Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
121
Since the class of an entity determines the security level of the
information it contains, all entities of the same class contain the same
information from a security point of view. Therefore, there is no point in
prohibiting information flows between entities of the same class. Moreover,
for purely practical reasons, it is necessary to provide for the ability for an
entity to transmit information to itself. Therefore, the relation < must be
reflexive.
Using a lattice to describe the relationships between security levels
allows you to use as security attributes (elements of the set L) not only
integers for which the “less than or equal” relation is defined, but also more
complex composite elements. For example, in government organizations
quite often, combinations consisting of a security level, which is an integer,
and a set of categories from a certain set are used as security attributes.
4.2.9. Classic Bell — LaPadula mandate model
In mandatory models, the security level function F, together with a
lattice of levels, determines all admissible access relationships between
system entities, therefore the set of system states V is represented as a set of
ordered pairs (F,M), where M is an access matrix reflecting the current
situation with access rights subjects to objects, the content of which is
similar to the matrix of access rights in the Harrison — Ruzzo — Ullman
model, but the set of rights is limited to the read and write rights. The system
model (vо,R,T) consists of an initial state vо, a set of requests R and a
transition function T:(VxR)→V, which, during the execution of a request,
transfers the system from one state to another. A system in state v V, upon
receiving a request r R, goes to the next state v* = T(v, r). State v is reachable
in the system (vo,R,T) if and only if there is a sequence<(r0,vo), …,
(r
n–1,Vn–1
).(rn,v)> such that T(ri vi) = v
i+1
for 0 < i < n.
As for the discretionary model, system states are divided into secure,
in which access relations do not contradict the rules established in the model,
and unsafe, in which these rules are violated and information leakage occurs.
122
Bell and Lapadula proposed the following definition of a safe state:
1. A state (F,M) is called read-safe (or simply safe) if and only if for
each subject performing read access to an object in this state, the security
level of this subject dominates the security level of this object.
2. A state (F,M) is called write-safe (or * — safe) if and only if for
each subject performing write access to an object in this state, the security
level of this object dominates the security level of this subject.
3. A state is safe if and only if it is safe both for reading and writing.
In accordance with the proposed definition of a safe state, the system
safety criterion is as follows:
A system (vo, R, T) is safe if and only if its initial state vо is safe
and all states reachable from v0 by applying a finite sequence of queries
from R are safe.
Bell and Lapadula proved a theorem that formally proves the security
of a system under certain conditions, called the fundamental security
theorem.
The main Bell — LaPadula safety theorem [4].
A system Z(vo, R, T) is secure if and only if:
a) the initial state v0 is safe and
b) for any state v reachable from v0 by applying a finite sequence of
queries from R such that T(v,r) = v*, v = (F,M) and v* = (F*,M*), for each
s S and o O the following conditions are satisfied:
1) if read M*[s,o] and read M[s,o], then F*(s) > F*(o);
2) if read M[s,o] and F*(s) < F*(o), then read M* [s,o];
3) if write M*[s,o] and write M[s,o], then F*(o) > F*(s);
4) if write M[s,o] and F*(o) < F*(s), then write M* [s,o].
Thus, the theorem states that a system with a secure initial state is
secure if and only if during any transition of the system from one state to
another, no new access relations are created and no old access relations are
maintained that would be unsafe with respect to the security level function
new state. Formally, this theorem defines all the necessary and sufficient
conditions that must be met so that a system, having started its operation in
a safe state, never reaches an unsafe state.
123
4.2.10. Safe transition function
The disadvantage of the basic Bell — LaPadula safety theorem is that
the restrictions imposed by the theorem on the transition function coincide
with the criteria for the safety of the state, so this theorem is redundant with
respect to the definition of a safe state. In addition, the theorem only implies
that all states reachable from a safe state under certain restrictions will be
safe in some sense, but it is not guaranteed that they will be achieved without
losing the safety property during the transition process. Since we do not have
any specific restrictions on the type of transition function, other than those
specified in the conditions of the theorem, and it is assumed that the security
levels of subjects and objects can change, we can imagine such a
hypothetical system (it is called the Z-system), in which, when trying to lowlevel subject to read information from a high-level object, the level of the
object will be lowered to the level of the subject and reading will be carried
out. The transition function of the Z-system satisfies the restrictions of the
main security theorem, and all states of such a system are also safe in the
sense of the Bell — LaPadula criterion, but at the same time in this system
any user can read any file, which is obviously incompatible with security in
the usual sense.
Therefore, it is necessary to formulate a theorem that would not only
state the safety of all reachable states for a system that meets certain
conditions, but would also guarantee safety in the process of transitions
between states. To do this, it is necessary to regulate changes in security
levels during the transition from state to state using additional rules.
This interpretation of the mandate model was carried out by McLean,
who proposed his formulation of the main security theorem, based not on
the concept of a safe state, but on the concept of a safe transition.
A branch function is safe if and only if it is both read and write safe
and when it changes only one component of the state and those changes do
not violate the security of the system.
124
McLean’s safety theorem. A system is safe in any state and during
transitions between them if its initial state is safe and its transition function
satisfies the McLean criterion.
The reverse statement is not true. A system can be safe according to
the Bell — LaPadula definition, but not have a safe transition function.
This formulation of the main security theorem puts at the disposal of
developers of secure systems the basic principle of their construction,
according to which, in order to ensure the security of the system both in any
state and in the process of transition between them, it is necessary to
implement for it a transition function that corresponds to the specified
conditions.
4.2.11. Authorized Subjects
The formulation of the main security theorem in McLean’s
interpretation allows us to expand the scope of its application compared to
the classical Bell — LaPadula theorem, but the used transition security
criterion does not always meet the access control requirements that arise in
practice. Since the security levels of system entities may change during
transitions, it is desirable to control this process by explicitly allowing or
prohibiting entities from making such transitions. To solve this problem,
McLean extended the basic model by identifying a subset of authorized
subjects who are allowed to initiate transitions that result in changes in
security levels for system entities. A system with authorized subjects is also
described by the sets S, O, L, the meaning of which coincides with similar
concepts of the Bell — LaPadula model, and its state is also described by a
set of ordered pairs (F, M), and the transition function F and the access
relation matrix M play the same role role. A new element of the model is
the level control function C: SuO > P(S) (hereinafter P(S) denotes the set of
all subsets of S). This function defines the subset of subjects that are allowed
to change the security level for a given object or subject. The system model
(vo,R,Ta) consists of an initial state vo, a set of queries R and a transition
125
function Ta, which transfers the system from state to state as queries are
executed.
From the point of view of the authorized subject model, a system
(vo,R,Ta) is considered secure if:
1. The initial state v0 and all states reachable from it by applying a
finite number of queries from R are safe according to the Bell — LaPadula
criterion.
2. Transition function Ta is an authorized transition function according
to the proposed definition.
4.2.12. Sharing model
The practical application of all the presented formulations of the
mandatory security model is limited by one more factor — they do not take
into account the rules widespread in government agencies, according to
which access to certain information or modification of its security level can
only be carried out as a result of joint actions of several users (so-called
group access).
In order for the mandate model to provide for shared access, it must be
modified as follows. Instead of the set of subjects of the system S, we will
consider the set of non-empty subsets of S, which we denote as S = P(S) \{}.
Let’s expand the matrix of access rights, reflecting the current state of access
in the system, by adding rows to it containing the rights of group subjects,
and denote it as M. In addition to the security level function F:SuO→L for
group subjects, additional functions are introduced: FL:S→L, such that FL(s)
is the least upper bound of the set {F(s)/sS}, and FH:S→L, such that FH(s)
is the least upper bound of the set {F(s)/s S}.
The state safety criteria for such a system are formulated as follows:
1. A system state is read-safe if and only if, for each individual or
group subject having read access to an object in this state, the largest lower
bound of the set of security levels of this subject dominates the security level
of this object: sS, oO, read M[s,o] → FL(s) > F(o).
126
2. A system state is write-safe if and only if, for each individual or
group subject having write access to an object in this state, the security level
of this object dominates the smallest upper bound of the set of security levels
of this subject: sS, oO, write M[s,o] → F(o) > FH(s).
Then the Bell — LaPadula theorem for shared access is formulated as
follows [3]:
System (vo,R,T) is safe if and only if:
a) the initial state vo is safe and
b) the transition function T is such that for any state v reachable from
vo by applying a finite sequence of queries from R such that T(v,r) = v*,
v = ((F,FH,FL),M) and v* = ((F*,F*H,F*L)*,M*), for each sS, oO the
following conditions are satisfied:
1) if read M*[s,o] and read M[s,o], then FL*(s) > F*(o);
2) if read M[s,o] and FL*(s) < F*(o), then read M* [s,o];
3) if write M*[s,o] and write M[s,o], then F*(o) > FH*(s);
4) if write M[s,o] and F*(o) < FH*(s), then write M* [s,o].
4.2.13. Application of mandate models
To conclude the review of mandate models, it is necessary to note the
difficulties associated with their application in practice. All mandatory
models, like the Bell — LaPalula model, use only two access rights — read
and write. In practice, information systems support a much wider range of
operations on information, such as creation, deletion, transfer, etc.
Therefore, in order to apply the mandate model to a real system, it is
necessary to establish a suitable correspondence between reading and
writing and the operations implemented in a particular system. The simplest
example of the impracticality of the mandate model is the impossibility of
its application for network interactions — it is impossible to build a
distributed system in which information would be transmitted only in one
direction, because there will always be a reverse flow of information
containing responses to requests, confirmations of receipt, etc.
127
Therefore, when a mandatory policy is used in a system, all
interactions are considered only at a fairly high level of abstraction, which
does not take into account the implementation details of access operations.
This approach allows you to map any set of diverse access operations into
generalized read and write operations. To assess the possibility of security
violations using methods based on the discrepancy between these abstract
operations and real access mechanisms, so-called hidden channels of
information leakage analysis is used. The purpose of these studies is to
identify the ways in which information can be transmitted in circumvention
of the rules of the mandate model.
The more information flows we put under the control of the mandate
model, the less flexible our system will be, but also the fewer information
flows we will have to examine in the process of analyzing hidden channels.
In conclusion of the review of the mandatory access control model, it
should be noted that, although it is a basic security model that forms the
basis of information security theory, its application in practice is associated
with serious difficulties. Therefore, in real life it is used only in systems that
process classified information, and is applied only to a limited subset of
subjects and objects.
4.2.14. Role-based security policy
The role-based security policy is a significantly improved Harrison —
Ruzzo — Ullman model, but it cannot be classified as either discretionary
or mandatory, because access control in it is carried out both on the basis of
a matrix of access rights for roles, and using rules governing the assignment
roles for users and their activation during sessions. Therefore, the role model
represents a very special type of policy, based on a compromise between the
flexibility of access control characteristic of discretionary models and the
rigidity of access control rules inherent in mandatory models.
In the role model, the classical concept of “subject” is replaced by the
concepts of “user” and “role”. A user is a person who works with the system
and performs certain job responsibilities. A role is an abstract entity actively
128
operating in the system, which is associated with a limited, logically
connected set of powers necessary to carry out a certain activity. The most
common example of a role is the administrative budget found on almost
every system (for example, root for UNIX and Administrator for Windows
NT), which has special powers and can be used by multiple users.
Role-based policies are very widespread because they, unlike other
more strict and formal policies, are very close to “real life.” After all, in fact,
users working in the system do not act on their own personal behalf; they
always carry out certain official duties, that is, they perform certain roles
that are in no way related to their personality.
Therefore, it is quite logical to implement access control and assign
permissions not to real users, but to abstract (not personalized) roles
representing participants in a certain information processing process. This
approach to security policy makes it possible to take into account the
division of responsibilities and powers between participants in the applied
information process, since from the point of view of role policy, what
matters is not the identity of the user accessing the information, but what
powers he needs to perform his official duties. For example, in a real
information processing system, a system administrator, a database manager,
and ordinary users may work.
In such a situation, a role-based policy allows you to distribute powers
between these roles in accordance with their job responsibilities: the
administrator role is assigned special powers that allow him to control the
operation of the system and manage its configuration, the database manager
role allows him to manage the database server, and the rights of ordinary
users are limited to a minimum necessary to run application programs. In
addition, the number of roles in the system may not correspond to the
number of actual users — one user, if he has different responsibilities
requiring different rights, can perform (simultaneously or sequentially)
several roles, and several users can use the same role if they do the same job.
When using a role-based policy, access control is carried out in two
stages: first, for each role, a set of permissions is specified, representing a
set of access rights to objects, and, second, each user is assigned a list of
129
roles available to him. Permissions are assigned to roles according to the
principle of least privilege, which states that each user should have only the
minimum set of permissions necessary to perform their job.
The role model describes the system in the form of the following
sets [3]:
• U — set of users;
• R — set of roles;
• P — a set of powers to access objects, presented, for example, in the
form of a matrix of access rights;
• S — set of user sessions with the system.
For the listed sets the following relations are defined (Fig. 4.6.):
Fig. 4.6. Role-based access control model
RAPxR — displays a set of powers for a set of roles, establishing for
each role a set of powers assigned to it;
UAUxR — maps multiple users to multiple roles, defining for each
user the set of roles available to him.
130
Role-based security policy access control rules are defined by the
following functions:
• user: S→U — for each session S, this function determines the user
who carries out this session of working with the system: user(s)=u;
• roles: S→P(R) — for each session S, this function determines a set
of roles from the set R that can be simultaneously available to the user in
this session: roles(s)={ri | (user(s), ri) UA};
• permissions: S→P — for each session S, this function specifies the
set of permissions available in it, which is defined as the set of permissions
of all roles involved in this session: permissions(s) = Urroles(s){Pi, (Pi, r)
PA).
The following rule is used as a security criterion for a role model: a
system is considered secure if any user of the system working in a session S
can perform actions that require permission p only if p permissions(s).
From the formulation of the role model security criterion, it follows
that access control is carried out primarily not by assigning permissions to
roles, but by specifying the UA relationship that assigns roles to users, and
the roles function that determines the set of roles available in a session.
Therefore, numerous interpretations of the role model differ in the type of
functions user, roles and permission, as well as the restrictions imposed on
the relationship between PA and UA. As examples, consider a role-based
access control policy with a hierarchical organization of roles, as well as
several of the most common typical restrictions on the PA and UA
relationships and the user and roles functions.
The hierarchical organization of roles is the most common type of role
model, since it very accurately reflects the relationships of subordination
established in the real world between participants in the information
processing process and the division of responsibilities between them. Roles
in the hierarchy are ordered by the level of authority granted. The higher a
role is in the hierarchy, the more powers are associated with it, since it is
believed that if a user is assigned a certain role, then all roles subordinate to
it in the hierarchy are automatically assigned to him. The role hierarchy
allows multiple inheritance.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]