Information Security: Confidentiality Policies (Chapter 4)

Information Security:Confidentiality Policies(Chapter 4) Dr. ShahriarBijani Shahed University

Slides References • Matt Bishop, Computer Security: Art and Science, the author homepage, 2002-2004. • Chris Clifton, CS 526: Information Security course, Purdue university, 2010.

Chapter 5: Confidentiality Policies • Overview • What is a confidentiality model • Bell-LaPadula Model • General idea • Informal description of rules • Formal description of rules • Tranquility • Controversy • †-property • System Z

Overview • Bell-LaPadula • Informally • Formally • Example Instantiation • Tranquility • Controversy • System Z

Confidentiality Policy • Goal: prevent the unauthorized disclosure of information • Deals with information flow • Multi-level security models are best-known examples • Bell-LaPadula Model basis for many, or most, of these

Background • Clearance levels • Top Secret • In-depth background check; highly trusted individual • Secret • Routine background check; trusted individual • For Official Use Only/Sensitive • No background check, but limited distribution; minimally trusted individuals • May be exempt from disclosure • Unclassified • Unlimited distribution • Untrusted individuals

Bell-LaPadulaModel (Step 1) • Security levels arranged in linear ordering • Top Secret: highest • Secret • Confidential • Unclassified: lowest • Levels consist of: • Subject has security clearance L(s) = ls • Object has security classification L(o) = lo • Clearance/Classification ordered: • li < li+1 • Mandatory access control

Example • Bill can read all files • Claire cannot read Personnel or E-Mail Files • John can only read Telephone Lists

Reading Information • Information flows up, not down • “Reads up” disallowed, “reads down” allowed • Simple Security Condition (Step 1) • Subject s can read object oiff, L(o) ≤ L(s) and shas permission to read o • Note: combines mandatory control (relationship of security levels) and discretionary control (the required permission) • Sometimes called “no reads up” rule

Writing Information • Information flows up, not down • “Writes up” allowed, “writes down” disallowed • *-Property (Step 1) • Subject s can write object oiffL(s) ≤ L(o) and shas permission to write o • Note: combines mandatory control (relationship of security levels) and discretionary control (the required permission) • Sometimes called “no writes down” rule

Basic Security Theorem, Step 1 • If a system is initially in a secure state, and every transition of the system satisfies the simple security condition, step 1, and the *-property, step 1, then every state of the system is secure • Proof: induct on the number of transitions

Basics: Partially Ordered Set • A Set S with relation  (written (S, ) is called a partially ordered set if  is • Anti-symmetric • If a  b and b  a then a = b • Reflexive • For all a in S, a  a • Transitive • For all a, b, c. a  b and b  c implies a  c

Background: Posetexamples • Natural numbers with less than (total order) • Sets under the subset relation (not a total order) • Natural numbers ordered by divisibility

Background: Lattice • Partially ordered set (S, ) and two operations: • greatest lower bound (glb X) • Greatest element less than all elements of set X • least upper bound (lub X) • Least element greater than all elements of set X • Every lattice has • bottom (glb L) a least element • top (lubL) a greatest element

Background: Lattice examples • Natural numbers in an interval (0 .. n) with less than • Also the linear order of clearances (U  FOUO  S  TS) • The powerset of a set of generators under inclusion • E.g. Powerset of security categories {NUC, Crypto, ASI, EUR} • The divisors of a natural number under divisibility

Bell-LaPadulaModel (Step 2) • Total order of classifications not flexible enough • Solution: Categories • S can access O if C(O)  C(S) • Combining with clearance: • (L,C) dominates (L’,C’) L’ = L and C’  C • Induces lattice instead of levels • Expand notion of security level to include categories • Security level is (clearance, category set)

Bell-LaPadulaModel (blp) • Lattice Example1 • Lattice Example2 • ( Top Secret, { NUC, EUR, ASI } ) • ( Confidential, { EUR, ASI } ) • ( Secret, { NUC, ASI } ) {NUC, EUR, US} {NUC, EUR} {NUC, US} {EUR, US} {EUR} {US} {NUC} 

Levels and Lattices • dom (dominates) relation • (L, C) dom(L, C) iffL≤ Land CC • Examples • (Top Secret, {NUC, ASI}) dom (Secret, {NUC}) • (Secret, {NUC, EUR}) dom (Confidential,{NUC, EUR}) • (Top Secret, {NUC}) dom (Confidential, {EUR}) • Let C be set of clearances, K set of categories. Set of security levels L = C  K, dom form lattice • lub(L) = (max(L),C) • glb(L) = (min(L), )

Levels and Ordering • Security levels partially ordered • Any pair of security levels may (or may not) be related by dom • “dominates” serves the role of “greater than” in step 1 • But “greater than” is a total ordering,

Reading Information • Information flows up, not down • “Reads up” disallowed, “reads down” allowed • Simple Security Condition (Step 2) • Subject s can read object oiffL(s) domL(o) ands has permission to read o • Note: combines mandatory control (relationship of security levels) and discretionary control (the required permission) • Sometimes called “no reads up” rule

Writing Information • Information flows up, not down • “Writes up” allowed, “writes down” disallowed • *-Property (Step 2) • Subject s can write object oiffL(o) domL(s) ands has permission to write o • Note: combines mandatory control (relationship of security levels) and discretionary control (the required permission) • Sometimes called “no writes down” rule

Basic Security Theorem (Step 2) • If a system is initially in a secure state, and every transition of the system satisfies the simple security condition (step 2) and the *-property (step 2) then every state of the system is secure • Proof: induct on the number of transitions

Example • George is cleared into security level (SECRET,{NUC, EUR}), DocAis classified as ( CONFIDENTIAL, { NUC } ), DocBis classified as ( SECRET, { EUR, US}), and DocCis classified as (SECRET, { EUR }). Then: • George domDocAas CONFIDENTIAL ≤SECRET and{ NUC }  { NUC, EUR } • George ¬domDocBas { EUR, US } { NUC, EUR } • George domDocCas SECRET ≤SECRET and { EUR } { NUC, EUR } • George can read DocA and DocC but not DocB(assuming the discretionary access controls allow such access). • Suppose Paul is cleared as (SECRET, { EUR, US, NUC }) and has discretionary read access to DocB. Paul can read DocB; were he to copy its contents to DocA and set its access permissions accordingly. George could then read DocB!? • *-property (step 2) prevents this

Problem • Colonel has (Secret, {NUC, EUR}) clearance • Major has (Secret, {EUR}) clearance • Major can talk to colonel (“write up” or “read down”) • Colonel cannot talk to major (“read up” or “write down”) • Not Desired!

Solution • Define maximum, current levels for subjects • maxlevel(s) domcurlevel(s) • Example • Treat Major as an object (Colonel is writing to him) • Colonel has maxlevel (Secret, { NUC, EUR }) • Colonel sets curlevel to (Secret, { EUR }) • Now L(Major) domcurlevel(Colonel) • Colonel can write to Major without violating “no writes down”

Systems Built on Bell-LaPadula(BLP) • BLP was a simple model • Intent was that it could be enforced by simple mechanisms • File system access control was the obvious choice • Multics (1965) implemented BLP • Unix inherited its discretionary AC from Multics

Information Security: Confidentiality Policies (Chapter 4)