Disjunction Category Labels Deian Stefan, Alejandro Russo, David - PowerPoint PPT Presentation

Disjunction Category Labels Deian Stefan, Alejandro Russo, David Mazières, John Mitchell NordSec 2011

Motivating Example Bob Speadsheet WebTax Public Network Proprietary DB

Motivating Example • Bob does not trust WebTax ➤ WebTax can exfiltrated his data Bob • WebTax author does not trust Bob Speadsheet WebTax ➤ Bob can learn proprietary information by inspecting code • WebTax author want to prevent Public Network Proprietary DB leaks due to bugs

Motivating Example • Bob does not trust WebTax ➤ WebTax can exfiltrated his data Bob • WebTax author does not trust Bob Speadsheet WebTax ➤ Bob can learn proprietary information by inspecting code • WebTax author want to prevent Public Network Proprietary DB leaks due to bugs

Motivating Example • Bob does not trust WebTax ➤ WebTax can exfiltrated his data Bob • WebTax author does not trust Bob Speadsheet WebTax ➤ Bob can learn proprietary information by inspecting code • WebTax author want to prevent Public Network Proprietary DB leaks due to bugs

Motivating Example • Bob does not trust WebTax ➤ WebTax can exfiltrated his data Bob • WebTax author does not trust Bob Speadsheet WebTax ➤ Bob can learn proprietary information by inspecting code • WebTax author want to prevent Public Network Proprietary DB leaks due to bugs

Motivating Example • Bob does not trust WebTax ➤ WebTax can exfiltrated his data Bob • WebTax author does not trust Bob Speadsheet WebTax ➤ Bob can learn proprietary information by inspecting code • WebTax author want to prevent Public Network Proprietary DB leaks due to bugs How do we address security in the presence of mutual-distrust?

Information Flow Control Well-established approach to enforcing security • ➤ Confidentiality: prevent unwanted leaks ➤ Integrity: prevent flows to critical operations Decentralized IFC addresses mutual distrust • Suitable for executing untrustworthy code • ➤ Policies specify where data can flow

Example with IFC Policy: observable by Bob cannot be exfiltrated to network Bob Speadsheet WebTax Policy: observable by WebTax author Public Network Proprietary DB

IFC Policies How are policies specified? • ➤ Associating a label with every piece of data Labels form a lattice over can-flow-to relation ⊑ • ➤ E.g., Bob’s data cannot flow to network ⋢ Policies are enforced at every possible flow • WebTax

IFC Policies How are policies specified? • ➤ Associating a label with every piece of data Labels form a lattice over can-flow-to relation ⊑ • ➤ E.g., Bob’s data cannot flow to network ⋢ Policies are enforced at every possible flow • ⊑ ? WebTax

IFC Policies How are policies specified? • ➤ Associating a label with every piece of data Labels form a lattice over can-flow-to relation ⊑ • ➤ E.g., Bob’s data cannot flow to network ⋢ Policies are enforced at every possible flow • ⋢ ✗ WebTax

Motivation for DC Labels Existing DIFC systems use ad-hoc label formats • ➤ DLM, Asbestos/HiStar, DStar, Flume, etc. all present their own label format Most labels have not been formalized • Some rely on centralized components • Need simple, sound, expressive & • decentralized label format ➠ DC Labels

DC Labels 〈 S , I 〉 Components S and I are formulas over principals • ➤ Components impose restrictions on data flow Principal is a source of authority (e.g., Bob) • Restrictions: • ➤ S and I are minimal (sorted) formulas in CNF ➤ Neither S nor I contain negated terms

DC Labels 〈 S , I 〉 Secrecy component S: • ➤ Specifies principals allowed or whose consent is necessary to observe the data Integrity component I : • ➤ Specifies principals that created or are allowed to modify the data

Example with DC Labels Policy: observable by Bob Bob Speadsheet WebTax Policy: observable by WebTax author Public Network Proprietary DB

Example with DC Labels Policy: observable by Bob 〈 {Bob}, {Bob} 〉 Bob Speadsheet WebTax 〈 {Preparer}, {Preparer} 〉 Policy: observable by WebTax author Public Network Proprietary DB

Example with DC Labels Policy: Bob created & observable by Bob vouches for data 〈 {Bob}, {Bob} 〉 Bob Speadsheet WebTax Preparer created 〈 {Preparer}, {Preparer} 〉 & vouches for data Policy: observable by WebTax author Public Network Proprietary DB

A more interesting label 〈 {(Bob ⋁ Alice) ⋀ User}, {Bob ⋁ Alice} 〉

A more interesting label Policy: created/modified by Bob or Alice 〈 {(Bob ⋁ Alice) ⋀ User}, {Bob ⋁ Alice} 〉

A more interesting label Policy: created/modified by Bob or Alice 〈 {(Bob ⋁ Alice) ⋀ User}, {Bob ⋁ Alice} 〉 Policy I: Policy II: observable by Bob observable by or Alice User (group) ➠ Policy: observable by Bob or Alice, given the consent the User group (or vice versa)

A more interesting label “categories” Policy: created/modified by Bob or Alice 〈 {(Bob ⋁ Alice) ⋀ User}, {Bob ⋁ Alice} 〉 Policy I: Policy II: observable by Bob observable by or Alice User (group) ➠ Policy: observable by Bob or Alice, given the consent the User group (or vice versa)

General observations … Secrecy: {(A ⋁ B) ⋀ C ⋀ } • ➤ Disjunction ➠ allows more readers ➤ Conjunction ➠ more restrictions ∴ more secret … Integrity: {(A ⋁ B) ⋀ C ⋀ } • ➤ Disjunction ➠ allows more writers ➤ Conjunction ➠ more restrictions ∴ trustworthy

Enforcing IFC Data may flow from one entity to another iff • ➤ it accumulates more secrecy restrictions ➤ it losses integrity restrictions S 2 ⟹ S 1 I 1 ⟹ I 2 〈 S 1 , I 1 〉 ⊑ 〈 S 2 , I 2 〉

Enforcing IFC Data may flow from one entity to another iff • ➤ it accumulates more secrecy restrictions ➤ it losses integrity restrictions Principal’s whose consent is needed S 2 ⟹ S 1 I 1 ⟹ I 2 to observe S 2 must include those of S 1 〈 S 1 , I 1 〉 ⊑ 〈 S 2 , I 2 〉

Enforcing IFC Data may flow from one entity to another iff • ➤ it accumulates more secrecy restrictions ➤ it losses integrity restrictions Principal’s whose Dual of secrecy. consent is needed I 2 must be less S 2 ⟹ S 1 I 1 ⟹ I 2 to observe S 2 restricting than I 1 must include those of S 1 〈 S 1 , I 1 〉 ⊑ 〈 S 2 , I 2 〉

Example of label relations Secrecy 〈 {Alice ⋁ Bob}, True 〉 〈 {Alice ⋁ Bob ⋁ Charlie}, True 〉 〈 {Alice ⋁ Bob}, True 〉 〈 {Alice ⋀ Dan}, True 〉 〈 {Alice ⋀ Bob}, True 〉 〈 {Alice}, True 〉

Example of label relations Secrecy ✗ 〈 {Alice ⋁ Bob}, True 〉 〈 {Alice ⋁ Bob ⋁ Charlie}, True 〉 〈 {Alice ⋁ Bob}, True 〉 〈 {Alice ⋀ Dan}, True 〉 〈 {Alice ⋀ Bob}, True 〉 〈 {Alice}, True 〉

Example of label relations Secrecy ✗ 〈 {Alice ⋁ Bob}, True 〉 〈 {Alice ⋁ Bob ⋁ Charlie}, True 〉 ✓ 〈 {Alice ⋁ Bob}, True 〉 〈 {Alice ⋀ Dan}, True 〉 〈 {Alice ⋀ Bob}, True 〉 〈 {Alice}, True 〉

Example of label relations Secrecy ✗ 〈 {Alice ⋁ Bob}, True 〉 〈 {Alice ⋁ Bob ⋁ Charlie}, True 〉 ✓ 〈 {Alice ⋁ Bob}, True 〉 〈 {Alice ⋀ Dan}, True 〉 ✗ 〈 {Alice ⋀ Bob}, True 〉 〈 {Alice}, True 〉

Example of label relations Integrity 〈 True , {Alice ⋁ Bob} 〉 〈 True , {Alice ⋁ Bob ⋁ Charlie} 〉 〈 True , {Alice} 〉 〈 True , {Alice ⋁ Bob} 〉 〈 True , {Alice} 〉 〈 True , {Alice ⋀ Bob} 〉

Example of label relations Integrity ✓ 〈 True , {Alice ⋁ Bob} 〉 〈 True , {Alice ⋁ Bob ⋁ Charlie} 〉 〈 True , {Alice} 〉 〈 True , {Alice ⋁ Bob} 〉 〈 True , {Alice} 〉 〈 True , {Alice ⋀ Bob} 〉

Example of label relations Integrity ✓ 〈 True , {Alice ⋁ Bob} 〉 〈 True , {Alice ⋁ Bob ⋁ Charlie} 〉 ✓ 〈 True , {Alice} 〉 〈 True , {Alice ⋁ Bob} 〉 〈 True , {Alice} 〉 〈 True , {Alice ⋀ Bob} 〉

Example of label relations Integrity ✓ 〈 True , {Alice ⋁ Bob} 〉 〈 True , {Alice ⋁ Bob ⋁ Charlie} 〉 ✓ 〈 True , {Alice} 〉 〈 True , {Alice ⋁ Bob} 〉 ✗ 〈 True , {Alice} 〉 〈 True , {Alice ⋀ Bob} 〉

DC Labels form a lattice Combining differently labeled data ➠ join ⊔ • 〈 S 1 , I 1 〉 ⊔ 〈 S 2 , I 2 〉 = 〈 S 1 ⋀ S 2 , I 1 ⋁ I 2 〉 Writing to differently labeled entities ➠ meet ⊓ • ➤ Dual of join: 〈 S 1 , I 1 〉 ⊓ 〈 S 2 , I 2 〉 = 〈 S 1 ⋁ S 2 , I 1 ⋀ I 2 〉

DC Labels form a lattice Combining differently labeled data ➠ join ⊔ • Need consent of principals in S 1 and S 2 to observe data 〈 S 1 , I 1 〉 ⊔ 〈 S 2 , I 2 〉 = 〈 S 1 ⋀ S 2 , I 1 ⋁ I 2 〉 Writing to differently labeled entities ➠ meet ⊓ • ➤ Dual of join: 〈 S 1 , I 1 〉 ⊓ 〈 S 2 , I 2 〉 = 〈 S 1 ⋁ S 2 , I 1 ⋀ I 2 〉

DC Labels form a lattice Combining differently labeled data ➠ join ⊔ • Principals of I 1 or I 2 could Need consent of principals in have created the data S 1 and S 2 to observe data 〈 S 1 , I 1 〉 ⊔ 〈 S 2 , I 2 〉 = 〈 S 1 ⋀ S 2 , I 1 ⋁ I 2 〉 Writing to differently labeled entities ➠ meet ⊓ • ➤ Dual of join: 〈 S 1 , I 1 〉 ⊓ 〈 S 2 , I 2 〉 = 〈 S 1 ⋁ S 2 , I 1 ⋀ I 2 〉