Outline

1. Bell-LaPadula Model: intuitive, security classifications only (a) Level, categories, define clearance and classification (b) Simple security condition (no reads up), *-property (no writes down), discretionary security property (c) Basic Security Theorem: if it is secure and transformations follow these rules, it will remain secure 2. Bell-LaPadula Model: intuitive, now add category sets (a) Apply lattice i. Set of classes SC is a partially ordered set under relation dom with glb (greatest lower bound), lub (least upper bound) operators ii. Note: dom is reflexive, transitive, antisymmetric iii. Example: (A,C) dom (A′,C′) iff A≤ A′ and C ⊆C′; lub((A,C),(A′,C′)) = (max(A,A′),C∪C′); and glb((A,C),(A′,C′)) = (min(A,A′),C∩C′) (b) Simple security condition (no reads up), *-property (no writes down), discretionary security property (c) Basic Security Theorem: if it is secure and transformations follow these rules, it will remain secure 3. Maximum, current security level 4. Example: Trusted Solaris 5. Bell-LaPadula: formal model (a) Set of requests is R (b) Set of decisions is D (c) W ⊆ R×D×V ×V is motion from one state to another. (d) System Σ(R,D,W,z0) ⊆ X ×Y × Z such that (x,y,z) ∈ Σ(R,D,W,z0) iff (xt ,yt ,zt ,zt−1) ∈W for each i ∈ T ; latter is an action of system (e) Theorem: Σ(R,D,W,z0) satisfies the simple security condition for any initial state z0 that satisfies the simple security condition iff W satisfies the following conditions for each action (ri,di,(b,m, f ′,h′),(b,m, f ,h)): i. each (s,o,x) ∈ b′−b satisfies the simple security condition relative to f ′ (i.e., x is not read, or x is read and fs(s)dom fo(o)); and ii. if (s,o,x) ∈ b does not satisfy the simple security condition relative to f ′, then (s,o,x) / ∈ b′ (f) Theorem: Σ(R,D,W,z0) satisfies the *-property relative to S′ ⊆ S for any initial state z0 that satisfies the *property relative to S′ iff W satisfies the following conditions for each (ri,di,(b,m, f ′,h′),(b,m, f ,h)): i. for each s ∈ S′, any (s,o,x) ∈ b′−b satisfies the *-property with respect to f ′; and ii. for each s ∈ S′, if (s,o,x) ∈ b does not satisfy the *-property with respect to f ′, then (s,o,x) / ∈ b′ (g) Theorem: Σ(R,D,W,z0) satisfies the ds-property iff the initial state z0 satisfies the ds-property and W satisfies the following conditions for each (ri,di,(b,m, f ′,h′),(b,m, f ,h)): i. if (s,o,x) ∈ b′−b, then x ∈ m′[s,o]; and ii. if (s,o,x) ∈ b and x ∈ m′[s,o],then (s,o,x) / ∈ b′ (h) Basic Security Theorem: A system Σ(R,D,W,z0) is secure iff z0 is a secure state and W satisfies the conditions of the above three theorems for each action. 6. Using the Bell-LaPadula model