Computer Security: Confidentiality Policies and Bell-LaPadula Model Overview

Confidentiality Policies Chapter 5 Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-1

Outline Overview What is a confidentiality model Bell-LaPadula Model General idea Informal description of rules Formal description of rules Tranquility Declassification Controversy -property System Z Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-2

Confidentiality Policy Goal: prevent the unauthorized disclosure of information Deals with information flow Integrity incidental Multi-level security models are best-known examples Bell-LaPadula Model basis for many, or most, of these Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-3

Bell-LaPadula Model, Step 1 Security levels arranged in linear ordering Top Secret: highest Secret Confidential Unclassified: lowest Levels consist are called security clearance L(s) for subjects and security classification L(o) for objects Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-4

Example security level subject object Top Secret Tamara Personnel Files Secret Samuel E-Mail Files Confidential Claire Activity Logs Unclassified Ulaley Telephone Lists Tamara can read all files Claire cannot read Personnel or E-Mail Files Ulaley can only read Telephone Lists Version 1.1 Computer Security: Art and Science, 2nd Edition Slide 5-5

Reading Information Information flows up, not down Reads up disallowed, reads down allowed Simple Security Condition (Step 1) Subject s can read object o iff, L(o) L(s) and s has permission to read o Note: combines mandatory control (relationship of security levels) and discretionary control (the required permission) Sometimes called no reads up rule Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-6

Writing Information Information flows up, not down Writes up allowed, writes down disallowed *-Property (Step 1) Subject s can write object o iff L(s) L(o) and s has permission to write o Note: combines mandatory control (relationship of security levels) and discretionary control (the required permission) Sometimes called no writes down rule Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-7

Basic Security Theorem, Step 1 If a system is initially in a secure state, and every transition of the system satisfies the simple security condition, step 1, and the *- property, step 1, then every state of the system is secure Proof: induct on the number of transitions Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-8

Bell-LaPadula Model, Step 2 Expand notion of security level to include categories Security level is (clearance, category set) Examples ( Top Secret, { NUC, EUR, ASI } ) ( Confidential, { EUR, ASI } ) ( Secret, { NUC, ASI } ) Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-9

Levels and Lattices (A, C) dom (A , C ) iff A A and C C Examples (Top Secret, {NUC, ASI}) dom (Secret, {NUC}) (Secret, {NUC, EUR}) dom (Confidential,{NUC, EUR}) (Top Secret, {NUC}) dom (Confidential, {EUR}) Let C be set of classifications, K set of categories. Set of security levels L = C K, dom form lattice lub(L) = (max(A),C) glb(L) = (min(A), ) Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-10

Levels and Ordering Security levels partially ordered Any pair of security levels may (or may not) be related by dom dominates serves the role of greater than in step 1 greater than is a total ordering, though Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-11

Reading Information Information flows up, not down Reads up disallowed, reads down allowed Simple Security Condition (Step 2) Subject s can read object o iff L(s) domL(o) and s has permission to read o Note: combines mandatory control (relationship of security levels) and discretionary control (the required permission) Sometimes called no reads up rule Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-12

Writing Information Information flows up, not down Writes up allowed, writes down disallowed *-Property (Step 2) Subject s can write object o iff L(o) domL(s) and s has permission to write o Note: combines mandatory control (relationship of security levels) and discretionary control (the required permission) Sometimes called no writes down rule Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-13

Basic Security Theorem, Step 2 If a system is initially in a secure state, and every transition of the system satisfies the simple security condition, step 2, and the *- property, step 2, then every state of the system is secure Proof: induct on the number of transitions In actual Basic Security Theorem, discretionary access control treated as third property, and simple security property and *-property phrased to eliminate discretionary part of the definitions but simpler to express the way done here. Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-14

Problem Colonel has (Secret, {NUC, EUR}) clearance Major has (Secret, {EUR}) clearance Major can talk to colonel ( write up or read down ) Colonel cannot talk to major ( read up or write down ) Clearly absurd! Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-15

Solution Define maximum, current levels for subjects maxlevel(s) domcurlevel(s) Example Treat Major as an object (Colonel is writing to him/her) Colonel has maxlevel (Secret, { NUC, EUR }) Colonel sets curlevel to (Secret, { EUR }) Now L(Major) dom curlevel(Colonel) Colonel can write to Major without violating no writes down Does L(s) mean curlevel(s) or maxlevel(s)? Formally, we need a more precise notation Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-16

Example: Trusted Solaris Provides mandatory access controls Security level represented by sensitivity label Least upper bound of all sensitivity labels of a subject called clearance Default labels ADMIN_HIGH (dominates any other label) and ADMIN_LOW (dominated by any other label) S has controlling user US SLsensitivity label of subject privileged(S, P) true if S can override or bypass part of security policy P asserted (S, P) true if S is doing so Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-17

Rules CL clearance of S, SL sensitivity label of S, US controlling user of S, and OL sensitivity label of O 1. If privileged(S, change SL ), then no sequence of operations can change SL to a value that it has not previously assumed 2. If privileged(S, change SL ), then privileged(S, change SL ) 3. If privileged(S, change SL ), then no value of SL can be outside the clearance of US 4. For all subjects S, named objects O, if privileged(S, change OL ), then no sequence of operations can change OL to a value that it has not previously assumed Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-18

Rules (cont) CL clearance of S, SL sensitivity label of S, US controlling user of S, and OL sensitivity label of O 5. For all subjects S, named objects O, if privileged(S, override O s mandatory read access control ), then read access to O is granted only if SLdomOL Instantiation of simple security condition 6. For all subjects S, named objects O, if privileged(S, override O s mandatory write access control ), then write access to O is granted only if OLdomSL and CLdomOL Instantiation of *-property Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-19

Initial Assignment of Labels Each account is assigned a label range [clearance, minimum] On login, Trusted Solaris determines if the session is single-level If clearance = minimum, single level and session gets that label If not, multi-level; user asked to specify clearance for session; must be in the label range In multi-level session, can change to any label in the range of the session clearance to the minimum Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-20

Writing Allowed when subject, object labels are the same or file is in downgraded directory D with sensitivity label DL and all the following hold: SLdomDL S has discretionary read, search access to D OLdomSL and OL SL S has discretionary write access to O CLdomOL Note: subject cannot read object Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-21

Directory Problem Process p at MAC_A tries to create file /tmp/x /tmp/x exists but has MAC label MAC_B Assume MAC_B dom MAC_A Create fails Now p knows a file named x with a higher label exists Fix: only programs with same MAC label as directory can create files in the directory Now compilation won t work, mail can t be delivered Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-22

Multilevel Directory Directory with a set of subdirectories, one per label Not normally visible to user p creating /tmp/x actually creates /tmp/d/x where d is directory corresponding to MAC_A All p s references to /tmp go to /tmp/d pcd s to /tmp System call stat( . , &buf) returns information about /tmp/d System call mldstat( . , &buf) returns information about/tmp Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-23

Labeled Zones Used in Trusted Solaris Extensions, various flavors of Linux Zone: virtual environment tied to a unique label Each process can only access objects in its zone Global zone encompasses everything on system Its label is ADMIN_HIGH Only system administrators can access this zone Each zone has a unique root directory All objects within the zone have that zone s label Each zone has a unique label Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-24

More about Zones Can import (mount) file systems from other zones provided: If importing read-only, importing zone s label must dominate imported zone s label If importing read-write, importing zone s label must equal imported zone s label So the zones are the same; import unnecessary Labels checked at time of import Objects in imported file system retain their labels Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-25

Example L1domL2 L3domL2 Process in L1 can read any file in the export directory of L2 (assuming discretionary permissions allow it) L1, L3 disjoint Do not share any files System directories imported from global zone, at ADMIN_LOW So can only be read / zone usr L1 L2 L3 root root root export usr usr export usr zone export zone zone L2 L2 export export Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-26

Formal Model Definitions S subjects, O objects, P rights Defined rights: r read, a write, w read/write, e empty M set of possible access control matrices C set of clearances/classifications, K set of categories, L = C K set of security levels F = { ( fs, fo, fc) } fs(s) maximum security level of subject s fc(s) current security level of subject s fo(o) security level of object o Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-27

More Definitions Hierarchy functions H: O P(O) Requirements 1. oi oj h(oi ) h(oj ) = 2. There is no set { o1, , ok } O such that for i = 1, , k, oi+1 h(oi ) and ok+1 = o1. Example Tree hierarchy; take h(o) to be the set of children of o No two objects have any common children (#1) There are no loops in the tree (#2) Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-28

States and Requests V set of states Each state is (b, m, f, h) b is like m, but excludes rights not allowed by f R set of requests for access D set of outcomes y allowed, n not allowed, i illegal, o error W set of actions of the system W R D V V Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-29

History X = RN set of sequences of requests Y = DN set of sequences of decisions Z = VN set of sequences of states Interpretation At time t N, system is in state zt 1 V; request xt R causes system to make decision yt D, transitioning the system into a (possibly new) state zt V System representation: (R, D, W, z0) X Y Z (x, y, z) (R, D, W, z0) iff (xt, yt, zt 1, zt) W for all t (x, y, z)called an appearance of (R, D, W, z0) Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-30

Example S = { s }, O = { o }, P = { r, w } C = { High, Low }, K = { All } For every f F, either fc(s) = ( High, { All }) or fc(s) = ( Low, { All }) Initial State: b1 = { (s, o, r) }, m1 M gives s read access over o, and for f1 F, fc,1(s) = (High, {All}), fo,1(o) = (Low, {All}) Call this state v0 = (b1, m1, f1, h1) V. Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-31

First Transition Now suppose in state v0: S = { s, s } Suppose fs,1(s ) = (Low, {All}), m1 M gives s read access over o and s write access to o As s not written to o, b1 = { (s, o, r) } r1: s requests to write to o: System decides d1 = y (as m1 gives it that right, and fs,1(s ) = fo(o) New state v1 = (b2, m1, f1, h1) V b2 = { (s, o, r), (s , o, w) } Here, x = (r1), y = (y), z = (v0, v1) Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-32

Second Transition Current state v1 = (b2, m1, f1, h1) V b2 = { (s, o, r), (s , o, w) } fc,1(s) = (High, { All }), fo,1(o) = (Low, { All }) r2: s requests to write to o: System decides d2 = n (as fc,1(s) domfo,1(o)) New state v2 = (b2, m1, f1, h1) V b2 = { (s, o, r), (s , o, w) } So, x = (r1, r2),y = (y, n), z = (v0, v1, v2), where v2 = v1 Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-33

Basic Security Theorem Define action, secure formally Using a bit of foreshadowing for secure Restate properties formally Simple security condition *-property Discretionary security property State conditions for properties to hold State Basic Security Theorem Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-34

Action A request and decision that causes the system to move from one state to another Final state may be the same as initial state (r, d, v, v ) R D V V is an action of (R, D, W, z0) iff there is an (x, y, z) (R, D, W, z0) and a t N such that (r, d, v, v ) = (xt, yt, zt, zt 1) Request r made when system in state v ; decision d moves system into (possibly the same) state v Correspondence with (xt, yt, zt, zt 1) makes states, requests, part of a sequence Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-35

Simple Security Condition (s, o, p) S O P satisfies the simple security condition relative to f (written ssc rel f) iff one of the following holds: 1. p = e or p = a 2. p = r or p = w and fs(s) domfo(o) Holds vacuously if rights do not involve reading If all elements of b satisfy ssc rel f, then state satisfies simple security condition If all states satisfy simple security condition, system satisfies simple security condition Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-36

Necessary and Sufficient (R, D, W, z0) satisfies the simple security condition for any secure state z0 iff for every action (r, d, (b, m, f, h), (b , m , f , h )), W satisfies Every (s, o, p) b b satisfies ssc rel f Every (s, o, p) b that does not satisfy ssc rel f is not in b Note: secure means z0 satisfies ssc rel f First says every (s, o, p) added satisfies ssc rel f; second says any (s, o, p) in b that does not satisfy ssc rel f is deleted Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-37

*-Property b(s: p1, , pn) set of all objects that s has p1, , pn access to State (b, m, f, h) satisfies the *-property iff for each s S the following hold: b(s: a) [ o b(s: a) [ fo(o) domfc(s) ] ] 2. b(s: w) [ o b(s: w) [ fo(o) =fc(s) ] ] 3. b(s: r) [ o b(s: r) [ fc(s) domfo(o) ] ] Idea: for writing, object dominates subject; for reading, subject dominates object 1. Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-38

*-Property If all states satisfy simple security condition, system satisfies simple security condition If a subset S of subjects satisfy *-property, then *-property satisfied relative to S S Note: tempting to conclude that *-property includes simple security condition, but this is false See condition placed on w right for each Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-39

Necessary and Sufficient (R, D, W, z0) satisfies the *-property relative to S S for any secure state z0 iff for every action (r, d, (b, m, f, h), (b , m , f , h )), W satisfies the following for every s S Every (s, o, p) b b satisfies the *-property relative to S Every (s, o, p) b that does not satisfy the *-property relative to S is not in b Note: secure means z0 satisfies *-property relative to S First says every (s, o, p) added satisfies the *-property relative to S ; second says any (s, o, p) in b that does not satisfy the *-property relative to S is deleted Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-40

Discretionary Security Property State (b, m, f, h) satisfies the discretionary security property iff, for each (s, o, p) b, then p m[s, o] Idea: if s can read o, then it must have rights to do so in the access control matrix m This is the discretionary access control part of the model The other two properties are the mandatory access control parts of the model Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-41

Necessary and Sufficient (R, D, W, z0) satisfies the ds-property for any secure state z0 iff, for every action (r, d, (b, m, f, h), (b , m , f , h )), W satisfies: Every (s, o, p) b b satisfies the ds-property Every (s, o, p) b that does not satisfy the ds-property is not in b Note: secure means z0 satisfies ds-property First says every (s, o, p) added satisfies the ds-property; second says any (s, o, p) in b that does not satisfy the *-property is deleted Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-42

Secure A system is secure iff it satisfies: Simple security condition *-property Discretionary security property A state meeting these three properties is also said to be secure Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-43

Basic Security Theorem (R, D, W, z0) is a secure system if z0 is a secure state and W satisfies the conditions for the preceding three theorems The theorems are on the slides titled Necessary and Sufficient Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-44

Rule : R V D V Takes a state and a request, returns a decision and a (possibly new) state Rule ssc-preserving if for all (r, v) R V and v satisfying ssc rel f, (r, v) = (d, v ) means that v satisfies ssc rel f . Similar definitions for *-property, ds-property If rule meets all 3 conditions, it is security-preserving Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-45

Unambiguous Rule Selection Problem: multiple rules may apply to a request in a state if two rules act on a read request in state v Solution: define relation W( ) for a set of rules = { 1, , m } such that a state (r, d, v, v ) W( ) iff either d = i; or for exactly one integer j, j(r, v) = (d, v ) Either request is illegal, or only one rule applies Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-46

Rules Preserving SSC Let be set of ssc-preserving rules. Let state z0 satisfy simple security condition. Then (R, D, W( ), z0 ) satisfies simple security condition Proof: by contradiction. Choose (x, y, z) (R, D, W( ), z0) as state not satisfying simple security condition; then choose t N such that (xt, yt, zt) is first appearance not meeting simple security condition As (xt, yt, zt, zt 1) W( ), there is unique rule such that (xt, zt 1) = (yt, zt) and yt i. As ssc-preserving, and zt 1 satisfies simple security condition, then zt meets simple security condition, contradiction. Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-47

Adding States Preserving SSC Let v = (b, m, f, h) satisfy simple security condition. Let (s, o, p) b, b = b { (s, o, p) }, and v = (b , m, f, h). Then v satisfies simple security condition iff: 1.Either p = e or p = a; or 2.Either p = r or p = w, and fc(s) domfo(o) Proof: 1. Immediate from definition of simple security condition and v satisfying ssc rel f 2. v satisfies simple security condition means fc(s) domfo(o), and for converse, (s, o, p) b satisfies ssc rel f, so v satisfies simple security condition Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-48

Rules, States Preserving *-Property Let be set of *-property-preserving rules, state z0 satisfies the *- property. Then (R, D, W( ), z0 ) satisfies *-property Let v = (b, m, f, h) satisfy *-property. Let (s, o, p) b, b = b { (s, o, p) }, and v = (b , m, f, h). Then v satisfies *-property iff one of the following holds: 1. p = a and fo(o) domfc(s) 2. p = w and fc(s) = fo(o) 3. p = r and fc(s) domfo(o) Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-49

Rules, States Preserving ds-Property Let be set of ds-property-preserving rules, state z0 satisfies ds- property. Then (R, D, W( ), z0 ) satisfies ds-property Let v = (b, m, f, h) satisfy ds-property. Let (s, o, p) b, b = b { (s, o, p) }, and v = (b , m, f, h). Then v satisfies ds-property iff p m[s, o]. Computer Security: Art and Science, 2nd Edition Version 1.1 Slide 5-50