Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
131
Each user is assigned a subset of the role hierarchy, and in each session
the set of permissions of the roles that make up a fragment of this hierarchy
is available. This approach makes it possible to significantly simplify access
control by implicitly assigning permissions, since in real life, as a rule, users
are strictly ordered by the degree of responsibility corresponding to the level
of authority they have. Moreover, more trusted users who are higher on the
career ladder always have all the powers of less trusted users subordinate to
them. The hierarchy of roles accurately reflects this situation.
Other implementations of role-based security policies also involve
introducing various restrictions on the PA, UA relationships, and user, roles,
and permissions functions. The main thing for these restrictions is that they
all reflect the specific distribution of powers and areas of responsibility
between participants in various information processing processes. Let’s
look at a few examples that demonstrate the rich possibilities of using the
role-based access control model:
1. Mutually exclusive roles. The set of roles is divided into subsets that
combine roles that cannot be assigned to a user at the same time and are
considered incompatible. Thus, a user can only be assigned one role from
each subset of incompatible roles.
Mutually exclusive roles are implemented by the so-called. static
separation of duties, when the conflict of incompatible powers is resolved
at the stage of assigning roles. This policy is well suited for an information
processing system in which users are prohibited from combining certain
responsibilities. For example, in the banking system, the same user cannot
simultaneously be assigned the roles of an operator responsible for
performing certain operations and an auditor responsible for monitoring
their implementation.
2. Restrictions on the simultaneous use of roles within one session. In
this case, the set of roles is also broken down into subsets of incompatible
roles, but the UA relationship can assign any combination of roles to the
user. However, during a session with the system, a user can simultaneously
activate no more than one role from each subset of incompatible roles.
132
Because a user can switch between different roles during a session, he
must avoid incompatibility conflicts between them, this policy is called
dynamic separation of duties. This policy is more flexible than static
separation of concerns because it allows for more complex access control
schemes to be implemented. In particular, it allows you to prohibit a user
who has a significant set of roles and permissions from using them all at the
same time. In certain situations, this allows you to protect yourself from a
Trojan horse attack: for example, a user can be prohibited from
simultaneously accessing valuable information and running “untrusted”
programs introduced into the system by other users. Correctly selected
restrictions on the simultaneous use of roles make it possible to implement
control over information flows, which is generally characteristic of
mandatory security models.
3. Quantitative restrictions when assigning roles and powers. This
model is intended for cases where a role can only be assigned to a limited
number of users and/or certain privileges can only be granted to a limited
number of roles.
The meaning of these conditions is that by limiting the number of users
performing certain operations, the circle of persons who are responsible for
carrying out the corresponding actions is narrowed. For example, there
should not be more than one administrator in the system, or the right to
destroy documents can be assigned to only one role.
4. Grouping of roles and powers. Roles and powers that complement
each other and that do not make sense to assign individually are combined
into groups that can only be assigned as a whole. To do this, additional
rules are introduced according to which any role can be assigned to a user
only if a certain set of roles is already assigned to him, and a role can only
be granted permission if a certain set of permissions is already associated
with it.
The introduction of such restrictions simplifies system administration
in cases where permissions must be granted in a specific set or when roles
must be assigned in a certain sequence. For example, it makes sense to
provide access to some objects (say, personal directories) only immediately
133
by both reading and writing. A typical example of role grouping is a
situation where a certain user who supervises the work of other users must
have powers equal to the total powers of all his subordinates, i.e. the
manager role forms one group with the executor roles. It should be noted
that the role hierarchy is a special case of grouping roles and powers.
Since all of the listed options for restrictions, as well as any others, can
be used in various combinations, the role model is very easily adapted for
each specific case, which is its main advantage over other models. Rolebased policy provides wide scope for developers of access control systems:
on the one hand, the use of an access rights matrix can turn it into a kind of
discretionary model, but, on the other hand, the use of strict rules for the
distribution of roles between sessions and users, as well as powers between
roles, allows you to build on its basis a full-fledged regulatory policy.
Consequently, the properties of a system built in accordance with the role
model are determined solely by the nature of the restrictions used and can
be in a very wide range, which does not allow a formal proof of the safety
of the model for the general case.
Summarizing the properties of a role-based access control policy, it
should be stated that, unlike other policies, it practically does not guarantee
security using formal proof, but only determines the nature of the
restrictions, the observance of which serves as a criterion for the security of
the system. This approach makes it possible to obtain simple and
understandable access control rules that can be easily applied in practice,
but deprives the system of an evidence-based theoretical basis. In some
situations, this circumstance makes it difficult to use role-based policies, but
in any case, it is much more convenient to operate with roles than with
subjects, since this is more consistent with common information processing
technologies that provide for the division of duties and responsibilities
between users. In addition, a role-based policy can be used simultaneously
with other security policies, when the powers of roles assigned to users are
controlled by a discretionary or mandatory policy, which allows the
construction of multi-level access control schemes.
134
4.2.15. Probabilistic models
Models of this type examine the probability of overcoming a defense
system within a certain time. The advantage of the models is a numerical
assessment of the resistance of the protection system, the disadvantage is
the initial assumption that the system can be opened.
The goal of the model is to minimize overcoming the defense system.
Game model
The model is built according to the following principle. The developer
creates the initial version of the security system. After this, the attacker begins
to overcome it. If by time T, at which the attacker has overcome the protection
system, the developer does not have a new option, the protection system has
been overcome. If not, then the process continues. That is, the model
describes the process of evolution of the protection system over time [1].
Full overlap safety system model
The model pinpoints each area that requires protection, evaluates
security controls, their effectiveness, and their contribution to security
across the entire computing system. Each object O that requires protection
is associated with a certain set of actions that an attacker can resort to to gain
unauthorized access to the object. The main characteristic of a set of threats
T is the probability of occurrence of each of the malicious actions. In a real
system, these probabilities can be calculated with a limited degree of
accuracy (Fig. 4.7).
The set of object-threat relations form a bipartite graph in which the
edge <ti oj> exists if and only if ti (tiT) is a means of gaining access to
object oi (oiO). The relationship between objects and threats is of a one-
to-many type, i.e. one threat can spread to any number of objects and an
object can be vulnerable to more than one threat. The goal of the defense is
to cover every edge of the graph and erect a barrier to access along that path.
135
Fig. 4.7. Multiple object-threat relationships
The model is completed by the third set, which includes security tools
M, which are used to protect information in a computer system. Ideally, each
mk (mkM) should eliminate some edge <ti oj> from the graph in the
figure. A set of Μ security features transforms a bipartite graph into a
tripartite graph. In a secure system, all edges are represented as <ti mk> and
<mk oj>. Any edge of the form <ti oj> defines an unprotected object. The
same security feature can cover more than one threat and/or protect more
than one entity. The absence of the <ti oj> edge does not guarantee complete
security (although the presence of such an edge provides the potential for
unauthorized access, except in the case where the probability of ti appearing
is zero).
Concept of a full overlap system
A full-coverage system is a system in which there are protections for
each path of entry [1].
Let:
T — set of threats;
О — set of protected objects;
M — security set;
V — set of vulnerabilities — mapping TO onto a set of ordered pairs
V = {ti,O}i, representing penetration paths into the system;
136
B is a set of barriers — a mapping of TOM or VM onto a set of
ordered triplets {ti oj mk}, representing the points at which protection is
required.
If {ti oj} V provides for {ti oj mk} B, then the jth object is protected.
The main advantage of this type of model is the ability to numerically
obtain an assessment of the degree of reliability of an information security
system. This method does not directly specify a model of an information
security system, but can only be used in combination with other types of
information security system models.
4.2.16. Information models
Stream models define constraints on the system’s input/output ratio
that are sufficient to implement the system. These models are the result of
applying Shannon’s information theory to the problem of system security.
These models include the non-interference and non-inferiority models.
Laissez faire model
Non-interference is a constraint in which high-level user input cannot
be mixed with low-level user output. The laissez faire model views the
system as consisting of four entities: high input, low input, high output, low
output.
Consider a system whose output to user u is determined by the function
out(u, hist.read(u)), where hist.read(u) is the input history of the system
(traces) whose last input was read(u) — the read command executed by the
user u. Security is defined in terms of purge input histories, where purge
removes commands executed by a user whose security level does not
dominate u's security level.
For certain systems, the non-interference model is especially good in
that if the input sequence X is not mixed with the output sequence Y and X
is independent of the input of other users, then I(X,Y)=0, where I(X,Y) is
the reciprocal of X and U information.
137
Irreducibility model
The non-derivability model is expressed in terms of users and
information associated with one of two possible privacy levels (high and
low).
A system is considered irreducibly secure if low-security users cannot
obtain high-security information from any actions of high-security users.
That is, information leakage cannot occur as a result of high-level users
sending high-level information to low-level users.
This definition prevents low-level users from using information
available to them to obtain high-level information, but does not protect highlevel users from being viewed by low-level users. It simply requires that
low-level users be unable to use information available to them to obtain
high-level information.
4.3. INTEGRITY CONTROL MODELS
4.3.1. Biba model
Biba’s Mandatory Integrity Model
This model is often called the inversion of the Bell — LaPadula model,
and therefore the basic rules of this model are simply an inversion of the
rules of the Bell — LaPadula model: NRU→“no read down (NRD)” and
NWD→“no write up (NWU)”.
An NRD rule is defined as preventing subjects from reading
information from an object with a lower integrity level. An NWU rule is
defined as preventing subjects from writing information to an object with a
higher integrity level.
One of the advantages of this model is that it inherits many of the
important characteristics of Bell — LaPadula model, including its simplicity
and intuitiveness. This means that designers of real-world systems can easily
138
understand these rules and use them to make design decisions. In addition,
because Biba’s mandated integrity model, like Bell — LaPadula model, is
based on a simple hierarchy, it is easy to explain and depict to users of the
system.
On the other hand, the model is an obvious contradiction with the NRU
and NWD rules. This means that if it is necessary to build a system that
prevents threats to both secrecy and integrity, then the simultaneous use of
the rules of the Bell — LaPadula model and Biba models can lead to a
situation in which the levels of security and integrity are used in opposite
ways.
Subject Downgrade Model
Biba’s second model is a slightly relaxed rule of reading down.
Here the subject is allowed to read down, but as a result of such reading
the level of integrity of the subject is reduced to the level of integrity of the
object. This model places no restrictions on what a subject can read and
assumes a monotonic progression of integrity levels.
Object Downgrade Model
Biba’s latest model is implemented by relaxing the write-up rule. The
model allows writing up, but as a result, the integrity level of the object is
lowered to the integrity level of the subject performing the recording. This
model also places no restrictions on what a subject can read or write, it also
implies a monotonic change in integrity levels, and does not contain any
mechanisms for increasing the integrity level of an object.
In practical application, the Biba model relies too heavily on the
concept of trusted processes. That is, the problem of the need to create
trusted processes to increase or decrease the integrity of subjects or objects
is very significant. It should be noted that this model does not provide
mechanisms for increasing integrity, which leads to a monotonous decrease
in the integrity of the system.
139
4.3.2. Clark-Wilson model
This model was created in 1987 by Clark and Wilson. Its creation was
facilitated by the analysis of methods for commercial organizations to
manage the integrity of their paper resources in a manual office.
Let us introduce some notation:
D — a finite data set;
CDI — restricted data elements;
UDI — unlimited data elements,
Moreover: D = CDI UDI, CDI UDI = .
Subjects are included in the model as a set of components that initiate
transformation procedures (TPs) — any non-zero sequences of elementary
actions (an elementary action is a state transition that causes changes in
some data elements). TPs can be represented as functions that associate a
subject and a data element with a new data element as follows: TP: subjects
xD→D.
TP — actions that subjects (capable of changing certain data) perform
on data.
This model, like other models, has its own rules. Let’s look at them.
Rule 1: The system must have integrity assertion procedures (IVP
(example checksum verification) — asserts that a given CDI has the
appropriate level of integrity) that approve any CDI.
Rule 2: Application of any PP to any CDI must preserve the integrity
of the CDI.
Rule 3: Only the PP can make changes to the CDI.
Rule 4: Subjects can only initiate certain TPs over certain CDIs.
Rule 5: Appropriate policy regarding segregation of responsibilities of
entities. That is, the computer system defines a policy to prevent subjects
from changing the CDI without the appropriate involvement of other
subjects.
Rule 6: Some special TPs can convert UDI into CDI.
This rule allows certain TPs to receive a UDI as an input and, after a
corresponding increase in integrity, issue a CDI as an output.
140
Rule 7: Each application of CDI must be registered in a special CDI,
to which only information sufficient to restore a picture of the operation
process of this CDI can be added. That is, the use of a special registration
journal.
Rule 8: The system must recognize entities attempting to initialize the PP.
This rule defines mechanisms to prevent attacks in which one entity
attempts to impersonate another.
Rule 9: The system should allow changes to authorization lists only to
special subjects.
These rules define how integrity can be verified, how CDIs can be
modified and by whom, and how UDIs can be turned into CDIs. That is, all
changes and those who are trying to make these changes are tracked here.
The disadvantage is the difficulty of implementing VIP and methods
to prevent CDI from corrupting integrity.
The main advantage of this model is that it is based on time-tested
business methods for handling paper resources. Therefore, it should not be
viewed as an academic study, but rather as a body of existing methods. The
Clark-Wilson model also provides researchers with methods for working
with integrity that differ from traditional level-based approaches such as the
Bell — LaPadula and Biba models.
The main disadvantage of the model is that IVP and methods for
preventing CDI from corrupting integrity are not easy to implement in real
computer systems.
4.4. MECHANISM FOR PROTECTION AGAINST
THE THREAT OF DENIAL OF SERVICE
4.4.1. Mandate model
The mandate model includes many of the characteristics of the Bell —
LaPadula and Beebe models.
Subjects of the system are assigned priorities, which may be the same,
lower or higher than the priority of any other subject. Objects correspond to
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]