Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
101
3. The integrity is monitored (based on user information Ki or without
it) of all objects of the base OS located on some media, locally or remotely
(via LAN technical means) associated with Tt.
4. The base operating system is loaded and the integrity of the gateway
software is monitored.
5. The gateway software is loaded (at the same time, the OSj file
structure located locally on Tm becomes available, at least in read mode).
6. The integrity of objects at levels lower than Rj (Rj is the maximum
level of representation of objects in OSj) for OSj (see above) is monitored.
7. The integrity of Rj level objects (files) OSj is monitored.
8. The integrity of the object that specifies the loading sequence of
components is monitored.
9. Forced loading is carried out (the loading order of OS components,
predetermined due to the integrity of Oz objects and the sequence ZL, is
initiated) of OSj, checked for integrity.
Statement 8 (conditions for generating ISE when implementing the
method).
Let the OS kernel contain an OSM and an SSM, the subjects initiated
in the OS are correct in pairs, their source objects belong to the set that are
checked for immutability during trusted loading, the OSM prohibits
changing any source object, and the trusted OS loading procedure has been
completed. Then, after the OS kernel is initiated, an ISE is generated.
Proof. The procedure of trusted loading by construction ensures the
immutability of Oz and ZL, according to the condition of the statement, only
source objects belonging to Oz are allowed to generate subjects, the
immutability of source objects by condition is guaranteed by the properties
of the OSM. Consequently, the conditions of Statement 5 are satisfied and
the ISE is generated. The statement has been proven [1].
102
CHAPTER 4. MATHEMATICAL MODELS
OF INFORMATION SECURITY2
An information security model is a formal expression of a security
policy.
Formal models are necessary and used quite widely, because only with
their help can one prove the safety of a system, while relying on objective
and irrefutable postulates of mathematical theory. Security models make it
possible to justify the viability of a system and determine the basic
principles of its architecture and the technological solutions used in its
construction. The main goal of creating a security policy for an information
system and describing it in the form of a formal model is to determine the
conditions to which the behavior of the system must be subject, to develop
a security criterion and to conduct a formal proof of the system’s compliance
with this criterion while observing the established rules and restrictions.
In addition, formal security models make it possible to solve a whole
range of problems that arise during the design, development and
certification of secure systems, therefore they are used not only by
information security theorists, but also by other categories of specialists
involved in the process of creating and operating secure information systems
(manufacturers, consumers, expert qualifiers).
Manufacturers of secure information systems use security models in
the following cases:
• when drawing up a formal specification of the security policy of the
system being developed;
• when choosing and justifying the basic principles of the architecture
of a protected system, which determine the mechanisms for implementing
security measures;
• in the process of analyzing the security of the system as a reference
model;
2
All figures in this chapter are taken from « Защита информации в цифровых системах
связи».
103
• when confirming the properties of the developed system by formally
proving compliance with the security policy.
By drawing up formal security models, consumers are able to
communicate their requirements to manufacturers in a clearly defined and
consistent manner, as well as evaluate the suitability of protected systems
for their needs. Qualification experts, when analyzing the adequacy of
security policy implementation in protected systems, use security models as
references.
All considered security models are based on the following basic
concepts:
1. A system is a collection of interacting entities — subjects and
objects. Security of information processing is ensured by solving the
problem of controlling subjects’ access to objects in accordance with a given
set of rules and restrictions that form a security policy. A system is
considered secure if subjects are unable to violate the rules of the security
policy.
2. All interactions in the system are modeled by establishing
relationships of a certain type between subjects and objects. The set of
relationship types is defined as a set of operations that subjects can perform
on objects.
3. All operations are controlled by the interaction monitor and are
either prohibited or allowed in accordance with the security policy rules.
4. The security policy is specified in the form of rules in accordance
with which all interactions between subjects and objects must be carried out.
Interactions that violate these rules are blocked by access controls and
cannot be implemented.
5. The set of sets of subjects, objects and relationships between them
(established interactions) determines the state of the system. Each state of
the system is either safe or unsafe according to the safety criterion proposed
in the model.
6. The main element of the security model is the proof of the statement
(theorem) that a system in a safe state cannot go into an unsafe state if all
established rules and restrictions are observed.
104
4.1. CLASSIFICATION OF MATHEMATICAL MODELS
OF INFORMATION SECURITY BY MAIN TYPES OF THREATS
Fig. 4.1. Classification of information security models
1. Model of non-derivability
2. Laissez faire model
Threat Protection
Protection from the threat of disclosure
Models of access control
based on the principle
of granting rights
Probabilistic models
Information models
Discretionary (discrete)
access models
Mandatory access
models
Role-based access model
Protection against integrity threats
Protection against the threat of service failure
1. Access matrix
2. Harrison — Ruzzo — Ullman model
3. Take-Grant model
4. Model ADEPT-50
5. Hurston model
1. Game model
2. Full overlap model
Bell — LaPadula model
1. Biba model
2. Clark-Wilson model
1. Mandate model
2. Millen model of resource allocation
105
4.2. ACCESS CONDITION MODELS
4.2.1. Description of the protection system
using the access matrix
Let O be a set of objects, S be a set of subjects, S O. Let U = {U1, ...,
Um} be a set of users. Let us define the mapping: own: О → U.
According to this mapping, each object is declared to be the property
of the corresponding user. A user who owns an object has all access rights
to it, and sometimes the right to transfer some or all rights to other users. In
addition, the owner of an object determines the access rights of other
subjects to this object, that is, the security policy regarding this object. The
specified access rights are written in the form of an access matrix (Fig. 4.2),
the elements of which are subsets of the set R that determine the access of
the subject S to the object Oi (i = 1, 2, ...; j = 1, 2, ...).
Fig. 4.2. Access Matrix
There are several options for specifying the access matrix:
1. Opportunity sheets: for each subject Si, a sheet (file) of all objects
to which this object has access is created.
2. Access control sheets: for each object, a list of all subjects who have
access rights to this object is created.
The discretionary policy is related to the original model in such a way
that the trajectories of processes in the computing system are limited in each
access. Moreover, the vertices of each graph are divided into classes, and
106
access in each class is determined by its own rules for each owner. The set
of unfavorable trajectories N for the class of policies under consideration is
determined by the presence of unfavorable states, which, in turn, are
determined by prohibitions on some arcs. Discretionary policies are the most
researched. There are many variations of this policy. However, this policy
cannot solve many protection problems. One of the most significant
weaknesses of this class of policies is that they do not withstand Trojan
horse attacks. This means, in particular, that a security system that
implements a discretionary policy provides poor protection against the
penetration of viruses into the system and other means of hidden destructive
influence. Let us use an example to demonstrate the principle of a Trojan
Horse attack in the case of a discretionary policy.
Example 1: Let U1 be some user, and U2 be a malicious user, O1 be an
object containing valuable information, O2 be a program with a Trojan
horse, T and M be an access matrix, which has the form:
Fig. 4.3. Access Matrix
The penetration of the program occurs as follows. The attacker U2
creates the program O2 and, being its owner, allows U1 to run it and write
information to the object O2. After that, he somehow initiates U1 to run this
program (for example, O2 presents an interesting computer game that he
offers to U1 for entertainment). U1 launches O2 and thereby launches the
hidden program T, which, having the rights of U1 (since it was launched by
user U1), writes down the information contained in O1. After this, the owner
107
U2 of object O2, using all rights, has the opportunity to read valuable
information of object O1 from O2.
The next problem with discretionary policies is the automatic
determination of entitlements. Since there are many objects, it is impossible
to manually specify in advance the list of rights of each subject to access the
object. Therefore, the access matrix is aggregated in various ways, for
example, only users are left as subjects, and function formulas are inserted
into the corresponding cell of the matrix, the calculation of which
determines the access rights of the subject generated by the user to object O.
Of course, these functions can change over time. In particular, it is possible
to revoke rights after the completion of some event. Modifications
depending on other parameters are possible.
One of the most important problems when using discretionary policies
is the problem of controlling the distribution of access rights. Most often, it
happens that the owner of a file transfers the contents of the file to another
user and that user thereby acquires the owner’s rights to the information.
Thus, rights can be extended, and even if the original owner did not want to
transfer access to some subject S to his information in O, then after a few
steps the transfer of rights can take place regardless of his will. The problem
arises of the conditions under which in such a system some subject will
sooner or later receive the access he requires. This problem was studied in
the “take-grant” model, when the form of transfer or taking of rights is
defined in the form of a special access right (instead of own).
4.2.2. Harrison — Ruzzo — Ullman discretionary model
The Harrison — Ruzzo — Ullman security model, which is a classic
discretionary model, implements arbitrary control of subject access to
objects and control over the distribution of access rights.
Within the framework of this model, the information processing
system is represented as a set of active entities — subjects (set S) that access
information, passive entities — objects (set O) containing protected
information, and a finite set of access rights R = {g1p ... gn}, indicating
108
permissions to perform the corresponding actions (for example, read, write,
execute).
The behavior of the system is modeled using the concept of state. The
state space of the system is formed by the Cartesian product of the sets of
its constituent objects, subjects and rights — OxSxR. The current state of
the system Q in this space is determined by a triple consisting of a set of
subjects, a set of objects and a matrix of access rights M, which describes
the current access rights of subjects to objects — Q = (S,O,M). The rows of
the matrix correspond to subjects, and the columns correspond to objects,
since a set of objects includes a set of subjects, the matrix has the form of a
rectangle. Any cell of the matrix M[s,o] contains a set of rights of subject s
to object o, belonging to the set of access rights R. The behavior of the
system over time is modeled by transitions between different states. The
transition is carried out by making changes to the matrix M using
commands.
In the classical model, only the following elementary operations are
allowed:
• enter r into M[s,o] (adding subject s the right r for object o);
• delete r from M[s,o] (deleting subject s' right r for object o);
• create subject s (creating a new subject s);
• create object o (creating a new object o);
• destroy subject s (deleting an existing subject s);
• destroy object o (deleting an existing object o).
The application of any elementary operation op in a system in the state
Q = (S,O,M) entails a transition to another state Q' = (S',O',MI), which
differs from the previous state Q at least one component.
The enter operation introduces the right r into an existing cell of the
access matrix. The contents of each cell are considered as a set, i.e. if this
right already exists, then the cell is not changed. The enter operation is called
monotonic because it only adds permissions to the access matrix and does
not remove anything. The delete operation is the opposite of the enter
operation. It removes the right from the access matrix cell if it is present
there. Because the contents of each cell are treated as a set, delete does
109
nothing if the specified cell has no right to be deleted. Since delete removes
information from the access matrix, it is called a non-monotonic operation.
The create subject and destroy subject operations are a similar pair of
monotonic and non-monotonic operations.
Note that for each operation there is also a precondition for its
execution: in order to change a cell of the access matrix using the enter or
delete operations, it is necessary that this cell exists, that is, that the
corresponding subject and object exist. Preconditions for creation
operations create subject/object is the absence of the subject/object being
created, and delete operations destroy subject/object are the presence of the
subject/object. If the precondition of any operation is not satisfied, then its
execution is unsuccessful.
The formal description of the system (Q,R,C) consists of the
following elements:
• finite set of access rights R = {r
1
, …, r
n
};
• finite sets of initial subjects So = {s
1
, …, s
i
} and objects О0 = {o
1
, …,
о
m
}, where So О0;
• the initial access matrix containing the access rights of subjects to
objects — Mo;
• a finite set of commands O{aj(x1, xk)}, each of which consists of
execution conditions and interpretation in terms of the listed elementary
operations.
The behavior of the system over time is modeled using a sequence of
states {Qj}, in which each subsequent state is the result of applying some
command from the set C to the previous one Q
n+1
= Cn(Qn). Each state
defines the access relationships that exist between system entities in the
form of a set of subjects, objects and a matrix of rights. Since some access
relationships must be restricted to ensure security, given the initial state of
the system, it must be possible to determine the set of states into which it
can go from there. This will make it possible to set such initial conditions
(interpretation of commands C, set of objects Oo, subjects So and access
matrix Mo) under which the system can never get into states that are not
desirable from a security point of view. Consequently, to build a system with
110
predictable behavior, it is necessary, for given initial conditions, to obtain
an answer to the question: will some subject s ever be able to acquire the
access right r for some object O?
The safety criterion for the Harrison — Ruzzo — Ullman model is
formulated as follows:
For a given system, the initial state Qo = (So, Oo, Mo) is safe with
respect to right r if there is no sequence of commands applicable to Qo, as
a result of which right r will be entered into a cell of the matrix M in which
it was absent in the state QO.
The meaning of this criterion is that for a secure system configuration,
a subject will never receive the right of access to an object if he did not have
it initially.
From the security criterion it follows that for this model the key role
is played by the choice of access rights values and their use in command
conditions. Although the model does not impose any restrictions on the
meaning of rights and considers them to be equivalent, those that are
involved in command execution conditions are in fact not access rights to
objects (such as read and write), but access control rights, or rights to modify
the cells of the access matrix. Thus, in essence, this model describes not only
the access of subjects to objects, but the distribution of access rights from
subject to subject, since it is the change in the content of the cells of the
access matrix that determines the possibility of executing commands,
including commands that modify the access matrix itself, which potentially
may lead to a violation of safety criteria.
It should be noted that from the point of view of the practice of
building secure systems, the Harrison — Ruzzo — Ullman model is the
simplest to implement and most effective to manage, since it does not
require any complex algorithms, and allows you to manage user permissions
up to an operation on an object, which explains its prevalence among
modern systems. In addition, the security criterion proposed in this model is
very strong in practical terms, since it allows us to guarantee the
inaccessibility of certain information to users who are not initially given the
appropriate permissions.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]