Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
111
However, Harrison, Ruzzo, and Ullman proved that in general there is
no algorithm that can, given an arbitrary system, its initial state Qo = (So,
Oo, Mo), and the general law r, decide whether a given configuration is
secure. The proof is based on the properties of the Turing machine, which
is used to model the sequence of transitions of the system from state to state.
As already mentioned, all discretionary models are vulnerable to
Trojan horse attacks because they control only the access operations of
subjects to objects, and not the flow of information between them.
Therefore, when a Trojan horse that an attacker slips onto some user
transfers information from an object accessible to that user to an object
accessible to the attacker, then formally no discretionary security policy rule
is violated, but information is leaked.
Thus, the discretionary Harrison — Ruzzo — Ullman model in its
general formulation does not guarantee the security of the system, but it
served as the basis for a whole class of security policy models that are used
to access control and the distribution of rights in all modern systems control.
4.2.3. Take-Grant model
The Take-Grant model of access rights distribution, first proposed in
1976, is used to analyze discretionary access control systems, primarily to
analyze the paths of access rights distribution in such systems. The main
elements of the model are the access graph and the rules for its
transformation. The purpose of the model is to answer the question about
the possibility of a system subject obtaining access rights to an object in the
state described by the access graph. Currently, this model has been
continued as an extended Take-Grant model, which examines the ways in
which information flows arise in systems with discretionary access control.
Let’s move on to a formal description of the model. Let’s denote:
O — set of objects (files), S — set of active subjects (users); R = {r,w,c} is
the set of accesses, where r is read, w is write, c is call. It is assumed that
subject X may have rights R to access object Y, these rights are recorded
in the access control matrix. In addition to these rights, we will introduce
112
two more: the take (t) right — the right to take access rights and the grant
(g) right — the right to give access rights, which are also recorded in the
subject’s access control matrix to objects. We can consider that these rights
determine the possibilities of transforming some state graphs into others.
State transformation, that is, transformation of access graphs, is carried out
using commands. There are 4 types of commands by which one access graph
is converted to another.
1. Take. Let S be a subject who has the right t to object X and R
be some access right of object X to object Y. Then the command S take
for Y from X is possible. As a result of executing this command, the set of
access rights of subject S to object Y is added right . Graphically, this
means that if the original access graph G had a subgraph
YXS
αt
⎯→⎯⎯→⎯
,
then in the new state G', constructed using this command t, there will be a
subgraph
2. Grant (to give). Let the subject S have the right g to object X and
the right R to object Y. Then the command S grant for Y to X is
possible. As a result of executing this command, the access graph G is
transformed into a new graph G', which differs from G by the added arc (X Y).
Graphically, this means that if the original graph G had a subgraph
then in the new state G there will be a subgraph
113
3. Create. Let S be a subject, R. The command S create P for new
object X creates a new vertex X in the graph and defines P as the access
rights of S to X. That is, in comparison with the graph G in the new state G',
a subgraph of the form is added
.
4. Remove. Let S be the subject and X be the object, R. The
command S remove P for X removes the access rights P from the rights of
the subject S to the object X. Graphically, the transformation of the access
graph G into a new state G' as a result of this command can be depicted as
follows:
.
By security we mean the ability or impossibility of an arbitrary fixed
vertex P to gain access R to an arbitrary fixed vertex X by transforming
the current graph G by a certain sequence of commands into a graph G',
where the specified access is allowed.
Definition. In an access graph G, vertices P and S are said to be tg-
connected if there is a path in G connecting P and S, regardless of the
orientation of the arcs, but such that each edge of this path has a label
including t or g.
Let us accept the following theorems without proof.
Theorem 1. A subject P can access an object X if there is a subject S
that has access a to a vertex X such that the subjects P and S are connected
by an arbitrarily oriented arc containing at least one of the rights t or g.
Theorem 2. Let all objects in the system be subjects. Then subject P
can access subject X if and only if the following conditions are met:
XS
β
⎯→⎯
XSX,S
p/βp
⎯→⎯⎯→⎯
114
1. There is a subject S such that the current graph G contains an arc
.
2. S tg is related to P.
To distinguish them from the rules of the extended Take-Grant model,
we will call the listed rules “Take”, “Give”, “Create”, “Destroy” de jure
rules.
4.2.4. Extended Take-Grant Model
The extended Take-Grant model examines the paths and costs of
information flows in systems with discretionary access control.
The classic Take-Grant model essentially considers two access rights:
t and g, as well as four rules (de jure rules) for transforming the access graph.
The extended model additionally considers two rights: to read r (read) and
to write w (write), as well as six rules (de facto rules) for transforming the
access graph: pose, spy, find, pass and two untitled rules.
As a result of applying de facto rules to the access graph, imaginary
arcs are added to it, marked r or w and depicted by dotted lines (Fig. 4.4).
Together with the graph arcs corresponding to rights r and w (real arcs),
imaginary arcs indicate the directions of information channels in the system.
The state of the system is described by its graph. The transition from
state to state is determined by operations or rules for transforming the access
graph. The transformation of graph G and graph G' as a result of fulfilling
the op rule will be denoted by GopG'.
The de jure rules for transforming the access graph cannot be applied
to imaginary arcs. Information channels cannot be taken or transmitted to
other system objects.
Interaction problems are a central issue when stealing access rights.
Each de jure rule requires the participation of one subject to achieve
its goal, and one or two subjects are required to implement the de facto rule.
It is desirable to identify a subset of so-called conspiratorial subjects in the
set of all subjects — participants in the processes of transfer of rights or
information. In small systems this task can be easily solved. By repeatedly
XS
α
⎯→⎯
115
looking through the access graph and applying all possible de jure and de
facto rules to it, you can find a closure of the access graph that will contain
arcs corresponding to all information channels of the system. However, if
the access graph is large, then finding its closure is very difficult.
r
x y
r
w
x y
x y
x y
x y
x y
x y
x y
x y
x y
x y
x y
r
r r
r
r
r
r
r
r
r
w w
w w
w
w
w w w w
w
w
w
w
r r
z
z
z
z
z
z
z
z
post(x,y,z)
spy(x,y,z)
find(x,y,z)
pass(x,y,z)
Fig. 4.4. De facto rules
116
Let’s say that an unwanted transfer of rights or information has taken
place. What is the most likely way to implement it? In the classic TakeGrant model, there is no direct answer.
Let us assume that the more nodes on the path between the vertices
along which access rights have been transferred or information flow has
occurred, the less likely it is to use this path. For example, in Fig. 4.5 it is
clear that intuitively the most likely path for transmitting information from
subject z to subject x is through object y. At the same time, an attacker can
deliberately use a longer path.
y
zx
r
w
r w
t
t
Fig. 4.5. Paths for the emergence of an information channel from z to x
Thus, the concept of probability and cost of the path of transfer of
rights or information can be included in the extended Take-Grant model.
The least cost paths have the highest probability and are explored first.
Discretionary models also include the ADEPT-50 model and the
Hurston model. Let’s give them a brief description.
4.2.5. Model ADEPT-50
This model presents four types of entities (any named component of a
computer system): users (u), jobs (j), terminals (t) and files (f), and each
entity is described by a triple: (L, F, M), where mode M — a set of access
types, powers F — a group of users who have the right to access a specific
object.
117
Let us formulate the rules of this model:
1. User u gains access to the system u U.
2. User u gains access to terminal t u F(t), i.e., in the case when
the user has the right to use terminal t.
3. The user gains access to file j A(j) A(f), C(j) C(f), M(j) M,
f F(f), i.e. in the case:
• the privileges of the job being executed are greater than or equal to
the file privileges;
• the user is a member of F(f).
That is, a user gains access to an object when he belongs to a group of
users who have access to this object, and his assignment is greater than or
equal to the object’s privileges. For example, the highest file access
permission for user “top secret” executing a task from a “confidential”
terminal will be “confidential”.
4.2.6. Hurston model
The model has five main sets:
A — established powers;
U — users;
E — operations;
R — resources;
S — states.
The security area will look like the product:
A U E R S.
The process of organizing access can be described algorithmically. It
will consist of the following procedures:
1. Call all auxiliary programs necessary for making a preliminary
decision.
2. Determine from U those groups to which u belongs. Then select
from P (the set of defined powers) the power specifications to which u
corresponds. This permission set F(u) defines the privilege of user u.
118
3. From P, define a set of powers F(e), establishing e as the main
operation. This set is called privilege e.
4. Define from P a set F(R) (unit resource privilege) — powers that
define a subset of resources from R1 (specific resource units) that have
common elements with R.
5. Make sure that R is fully included in D(q) = F(u) F(e)F(R)
(authority domain).
6. Partition D(q) into equivalent classes so that two powers fall into
the equivalent class if and only if they specify the same unit of resource. The
new set of privileges F(u,q) is the privilege of user u over request q.
7. Calculate EAC — the actual access condition corresponding to
request q.
8. Evaluate the EAC and make a decision on access:
• allow access to R if R is overlapped;
• deny access otherwise.
9. Record the necessary events.
10. Call all programs necessary to make a decision.
11. Execute all auxiliary programs.
12. If the access decision is positive, complete physical processing.
That is, the user can gain (or not gain) access to information after first
going through the appropriate stages of identification (definition of the
group, its powers, conditions of actual access, etc.).
This model is not always necessary in full. For example, when
registering a system user, points 2 and 6 are required.
4.2.7. Mandatory Bell — LaPadula model
The mandated access control model is based on the rules of secret
document flow adopted in state and government agencies in many countries.
The main provision of the Bell — LaPadula policy, taken from real life, is
to assign a special label to all participants in the process of processing
protected information and the documents in which it is contained, for
example, secret, top secret, etc., called the security level. All security levels
119
are ordered by an established dominance relationship, such as the top secret
level is considered higher than or dominates the secret level. Access control
is carried out depending on the security levels of the interacting parties
based on two simple rules:
1. An authorized person (subject) has the right to read only those
documents whose security level does not exceed his own security level.
2. An authorized person (subject) has the right to enter information
only into those documents whose security level is not lower than his own
security level.
The first rule ensures the protection of information processed by more
trusted (high-level) persons from access by less trusted (low-level) persons.
The second rule (later we will see that it is more important) prevents the
leakage of information (conscious or unconscious) from high-level
participants in the information processing process to low-level ones.
Thus, if in discretionary models access control occurs by granting
users the authority to perform certain operations on certain objects, then
mandatory models control access implicitly — by assigning to all entities a
system of security levels that determine all permissible interactions between
them.
The system in the Bell — LaPadula security model, as in other models,
is represented as sets of subjects S, objects O (the set of objects includes a
set of subjects, ScO) and access rights gead and write. The mandate model
considers only these two types of access, and although it can be expanded
by introducing additional rights (for example, the right to add information,
execute programs, etc.), all of them will be mapped to the basic ones (read
and write). The use of such a rigid approach, which does not allow for
flexible access control, is explained by the fact that in the mandate model it
is not the operations carried out by the subject on the object that are
controlled, but information flows, which can be of only two types: either
from the subject to the object (record), or from object to subject (reading).
The security levels of subjects and objects are specified using the
security level function F:SO→L, which assigns each subject and object a
security level belonging to the set of security levels L.
120
4.2.8. Security level grid
The security level lattice is a formal algebra (L, <, •, ), where L is
the basic set of security levels, and the operator < defines a partial non-strict
order relation for the elements of this set, i.e. the operator < is
antisymmetric, transitive and reflexive . Relation < on L:
1) reflexively, if а L: а < а;
2) antisymmetric if a1, а2 L: (а1 < а2 а2 < a1 ) а1 = а2;
3) transitive if a
1
, а2, а
3
L: (а
1
< а
2
а2 < a3 ) а1 < а.
Another property of the lattice is that for each pair a1 and a2 of
elements of the set L, one can specify a unique element of the smallest upper
bound and a single element of the largest lower bound. These elements also
belong to L.
The meaning of these definitions is that for each pair of elements it is
always possible to specify a single element that bounds it above or below in
such a way that there are no other elements between them and this element.
The security level function F assigns each subject and object a certain
security level from L, dividing the set of system entities into classes within
which their properties are equivalent from the point of view of the security
model. Then the operator < determines the direction of information flows,
that is, if F(A) < F(B), then information can be transferred from elements of
class A to elements of class B.
Let us show why the Bell — LaPadula model uses a lattice to describe
the dominance relationship at multiple security levels.
If information can be transferred from entities of class A to entities of
class B, and also from entities of class B to entities of class A, then classes
A and B contain single-level information and from a security point of view
are equivalent to one class (AB). Therefore, to remove redundant classes, it
is necessary that the relation < be antisymmetric.
If information can be transferred from entities of class A to entities of
class B, and also from entities of class B to entities of class C, then it is
obvious that it will also be transferred from entities of class A to entities of
class C. Thus, the relation < must be transitive.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]