Introduction CS361: to Computer Security
Integrity Policies Dr. Bill Young Department of Computer Sciences University of Texas at Austin
Last updated: April 8, 2009 at 17:24
CS361 Slideset 3: 1
Policies and Channels II
Meaning of Computer Security
Typically today, computer security is described as encompassing at least: Confidentiality: (also called secrecy/privacy) who can read information; Integrity: who can write or modify information; Availability: what mechanisms ensure that resourses are available when needed. Confidentiality models, like BLP, are useful but obviously limited. A private overwriting a general's documents does not compromise confidentiality, but obviously violates integrity. How then do we extend our models to handle integrity concerns.
CS361 Slideset 3: 2
Policies and Channels II
Integrity
Integrity is a fuzzier notion than confidentiality and more context dependent. Who is authorized to modify data? How do you separate and protect assets? How do you detect and/or correct erroneous or unauthorized changes to data? Integrity has an important difference from confidentiality: a program can damage integrity without interaction with the external world, simply by computing data incorrectly. Threats to integrity may be accidental or malicious.
CS361 Slideset 3: 3
Policies and Channels II
Some Integrity Principles
Integrity has aspects and principles of operation not as relevant to military security: Separation of Duty: several different people must be involved to complete a critical function. Separation of Function: a single person cannot complete complementary roles within a critical process. Auditing: recoverability and accountability require maintaining an audit trail. Often commercial security controls are discretionary, procedural, and decentralized, rather than mandatory and centralized. Aggregation of information may also be a problem.
CS361 Slideset 3: 4
Policies and Channels II
Commercial Concerns
Integrity concerns are often more important than confidentiality concerns in commercial settings. Steve Lipner lists five common aspects of commercial data integrity:
1
Users will not write their own programs, but use existing production software. Programmers develop and test applications on a nonproduction system, possibly using contrived data. Moving applications from development to production requires a special process. This process must be controlled and audited. Managers and auditors must have access to system state and system logs.
2
3
4 5
CS361 Slideset 3: 5
Policies and Channels II
Integrity Meta-Policy
Recall that a confidentiality access control policy such as BLP imposes certain restrictions in order to enforce a particular meta-policy: information should only flow upward in the lattice of security levels. Question for consideration: What is the meta-policy that integrity models are trying to enforce?
CS361 Slideset 3: 6
Policies and Channels II
What Does Integrity Mean?
Suppose you're standing in a checkout line at the grocery store and on the adjacent newsrack you notice the headline: "Hillary Clinton to have Alien's Baby." Your reaction might be different depending on whether the publication is:
1
The New York Times: Wow! Could there be something to this? The Wall Street Journal: The vast right wing conspiracy is at it again! The National Enquirer: Those idiots! How funny!
2
3
CS361 Slideset 3: 7
Policies and Channels II
Integrity Levels
Integrity models, particularly those of Ken Biba, presume that we can associate integrity levels with subjects and with objects in our system, and define a dominates relation between levels. The integrity level of an object describes the degree of "trustworthiness" of the information contained in that object. For example, a "man-on-the-street" report may have lower integrity than a report from a panel of experts. The integrity level of a subject is a measure of the confidence one places in the ability of that subject to produce / handle information. For example, a certified application may have more integrity than freeware downloaded from the Internet.
CS361 Slideset 3: 8
Policies and Channels II
Structured Levels
Suppose we follow our standard scheme for labels. What would labels like the following mean: (High: {Nuclear}), (Low: {Crypto}).
CS361 Slideset 3: 9
Policies and Channels II
Structured Levels
Suppose we follow our standard scheme for labels. What would labels like the following mean: (High: {Nuclear}), (Low: {Crypto}).
As usual, we have a hierarchical component and a set of categories. Does this scheme make sense for integrity?
CS361 Slideset 3: 10
Policies and Channels II
Important Proviso
Note that integrity levels are not also clearance levels, though in many cases, they have similar structure and dominates is defined exactly analogously. Integrity concerns are orthogonal to confidentiality concerns and should be treated either separately or in a "mixed policy." In a system with both confidentiality and integrity constraints, only accesses that pass both tests may be allowed. For example, a general may have read access to very confidential information, but be a very unreliable source of intelligence. A piece of information may be both highly unreliable and very sensitive, or highly reliable and of little sensitivity.
CS361 Slideset 3: 11
Policies and Channels II
Biba's Integrity Models
Ken Biba (1977) proposed three different models of integrity control. All assume that we can associate integrity levels with subjects and objects, analogous to clearance levels in BLP.
1 2 3
Low Water Mark Integrity Policy Ring Policy Strict Integrity
Only Strict Integrity had much continuing influence. It is the one typically referred to as "Biba Integrity."
CS361 Slideset 3: 12
Policies and Channels II
Biba's Low Water Mark Integrity Policy
In general, a water mark policy is one where an attribute monotonically floats up (high water mark) or down (low water mark), but may be "reset" at some point. Biba's Low Water Mark Policy has the following two rules:
1 2
Subject s can write to object o only if i(o) i(s). If s reads o, then i (s) = min(i(s), i(o)), where i (s) is the subject's new integrity level after the read.
CS361 Slideset 3: 13
Policies and Channels II
Low Water Mark (Cont.)
A potential of the LWM Integrity policy is to monotonically decrease the integrity level of a subject unnecessarily. This sort of problem is called label creep and may result in an overly conservative analysis. What would happen if you decrease object integrity levels instead of subject integrity levels?
CS361 Slideset 3: 14
Policies and Channels II
Ring Policy
This focuses on direct modification and solves some problems of LWM.
1 2
Any subject can read any object, regardless of integrity levels. Subject s can write to object o only if i(o) i(s).
Does the Ring policy make some assumption about the subject that the LWM policy does not?
CS361 Slideset 3: 15
Policies and Channels II
Strict Integrity Policy
This policy is what is typically called the "Biba Model." It is the dual of BLP.
1
(Simple integrity) Subject s can read object o only if i(s) i(o). (Integrity *-property) Subject s can write to object o only if i(o) i(s).
2
Note that it would be possible to have a system that incorporated both BLP and Strict Integrity, using very similar mechanisms to enforce these two orthogonal aspects of security. But notice that you'd need two sets of labels.
CS361 Slideset 3: 16
Policies and Channels II
Relation of Biba Models to BLP
Notice that Biba's Strict Integrity Policy is exactly analogous to the Bell and LaPadula model. What would confidentiality policies look like that directly corresponded to Biba's Low Water Mark and Ring Policies? Would these be reasonable access control policies from the perspective of constraining information flow?
CS361 Slideset 3: 17
Policies and Channels II
Lipner's Integrity Matrix Model
Steve Lipner's model illustrates how BLP and Biba can be combined to make a useful model for a commercial application environment. There are two confidentiality levels: Audit Manager (AM): system audit and management. System Low (SL): all other processes. In addition there are three confidentiality categories: Production (SP): production code and data. Development (SD): programs under development. System Development (SSD): system programs in development.
CS361 Slideset 3: 18
Policies and Channels II
Lipner's Model (Cont.)
In addition to the security constraints, we also impose integrity constraints. There are three integrity classification (highest to lowest): System Program (ISP): system software Operational (IO): production programs and development software System Low (ISL): user level behavior and two integrity categories: Development (ID) Production (IP)
CS361 Slideset 3: 19
Policies and Channels II
Subject Levels
Security levels (both confidentiality and integrity) are assigned to subjects based on their roles in the organization and their need to know. User Role Ordinary users Application developers System programmers System managers/auditors System controllers Confidentiality (SL, {SP}) (SL, {SD}) (SL, {SSD}) (AM, {SP, SD, SSD}) (SL, {SP, SD}) and downgrade Integrity (ISL, {IP}) {ISL, {ID}) {ISL, {ID}) {ISL, {IP, ID}) {ISP, {IP, ID})
Here downgrade means the ability to move from development to production. What is the tranquility property for this system?
CS361 Slideset 3: 20 Policies and Channels II
Object Levels
Security levels (both confidentiality and interity) are assigned to objects based on who should access them. Object type Development code/test data Production code Production data Software tools System programs System programs in modification System and application logs Confidentiality (SL, {SD}) (SL, {SP}) (SL, {SP}) (SL, ) (SL, ) (SL, {SSD}) (AM, {categories}) Integrity {ISL, {ID}) {IO, {IP}) {ISL, {IP}) {IO, {ID}) {ISP, {IP, ID}) {ISL, {ID}) {ISL, )
Make sure you review these and convince yourself that these are reasonable decisions.
CS361 Slideset 3: 21 Policies and Channels II
Lipner's Model
Can an ordinary user utilize a system program? Can he modify it? Can a system programmer use production software? Can he modify it? Why is that special downgrade permission required? Could it be done with BLP and Biba alone?
CS361 Slideset 3: 22
Policies and Channels II
Revisiting Lipner's Concerns
Recall Lipner's integrity concerns for such a setting:
1
Users will not write their own programs, but use existing production software. Programmers develop and test applications on a nonproduction system, possibly using contrived data. Moving applications from development to production requires a special process. This process must be controlled and audited. Managers and auditors must have access to system state and system logs.
2
3
4 5
Does his scheme support implementation of these constraints?
CS361 Slideset 3: 23
Policies and Channels II
Integrity Meta-Policy Revisited
Earlier we asked: What is the meta-policy that integrity models are trying to enforce? Possible answer: we don't want unreliable information to corrupt more reliable information.
CS361 Slideset 3: 24
Policies and Channels II
Clark-Wilson Commercial Security
Biba integrity is a clone of BLP. Clark and Wilson proposed a model that they argued better reflects the integrity requirements of real commercial enterprises, particularly separation of duty. A major concern is consistency among the various components of the system state. For example, for a bank, the funds at the beginning of the day plus the funds deposited minus the funds withdrawn should equal funds on hand. A well-formed transaction is a procedure that moves from one consistent state to another. Integrity of the transactions is important.
CS361 Slideset 3: 25
Policies and Channels II
Four Basic Criteria
1
Authentication: identity of all users must be properly authenticated. Audit: modifications should be logged to record every program executed and by whom, in a way that be cannot undone. Well-formed transactions: users manipulate data only in constrained ways. Only legitimate accesses are allowed. Separation of duty: the system associates with each user a valid set of programs they can run. Prevents unauthorized modifications, thus preserving integrity and consistency with the real world.
2
3
4
CS361 Slideset 3: 26
Policies and Channels II
Basic Concepts
Constrained Data Items: CDIs are the objects whose integrity is protected Unconstrained Data Items: UDIs are objects not covered by the integrity policy Integrity Verification Procedures: IVPs are procedures meant to verify maintainance of integrity of CDIs. Transformation Procedures: TPs are the only procedures allowed to modify CDIs, or take arbitrary user input and create new CDIs. Designed to take the system from one valid state to another.
CS361 Slideset 3: 27
Policies and Channels II
Integrity Rules
There are two kinds of rules--Certification and Enforcement. C1: All IVPs must ensure that CDIs are in a valid state when the IVP is run. C2: All TPs must be certified valid. C3: Assignment of TPs to users must satisfy separation of duty. C4: The operation of TPs must be logged. C5: TPs executing on UDIs must result in valid CDIs. E1: Only certified TPs can manipulate CDIs. E2: Users must only access CDIs by means of TPs for which they are authorized. E3: The identify of each user attempting to execute a TP must be authenticated. E4: Only the agent permitted to certify entities can change the list of entities associated with other entities.
CS361 Slideset 3: 28 Policies and Channels II
Clark-Wilson (Cont.)
The model is defined in terms of a set of triples of the form: (user, TP, {CDI set}) where user is authorized to perform a transaction procedure TP, on a given set of constrained data items (CDIs). The rules that govern the application of transformations, the certification of the state, and the enforcement of the constraints.
CS361 Slideset 3: 29
Policies and Channels II
Chinese Wall Policy
Brewer and Nash proposed a policy called the Chinese Wall Policy that addresses a very specific commercial need: the potential for conflicts of interest and inadvertant disclosure of information. Strictly speaking, this is not an integrity policy, but an access control confidentiality policy. Suppose a lawyer specializes in product liability. At one time, she might consult for and see sensitive corporate data from American Airlines or United Airlines, but not both. However, a simultaneous contract with McDonalds would not be a conflict.
CS361 Slideset 3: 30
Policies and Channels II
Levels of Abstraction
The security policy builds on three levels of abstraction. Objects such as files. Objects contain information about only one company. Company groups collect all objects concerning a particular company. Conflict classes cluster the groups of objects for competing companies. For example, consider the following conflict classes: { Ford, Chrysler, GM } { Citicorp, Credit Lyonnais, Deutsche Bank } { Microsoft }
CS361 Slideset 3: 31
Policies and Channels II
Chinese Wall Policy
We have a simple access control policy: A person can access information from any company as long as that person has never accessed information from a different company in the same conflict class. For example, if you access a file from GM, you will subsequently be blocked from accessing any files from Ford or Chrysler. You are free to access files from companies in any other conflict class. Notice that permissions change dynamically. The access rights that any subject enjoys depends on the history of past accesses.
CS361 Slideset 3: 32
Policies and Channels II
Chinese Wall
The policy restricts access according to the following two properties: (Chinese Wall) Simple Security Rule: A subject s can be granted access to an object o only if the object: is in the same company datasets as the objects already accessed by s, that is, "within the Wall," or belongs to an entirely different conflict of interest class. (Chinese Wall) *-property: Write access is only permitted if: access is permitted by the simple security rule, and no object can be read which is:
in a different company dataset than the one for which write access is requested, and contains unsanitized information.
CS361 Slideset 3: 33 Policies and Channels II
Role-Based Access Control
A role-based access control system (RBAC) is another way of enforcing access. It is based on the job functions that a subject performs. A subject may fill several roles at once. Roles may change over time. A role is a collection of job functions. Each role r is has an associated set of authorized transactions, trans(r ). The active roles of a subject s, actr(s), is the set of roles the subject currently assumes. The authorized roles, authr(s), is the set of roles the subject may assume. The predicate canexec(s, t) is true if subject s can execute transaction t at the current time.
CS361 Slideset 3: 34
Policies and Channels II
RBAC (Cont.)
Several rules control what subjects can perform which accesses: Rule of Role Assignment: Let S be the set of subjects and T the set of transactions. s S, t T , [canexec (s, t) actr (s) = ]
Rule of Role Authorization: Let S be the set of subjects. s S, [actr (s) authr (s)]
Rule of Transaction Authorization: Let S be the set of subjects and T the set of transactions. s S, t T , [canexec (s, t) t trans (actr (s))]
CS361 Slideset 3: 35 Policies and Channels II
RBAC (Cont.)
Various other notions can be captured in an RBAC system. For example, some roles may subsume others, meaning that anyone having role rj can do at least the functions of ri . E.g., a trainer can perform all of the actions of a trainee, as well as some others. We say that role rj subsumes or contains role ri (rj > ri ), if: s S, [(rj authr(s) rj > ri ) ri authr(s)] RBAC can also model separation of duty (one individual cannot assume both roles r1 and r2 ). This is expressed as: s S, [r1 authr(s) r2 authr(s)]
CS361 Slideset 3: 36
Policies and Channels II
RBAC Advantages
RBAC associates access permissions with a job/function/role rather than with an individual or subject. RBAC recognizes that a subject can have various functions within the organization. RBAC allows the subject to transition between roles without having to change identities.
CS361 Slideset 3: 37
Policies and Channels II
Access Control Matrix
The point of many security models--including Bell and LaPadula, Biba Integrity, and others--is to control the access of subjects to objects according to some criteria. The most general representation of this is an access control matrix (ACM). object1 Ai , Aj ... objectk
subject1 ... subjectn
Al
Ai , Am
The ACM gives an explicit representation of every access permitted by every subject to every object.
CS361 Slideset 3: 38
Policies and Channels II
Policies as ACMs
Any access control policy can be defined using an ACM rather than a set of rules. What would such a model look like for a Bell and LaPadula system? What would one look like for Biba's Strict Integrity Model? How might you combine the two?
CS361 Slideset 3: 39
Policies and Channels II
Problems with ACMs
Though the ACM is a completely general mod...