Lattice Model of Flow

Transcription

1 Lattice Model of Flow CS4605 George W. Dinolt Taken From Denning s A Lattice Model of Secure Information Flow, Communications of the ACM, Vol 19, #5, May, 1976

2 The Plan The Elements of the Model The Flow What is a Lattice The Labels are a Lattice gwdinolt@nps.edu July 25,

3 Model Elements The model is: F M =< N, P, SC,, > N = {a, b, c,...} storage objects P = {p, q, r,...} Processes SC = {A, B,...} The security classes (labels) lb : N P SC a labeling function : SC SC SC class combining function, associative and commutative, extend to many arguements SC SC a relation on SC, A B implies information can flow from A to B. Flows result from operations that cause information to move from A to B gwdinolt@nps.edu July 25,

4 Security Model F M is secure if and only if execution of a sequence of operations cannot give rise to a flow that violates. If f(a 1, a 2,..., a n ) is a function on objects with results an object b, then lb(a 1 ) lb(a 2 )... lb(a n ) lb(b) gwdinolt@nps.edu July 25,

5 Assumption on the Model is transitivie July 25,

6 What is a lattice A lattice L = (L,, ) where L is a set : L L L (meet) : L L L (join) See notes from course web page for a more complete discussion. See Lattice Theory by Garret Birkhoff gwdinolt@nps.edu July 25,

7 Lattice Properties For all a, b, c L: a a = a a a = a (1) a b = b a a b = b a (2) (a b) c = a (b c) (a b) c = a (b c) (3) (a b) a = a (a b) a = a (4) We can induce an order on L using the following: a b (a b = a or a b = b) (5) gwdinolt@nps.edu July 25,

8 Lattice as a POSET Let S be a set and be a relation on S that satisfies s S : s s (reflexive) s, t S : (s t) (t s) s = t (antisymmetric) s, t, u S : (s t) (t u) s u (transitivity) s, t S : u S, u = lub(s, t) s, t S : w S, w = glb(s, t) (greatest lower bound) From the notes we know that any set that satisfies these properties is a lattice u is a least upper bound of s and t if s u and t u and if s v and t v then u v (u is the smallest upper bound of s and t) gwdinolt@nps.edu July 25,

9 Equivalent Security Classes Two elements A, B SC are equivalent A B and B A. We denote by A = {B : A B and B A} the set of all the elements equivalent to A. It is easy to show that if A B then A = B. We call A the equivalent set of A in SC. We will show that the collection of distinct equivalent sets in SC form a lattice. From here on in, we will assume that we are dealing with the equivalence classes, i.e. that if A B and B A then A = B. gwdinolt@nps.edu July 25,

10 SC is a POSET We show that is reflexive, antisymmetric and transitive: We have reflexivity and transitivity by the definition of. We have anti-symmetry by the previous discussions. We define lub(a, B) = A B and we show that A B has the properties of an upper bound. It is obvious that A A B and B A B so A B is an upper bound of A and B. gwdinolt@nps.edu July 25,

11 Continuing is lub We will consider reasonable semantics for. Consider 5 objects, a, b, c, c 1, c 2 such that lb(a) lb(c), lb(b) lb(c) and lb(c) = lb(c 1 ) = lb(c 2 ). Suppose we have the program segment: c1 := a; c2 := b; c := c1 * c2; We deduce that lb(a) lb(b) lb(c) since it really is formed from the values of a and b. So is a least upper bound (lub) function on the elements of SC. gwdinolt@nps.edu July 25,

12 SC Has a Minimal Element If SC has an element 0 such that A SC, 0 A, and 0 A = A 0 = A then we are done. We do all of our reasoning on this new set. If no such element exists, we can just add a new element to SC that satisfies that property. gwdinolt@nps.edu July 25,

13 The glb function We can easily extend the lub function to sets. lub(a, B, C) = lub(a, lub(b, C)) = A B C Suppose A, B SC. Consider the set X = {C : C A and C B} We know X = since 0 X. We define glb(a, B) = lub(x ). gwdinolt@nps.edu July 25,

14 The glb function continued We need to show that glb(a, B) A, glb(a, B) B and (Z A Z B) Z glb(a, B). Suppose A glb(a, B) and A glb(a, B). But then x X, x A, lub(x) A which contradicts the definition of lub. We can argue similarly for B. We need to show that there isn t any bigger element that could be a glb. Let (Z A) (Z B) (glb(a, B) Z). Clearly Z X, hence Z lub(x ) = glb(a, B) which is a contradiction unless Z = glb(a, B). Actually it is slightly more complicated, and we really need the finiteness of X to ensure that we can do this, but you should be able to see the idea from this argument gwdinolt@nps.edu July 25,

15 SC is a Lattice SC, lub, glb (SC,, ) forms a lattice when the duplicate classifications are removed and the 0 element is added. gwdinolt@nps.edu July 25,