(A1)  A1/t  dom(A1) link4(A2, P2) = P2/t  dom(A2)  A2/t  dom(A2) link4(A3, P3) = P3/t  dom(A3)  A3/t  dom(A3) Version 1.0 Computer Security: Art and Science, 2nd Edition

Filter Functions f1(a2, a1) = a1/t  c/Rtc f1(a3, a2) = a2/t  c/Rtc f2(s, a3) = a3/t  c/Rtc f3(a1, c) = p1/R4,1 f3(a2, c) = p2/R4,2 f3(a3, c) = p3/R4,3 f4(a1, p1) = c/R1,1  p1/R2,1 f4(a2, p2) = c/R1,2  p2/R2,2 f4(a3, p3) = c/R1,3  p3/R2,3 Version 1.0 Computer Security: Art and Science, 2nd Edition

Construction Create A1, A2, A3, S, C; then P1 has no relevant tickets P2 has no relevant tickets P3 has no relevant tickets A1 has P1/Rtc A2 has P2/Rtc  A1/tc A3 has P3/Rtc  A2/tc S has A3/tc  C/Rtc C has C/R3t Version 1.0 Computer Security: Art and Science, 2nd Edition

Construction Only link2(S, A3) true  apply f2 A3 has P3/Rtc  A2/t  A3/t  C/Rtc Now link1(A3, A2) true  apply f1 A2 has P2/Rtc  A1/tc  A2/t  C/Rtc Now link1(A2, A1) true  apply f1 A1 has P2/Rtc  A1/t  C/Rtc Now all link3s true  apply f3 C has C/R3  P1/R4,1  P2/R4,2  P3/R4,3 Version 1.0 Computer Security: Art and Science, 2nd Edition

Finish Construction Now link4 is true  apply f4 P1 has C/R1,1  P1/R2,1 P2 has C/R1,2  P2/R2,2 P3 has C/R1,3  P3/R2,3 3-parent joint create gives same rights to P1, P2, P3, C If create of C fails, link2 fails, so construction fails Version 1.0 Computer Security: Art and Science, 2nd Edition

Theorem The two-parent joint creation operation can implement an n-parent joint creation operation with a fixed number of additional types and rights, and augmentations to the link predicates and filter functions. Proof: by construction, as above Difference is that the two systems need not start at the same initial state Version 1.0 Computer Security: Art and Science, 2nd Edition

Theorems Monotonic ESPM and the monotonic HRU model are equivalent. Safety question in ESPM also decidable if acyclic attenuating scheme Proof similar to that for SPM Version 1.0 Computer Security: Art and Science, 2nd Edition

Expressiveness Graph-based representation to compare models Graph Vertex: represents entity, has static type Edge: represents right, has static type Graph rewriting rules: Initial state operations create graph in a particular state Node creation operations add nodes, incoming edges Edge adding operations add new edges between existing vertices Version 1.0 Computer Security: Art and Science, 2nd Edition

Example: 3-Parent Joint Creation
Simulate with 2-parent Nodes P1, P2, P3 parents Create node C with type c with edges of type e Add node A1 of type a and edge from P1 to A1 of type e´ P1 P2 P3 A1 Version 1.0 Computer Security: Art and Science, 2nd Edition

Next Step A1, P2 create A2; A2, P3 create A3 Type of nodes, edges are a and e´ P3 P1 P2 A3 A1 A2 Version 1.0 Computer Security: Art and Science, 2nd Edition

Next Step A3 creates S, of type a S creates C, of type c P3 P1 P2 A3 A1 A2 S C Version 1.0 Computer Security: Art and Science, 2nd Edition

Last Step Edge adding operations: P1A1A2A3SC: P1 to C edge type e P2A2A3SC: P2 to C edge type e P3A3SC: P3 to C edge type e P3 P1 P2 A2 A3 A1 S C Version 1.0 Computer Security: Art and Science, 2nd Edition

Definitions Scheme: graph representation as above Model: set of schemes Schemes A, B correspond if graph for both is identical when all nodes with types not in A and edges with types in A are deleted Version 1.0 Computer Security: Art and Science, 2nd Edition

Example Above 2-parent joint creation simulation in scheme TWO Equivalent to 3-parent joint creation scheme THREE in which P1, P2, P3, C are of same type as in TWO, and edges from P1, P2, P3 to C are of type e, and no types a and e´ exist in TWO Version 1.0 Computer Security: Art and Science, 2nd Edition

Simulation Scheme A simulates scheme B iff every state B can reach has a corresponding state in A that A can reach; and every state that A can reach either corresponds to a state B can reach, or has a successor state that corresponds to a state B can reach The last means that A can have intermediate states not corresponding to states in B, like the intermediate ones in TWO in the simulation of THREE Version 1.0 Computer Security: Art and Science, 2nd Edition

Expressive Power If there is a scheme in MA that no scheme in MB can simulate, MB less expressive than MA If every scheme in MA can be simulated by a scheme in MB, MB as expressive as MA If MA as expressive as MB and vice versa, MA and MB equivalent Version 1.0 Computer Security: Art and Science, 2nd Edition

Example Scheme A in model M Nodes X1, X2, X3 2-parent joint create 1 node type, 1 edge type No edge adding operations Initial state: X1, X2, X3, no edges Scheme B in model N All same as A except no 2-parent joint create 1-parent create Which is more expressive? Version 1.0 Computer Security: Art and Science, 2nd Edition

Can A Simulate B? Scheme A simulates 1-parent create: have both parents be same node Model M as expressive as model N Version 1.0 Computer Security: Art and Science, 2nd Edition

Can B Simulate A? Suppose X1, X2 jointly create Y in A Edges from X1, X2 to Y, no edge from X3 to Y Can B simulate this? Without loss of generality, X1 creates Y Must have edge adding operation to add edge from X2 to Y One type of node, one type of edge, so operation can add edge between any 2 nodes Version 1.0 Computer Security: Art and Science, 2nd Edition

No All nodes in A have even number of incoming edges 2-parent create adds 2 incoming edges Edge adding operation in B that can edge from X2 to C can add one from X3 to C A cannot enter this state B cannot transition to a state in which Y has even number of incoming edges No remove rule So B cannot simulate A; N less expressive than M Version 1.0 Computer Security: Art and Science, 2nd Edition

Theorem Monotonic single-parent models are less expressive than monotonic multiparent models Proof by contradiction Scheme A is multiparent model Scheme B is single parent create Claim: B can simulate A, without assumption that they start in the same initial state Note: example assumed same initial state Version 1.0 Computer Security: Art and Science, 2nd Edition

Outline of Proof X1, X2 nodes in A They create Y1, Y2, Y3 using multiparent create rule Y1, Y2 create Z, again using multiparent create rule Note: no edge from Y3 to Z can be added, as A has no edge-adding operation Y1 X1 Y2 Z X2 Y3 Version 1.0 Computer Security: Art and Science, 2nd Edition

Outline of Proof W, X1, X2 nodes in B W creates Y1, Y2, Y3 using single parent create rule, and adds edges for X1, X2 to all using edge adding rule Y1 creates Z, again using single parent create rule; now must add edge from Y2 to Z to simulate A Use same edge adding rule to add edge from Y3 to Z: cannot duplicate this in scheme A! Y1 X1 Y2 Z X2 Y3 Version 1.0 Computer Security: Art and Science, 2nd Edition

Meaning Scheme B cannot simulate scheme A, contradicting hypothesis ESPM more expressive than SPM ESPM multiparent and monotonic SPM monotonic but single parent Version 1.0 Computer Security: Art and Science, 2nd Edition

Typed Access Matrix Model
Like ACM, but with set of types T All subjects, objects have types Set of types for subjects TS Protection state is (S, O, , A) :OT specifies type of each object If X subject, (X) in TS If X object, (X) in T – TS Version 1.0 Computer Security: Art and Science, 2nd Edition

Create Rules Subject creation create subject s of type ts s must not exist as subject or object when operation executed ts  TS Object creation create object o of type to o must not exist as subject or object when operation executed to  T – TS Version 1.0 Computer Security: Art and Science, 2nd Edition

Create Subject Precondition: s  S Primitive command: create subject s of type t Postconditions: S´ = S { s }, O´ = O { s } (y  O)[´(y) =  (y)], ´(s) = t (y  O´)[a´[s, y] = ], (x  S´)[a´[x, s] = ] (x  S)(y  O)[a´[x, y] = a[x, y]] Version 1.0 Computer Security: Art and Science, 2nd Edition

Create Object Precondition: o  O Primitive command: create object o of type t Postconditions: S´ = S, O´ = O  { o } (y  O)[´(y) =  (y)], ´(o) = t (x  S´)[a´[x, o] = ] (x  S)(y  O)[a´[x, y] = a[x, y]] Version 1.0 Computer Security: Art and Science, 2nd Edition

Definitions MTAM Model: TAM model without delete, destroy MTAM is Monotonic TAM (x1:t1, ..., xn:tn) create command ti child type in  if any of create subject xi of type ti or create object xi of type ti occur in  ti parent type otherwise Version 1.0 Computer Security: Art and Science, 2nd Edition

Cyclic Creates command cry•havoc(s1 : u, s2 : u, o1 : v, o2 : v, o3 : w, o4 : w) create subject s1 of type u; create object o1 of type v; create object o3 of type w; enter r into a[s2, s1]; enter r into a[s2, o2]; enter r into a[s2, o4] end Version 1.0 Computer Security: Art and Science, 2nd Edition

Creation Graph u, v, w child types u, v, w also parent types Graph: lines from parent types to child types This one has cycles u v w Version 1.0 Computer Security: Art and Science, 2nd Edition

Acyclic Creates command cry•havoc(s1 : u, s2 : u, o1 : v, o3 : w) create object o1 of type v; create object o3 of type w; enter r into a[s2, s1]; enter r into a[s2, o1]; enter r into a[s2, o3] end Version 1.0 Computer Security: Art and Science, 2nd Edition

Creation Graph v, w child types u parent type Graph: lines from parent types to child types This one has no cycles u w v Version 1.0 Computer Security: Art and Science, 2nd Edition

Theorems Safety decidable for systems with acyclic MTAM schemes In fact, it’s NP-hard Safety for acyclic ternary MATM decidable in time polynomial in the size of initial ACM “Ternary” means commands have no more than 3 parameters Equivalent in expressive power to MTAM Version 1.0 Computer Security: Art and Science, 2nd Edition

Security Properties Question: given two models, do they have the same security properties? First comes theory Then comes an example comparison Basic idea: view access request as query asking if subject has right to perform action on object Version 1.0 Computer Security: Art and Science, 2nd Edition

Alternate Definition of “Scheme”
Σ set of states Q set of queries e: Σ × Q → {true, false } Called entailment relation T set of state transition rules (Σ, Q, e, T) is an access control scheme Version 1.0 Computer Security: Art and Science, 2nd Edition

Alternate Definition of “Scheme”
s tries to access o Corresponds to query q  Q If state σ  Σ allows access, then e(σ, q) = true; otherwise, e(σ, q) = false Write change of state from σ0 to σ1 as σ0 ↦ σ1 Emphasizing we’re looking at permissions Multiple transitions are σ0 ↦τ* σn Σn said to be τ-reachable from σ0 Version 1.0 Computer Security: Art and Science, 2nd Edition

Example: Take-Grant Σ set of all possible protection graphs Q set of queries { can•share(α, v1, v2, G0) | α  R, v1, v2  G0 } e(σ0, q) = true if q holds; e(σ0, q) = false if not T set of sequences of take, grant, create, remove rules Version 1.0 Computer Security: Art and Science, 2nd Edition

Security Analysis Instance
Let (Σ, Q, e, T) be an access control scheme Tuple (σ, q, τ, Π) is security analysis instance, where: σ  Σ – τ  T q  Q – Π is ∀ or ∃ If Π is ∃, existential security analysis Is there a state σ such that σ ↦τ* σ, e(σ, q) = true? If Π is ∀, universal security analysis For all states σ such that σ ↦τ* σ, is e(σ, q) = true? Version 1.0 Computer Security: Art and Science, 2nd Edition

Example: Take-Grant σ0 = G0 q is can•share(r, v1, v2, G0) τ is sequence of take-grant rules Π is ∃ Security analysis instance examines whether v1 has r rights over v2 in graph with initial state G0 So safety question is security analysis instance Version 1.0 Computer Security: Art and Science, 2nd Edition

Comparing Two Models Each query in A corresponds to a query in B Each (state, state transition) in A corresponds to (state, state transition) in B Formally: A = (ΣA, QA, eA, TA) and B = (ΣB, QB, eB, TB) mapping from A to B is: f : (ΣA × TA)  QA  (ΣB × TB)  QB Version 1.0 Computer Security: Art and Science, 2nd Edition

Image of Instance f mapping from A to B image of a security analysis instance (σA, qA, τA, Π) under f is (σB, qB, τB, Π), where: f((σA, τA)) = (σB, τB) f(qA) = qB f is security-preserving if every security analysis instance in A is true iff its image is true Version 1.0 Computer Security: Art and Science, 2nd Edition

Composition of Queries
Let (Σ, Q, e, T) be an access control scheme Tuple (σ, φ, τ, Π) is compositional security analysis instance, where φ is propositional logic formula of queries from Q image of compositional security analysis instance defined similarly to previous f is strongly security-preserving if every compositional security analysis instance in A is true iff its image is true Version 1.0 Computer Security: Art and Science, 2nd Edition

State-Matching Reduction
A = (ΣA, QA, eA, TA), B = (ΣB, QB, eB, TB), f mapping from A to B σA, σB equivalent under the mapping f when eA(σA, qA) = eB (σB, qB) f state-matching reduction if for all σA  SA, τA  TA, (σB, τB) = f ((σA, τA)) has the following properties: Version 1.0 Computer Security: Art and Science, 2nd Edition

Property 1 For every state σA in scheme A such that σA ↦τ* σA, there is a state σB in scheme B such that σB ↦τ* σB, and σA and σB are equivalent under the mapping f That is, for every reachable state in A, a matching state in B gives the same answer for every query Version 1.0 Computer Security: Art and Science, 2nd Edition

Property 2 For every state σB in scheme B such that σB ↦τ* σB, there is a state σA in scheme A such that σA ↦τ* σA, and σA and σB are equivalent under the mapping f That is, for every reachable state in B, a matching state in A gives the same answer for every query Version 1.0 Computer Security: Art and Science, 2nd Edition

Theorem Mapping f from scheme A to B is strongly security-preserving iff f is a state-matching reduction Version 1.0 Computer Security: Art and Science, 2nd Edition

Proof () Must show (σA, φA, τA, Π) true iff (σB, φB, τB, Π) true Π is ∃: assume τA-reachable state σA from σA in which φA true By property 1, there is a state σB corresponding to σA in which φB holds Π is ∀: assume τA-reachable state σA from σA in which φA false By property 1, there is a state σB corresponding to σA in which φB false Same for φB with τB-reachable state σB from σB So (σA, φA, τA, Π) true iff (σB, φB, τB, Π) true Version 1.0 Computer Security: Art and Science, 2nd Edition

Proof (⟸) Let f be map from A to B but not state-matching reduction. Then there are σA  SA, τA  TA, (σB, τB) = f ((σA, τA)) violating at least one of the properties Assume it’s property 1; σA, σB corresponding states. There is a τA-reachable state σA from σA such that no τB-reachable state from σB is equivalent to σB Generate φA and φB such that the existential compositional security analysis in A is true but in B is false To do this, look at each qA  QA If e(σA, qA) = true, conjoin qA to φA; otherwise, conjoin ¬qA to φA Then e(σA, qA) = true but for φB = f(φA) and all states σB that are τB-reachable from σB, e(σB, qB) = false Thus, f is not strongly security-preserving Argument for property 2 is similar Version 1.0 Computer Security: Art and Science, 2nd Edition

Expressive Power If access control model MA has a scheme that cannot be mapped into a scheme in access control model MB using a state-matching reduction, then model MB is less expressive than model MA. If every scheme in model MA can be mapped into a scheme in model MB using a state-matching reduction, then model MB is as expressive as model MA. If MA is as expressive as MB, and MB is as expressive as MA, the models are equivalent Note this does not assume monotonicity, unlike earlier definition Version 1.0 Computer Security: Art and Science, 2nd Edition

Augmented Typed Access Control Matrix
Add a test for the absence of rights to TAM command add•right(s:u, o:v) if own in a[s,o] and r not in a[s,o] then enter r into a[s,o] end How does this affect the answer to the safety question? Version 1.0 Computer Security: Art and Science, 2nd Edition

Safety Question ATAM can be mapped onto TAM But will the mapping, or any such mapping, preserve security properties? Approach: consider TAM as an access control model Version 1.0 Computer Security: Art and Science, 2nd Edition

TAM as Access Control Model
S set of subjects; Sσ subjects in state σ O set of objects; Oσ objects in state σ R set of rights; Rσ rights in state σ T set of types; Tσ subjects in state σ t : Sσ ∪ Oσ ⟶ Tσ gives type of any subject or object State σ defined as (Sσ, Oσ, Rσ, Tσ, t) In TAM, query is of form “is r ∈ a[s,o]”, and e(s, r ∈ a[s,o]) true iff s ∈ Sσ, o ∈ Oσ, r ∈ Rσ, r ∈ aσ[s,o] are true Version 1.0 Computer Security: Art and Science, 2nd Edition

ATAM as Access Control Model
Same as TAM with one addition: ATAM also allows queries of form “is r ∉ a[s,o]”, and e(s, r ∉ a[s,o]) true iff s ∈ Sσ, o ∈ Oσ, r ∈ Rσ, r ∉ aσ[s,o] are true Version 1.0 Computer Security: Art and Science, 2nd Edition

Theorem A state-matching reduction from ATAM to Tam does not exist. Outline of proof: by contradiction Consider two state transitions, one that creates subject and one that adds right r to an element of the matrix Can determine an upper bound on the number of answers to TAM query a command can change; depends on state and commands Version 1.0 Computer Security: Art and Science, 2nd Edition

Proof Assume f is state-matching reduction from ATAM to TAM Consider simple ATAM scheme: Initial state σ0 has no subjects, objects All entities have type t Only one right r Query qij = r ∈ a[s,o]; query qij = r ∉ a[s,o] 2 state transition rules make•subj(s : t) creates subject s of type t add•right(x : t, y : t) adds right r to a[x, y] Version 1.0 Computer Security: Art and Science, 2nd Edition

Proof TAM: superscript T represents components of that system So initial state is σ0 T = f(σ0), transitions are 𝜏T = f(𝜏) By definition of state-matching reduction, how f maps queries does not depend on initial state or state transitions of a model Let p, q be queries in ATAM and pT, qT the corresponding queries in TAM; if p ≠ q, then pT ≠ qT As commands in TAM execute, they can change the value (response) of qij Upper bound on the number of values of queries a single command can change is m (number of enter or add•right operations) Version 1.0 Computer Security: Art and Science, 2nd Edition

Proof Choose n > m In ATAM, construct state σk such that: σ0 ⟶* σk; and e(σk, ¬q1,1 ∧ q1,1 ∧ ∧ ¬qn,n ∧ qn,n) is true So e(σk, qi,j) is false, e(σk, qi,j) is true for all 1 ≤ i, j ≤ n As f is a state-matching reduction, there is a state σkT in TAM that causes the corresponding queries to be answered the same way Consider σ0T ⟶ σ1T ⟶ ⟶ σkT; choose first state σCT such that e(σCT, qi,jT ∨ qi,jT) is true for all 1 ≤ i, j ≤ n Version 1.0 Computer Security: Art and Science, 2nd Edition

Proof In σC-1T, e(σC-1T, qv,wT ∨ qv,wT) is false for some 1 ≤ v, w ≤ n, so e(σC-1T, ¬qv,wT ∧ ¬qv,wT) is true State σ in ATAM for which e(σ, ¬qv,w ∧ ¬qv,w) is true is one in which either sv or sw or both does not exist Thus in that state, one of the following 2 queries holds: Q1 = ¬qv,1 ∧ ¬qv,1 ∧ ∧ ¬qn,v ∧ ¬qn,v Q1 = ¬qw,1 ∧ ¬qw,1 ∧ ∧ ¬qn,w ∧ ¬qn,w So in TAM, e(σC-1T, Q1T ∧ Q2T) is true Version 1.0 Computer Security: Art and Science, 2nd Edition

Proof Now consider the transition from σC-1T to σCT Values of at least n queries in Q1 or Q2 must change from false to true But each command can change at most m < n queries This is a contradiction So no such f can exist, proving the result Thus, ATAM can express security properties that TAM cannot Version 1.0 Computer Security: Art and Science, 2nd Edition

Key Points Safety problem undecidable Limiting scope of systems can make problem decidable Types critical to safety problem’s analysis Version 1.0 Computer Security: Art and Science, 2nd Edition

Computer Security: Art and Science, 2nd Edition

Similar presentations

Presentation on theme: "Computer Security: Art and Science, 2nd Edition"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Computer Security: Art and Science, 2nd Edition

Similar presentations

Presentation on theme: "Computer Security: Art and Science, 2nd Edition"— Presentation transcript:

Similar presentations

About project

Feedback