Looked at models to use to ensure an OS met certain security goals

Looked at models to use to ensure an OS met certain security goalsCIAPolicies can be about: confidentiality, integrity, availability.Found some could meet one security goal as long asCertain rules/concepts were observed. i.e tranquilityOnly used monadic operationsThis was proved theoretically by HRU using ACMsThe Take-Grant model used directed graphs to make the HRU calculations much fasterBLPThe Bell and La Padula model is a formal description of the allowable paths of information flow in a secure system. The model goal is to identify allowable communication when maintaining secrecy is important. The model has been used to define security requirements for systems concurrently handing data at different sensitivity levels.It would be possible to prove that for each state transition that followed the model then the system would retain the confidentiality property for its data.A system state is defined to be "secure" if the only permitted access modes of subjects to objects are in accordance with a security policy. To determine whether a specific access mode is allowed, the clearance of a subject is compared to the classification of the object (more precisely, to the combination of classification and set of compartments, making up the security level) to determine if the subject is authorized for the specific access mode. The clearance/classification scheme is expressed in terms of a lattice. The model defines two mandatory access control (MAC) rules and one discretionary access control (DAC) rule with three security properties:1.The Simple Security Property - a subject at a given security level may not read anobject at a higher security level (no read-up).2.The ★-property (read "star"-property) - a subject at a given security level must notwrite to any object at a lower security level (no write-down). The ★-property is also known as the Confinement property.3.The Discretionary Security Property - use of an access matrix to specify thediscretionary access control.The transfer of information from a high-sensitivity document to a lower-sensitivity document may happen in the Bell-LaPadula model via the concept of trusted subjects. Trusted Subjects are not restricted by the ★-property. Untrusted subjects are. Trusted Subjects must be shown to be trustworthy with regard to the security policy. This security model is directed toward access control and is characterized by the phrase: "no read up, no write down."Tranquility principle (problem)The tranquility principle of the Bell-LaPadula model states that the classification of a subject or object does not change while it is being referenced. There are two forms to the tranquility principle: the "principle of strong tranquility" states that security levels do not change during the normal operation of the system. The "principle of weak tranquility" states that security levels may never change in such a way as to violate a defined security policy. Weak tranquility is desirable as it allows systems to observe the principle of least privilege. That is, processes start with a low clearance level regardless of their owners clearance, and progressively accumulate higher clearance levels as actions require it.FIGURE--Biba ModelThe Biba Model or Biba Integrity Model developed by Kenneth J. Biba in 1977,[1] is a formal state transition system of computer security policy that describes a set of access control rules designed to ensure data integrity. Data and subjects are grouped into ordered levels of integrity. The model is designed so that subjects may not corrupt objects in a level ranked higher than the subject, or be corrupted by objects from a lower level than the subject.In general, preservation of data integrity has three goals:∙Prevent data modification by unauthorized parties∙Prevent unauthorized data modification by authorized parties∙Maintain internal and external consistencyThis security model is directed toward data integrity (rather than confidentiality) and is characterized by the phrase: "no read down, no write up".In the Biba model, users can only create content at or below their own integrity level, Conversely, users can only view content at or above their own integrity level.The Biba model defines a set of security rules similar to the Bell-LaPadula model.1.The Simple Integrity states that a subject at a given level of integrity must not read anobject at a lower integrity level (no read down).2.The * (star) Integrity states that a subject at a given level of integrity must not write toany object at a higher level of integrity (no write up).These two rules cover untrustworthy information in a natural way. Suppose John is known to be untruthful. If john can create or modify a document, other people should distrust the truth of the statement in that document. Thus, an untrusted subject who has writhe access to an object reduces the integrity of that object. Similarly, people are rightfully skeptical of a report based on unsound evidence. The low integrity of a source object implies low integrity for any object based on the source object.The Bell La-Padula model uses labels to give subjects clearance levels and objects classification levels. Similarly, the Biba model also uses labels to define security, but it takes a different approach. The Biba model uses labels to give integrity levels to the subjects and objects.The Biba model requires that each subject and object is given an integrity label. The labels by themselves do not provide protection to data. The labels must be complemented with a security mechanism in order to provide protection (RFC 1457). Usually the level of a security label remains constant, but there are exceptions to this rule; some of the policies in the Biba model support dynamic labels. The Biba model can use both static and dynamic labels. Dynamic labels allow the integrity levels to vary.An integrity label consists of two parts, a classification and a set of categories. The classification of integrity forms a hierarchical set.The second part of the label will consist of a set of categories also known as a compartment. The set of categories contained in the label will be a subset of all the sets in the system. The classification of the set of categories is non-hierarchical.What did BLP & BIBA teach us?Could model operations in an OS using MAC to achieve one security goalThe importance of tranquility during OS processesThe need to have processes that upgrade the level of objects and subjects as well as down grade themGraham-DenningThe Graham-Denning Model shows how subjects and objects should be securely created and deleted. It also addresses how to assign specific access rights. It is mainly used in access control mechanisms for distributed systems.Graham and Denning with Lampson showed that ACMs allowed the security state of systems to be modeled & analysedThis model addresses the security issues associated with how to define a set of basic rights on how specific subjects can execute security functions on an object. The model has eight basic protection rules (actions) that outline:∙How to securely create an object.∙How to securely create a subject.∙How to securely delete an object.∙How to securely delete a subject.∙How to securely provide the read access right.∙How to securely provide the grant access right.∙How to securely provide the delete access right.∙How to securely provide the transfer access right.Moreover, each object has an owner that has special rights on it, and each subject has another subject (controller) that has special rights on it.The model is based on the Access Control Matrix model where rows correspond to subjects and columns correspond to objects and subjects, each element contains a set of rights between subject i and object j or between subject i and subject k.For example an action A[s,o] contains the rights that subject s has on object o (example: {own, execute}).When executing one of the 8 rules, for example creating an object, the matrix is changed: a new column is added for that object, and the subject that created it becomes its owner.Each rule is associated with a precondition, for example if subject x wants to delete object o, it must be its owner (A[x,o] contains the 'owner' right ).Problem: losing track of rights; whether or not some subject can use an objectHRUThe HRU model defines a protection system consisting of a set of generic rights R and a set of commands C. An instantaneous description of the system is called a configuration and is defined as a tuple (S,O,P) of current subjects S, current objects O and an access matrix P. Since the subjects are required to be part of the objects, the access matrix contains one row for each subject and one column for each subject and object. An entry for subject s and object o is a subset of the generic rights R.The commands are composed of primitive operations and can additionally have a list of pre-conditions that require certain rights to be present for a pair (s,o) of subjects and objects.The primitive requests can modify the access matrix by adding or removing access rights for a pair of subjects and objects and by adding or removing subjects or objects. Creation of a subject or object requires the subject or object not to exist in the current configuration, while deletion of a subject or object requires it to have existed prior to deletion.Protect systemFirst result:When commands are restricted to a single operation each it is possible to decide whether a given subject can ever obtain a particular right to an object Second resultWhen commands are NOT restricted to a single operation each it is NOT always decidable whether a given protection system can confer a given right.Is an NP complete problem:NP Complete - the most notable characteristic of NP-complete problems is that no fast solution to them is known. That is, the timerequired to solve the problem using any currently known algorithm increases veryquickly as the size of the problem grows. As a result, the time required to solve evenmoderately large versions of many of these problems easily reaches into the billionsor trillions of yearsClark-Wilson modelPrinciplesThe model’s enforcement and certification rules define data items and processes that provide the basis for an integrity policy. The core of the model is based on the notion of a transaction.∙ A well-formed transaction is a series of operations that transition a system from one consistent state to another consistent state.∙In this model the integrity policy addresses the integrity of the transactions.∙The principle of separation of duty requires that the certifier of a transaction and the implementer be different entities.The key data type in the Clark-Wilson model is a Constrained Data Item (CDI, Data with a known integrity or data subject to integrity control). An Integrity Verification Procedure (IVP) ensures that all CDIs in the system are valid at a certain state. Transactions that enforce the integrity policy are represented by Transformation Procedures (TPs). A TP takes as input a CDI or Unconstrained Data Item (UDI, Data not subject to integrity controls) and produces a CDI. A TP must transition the system from one valid state to another valid state. UDIs represent system input (such as that provided by a user or adversary). A TP must guarantee (via certification) that it transforms all possible values of a UDI to a ―safe‖ CDI.Clark-Wilson model rulesAt the heart of the model is the notion of a relationship between an authenticated principal (i.e., user) and a set of programs (i.e., TPs) that operate on a set of data items (e.g., UDIs and CDIs). The components of such a relation, taken together, are referred to as a Clark-Wilson triple. The model must also ensure that different entities are responsible for manipulating the relationships between principals, transactions, and data items. As a short example, a user capable of certifying or creating a relation should not be able to execute the programs specified in that relation.C1—When an IVP is executed, it must ensure the CDIs are valid.C2—For some associated set of CDIs, a TP must transform those CDIs from onevalid state to another.Since we must make sure that these TPs are certified to operate on a particular CDI, we must have E1 and E2.E1—System must maintain a list of certified relations and ensure only TPs certified to run on a CDI manipulate that CDI.E2—System must associate a user with each TP and set of CDIs. The TP may access the CDI on behalf of the user if it is ―legal.‖ The TP cannot access that CDI on behalf of a user not associated with that TP and CDI.This requires keeping track of triples (user, TP, {CDIs}) called ―allowed relations.‖C3—Allowed relations must meet the requirements of ―separation of duty.‖We need authentication to keep track of this.E3—System must authenticate every user attempting a TP. Note that this is per TPrequest, not per login.For security purposes, a log should be kept.C4—All TPs must append to a log enough information to reconstruct the operation. When information enters the system it need not be trusted or constrained (i.e. can be a UDI). We must deal with this appropriately.C5—Any TP that takes a UDI as input may only perform valid transactions for allpossible values of the UDI. The TP will either accept (convert to CDI) or reject theUDI.Finally, to prevent people from gaining access by changing qualifications of a TP: E4—Only the certifier of a TP may change the list of entities associated with that TP.No certifier of a TP, or of an entity associated with that TP, may ever have executedpermission with respect to that entity.Enforces separation of duty with respect to certified and allowed relatio ns. Comparison to BibaBibaNo notion of certification rules; trusted subjects ensure actions obey rulesUntrusted data examined before being made trustedClark-WilsonExplicit requirements that actions must meetTrusted entity must certify method to upgrade untrusted data (and not certify the data itselfProblem2 different users cannot use same copy of TP to access 2 different CDIsNeed 2 separate copies of TP (one for each user and CDI set) TPs are setuid programsAs these change privileges, want to minimize their number root can assume identity of users owning TPs, and so cannot be separated from certifiersNo way to overcome this without changing nature of rootChinese wall modelBrewer and Nash defined a security policy called the Chinese wall that reflects certain commercial needs for information access protection. The security requirements reflects issues relevant to these people in legal medical, investment, or accounting firms who might be subject to conflict of interest. A conflict of interest reproduces, or services in competing companies.Problem:Tony advises American Bank about investmentsHe is asked to advise Toyland Bank about investmentsConflict of interest to accept, because his advice for either bank would affect his advice to the other bankDeals with conflict of interest – a user is restricted to accessing the data for just one company within a conflict of interest classIs a dynamic model – can access anything until access one object within a conflict of interest classRules for accessing sanitized (eg public) data from all objects within a COIProblems occur with being able to read from one COI group and write to another COI group Use mandated by law for financial transactions in some countriesWrite Rules (Problem)。