Outline Review Decidability of security Take-Grant Protection Model Lecture 3: Decidability January 11, 2011 Lecture 3, Slide 1 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model 1 Review 2 Decidability of security Mono-operational command case General case 3 Take-Grant Protection Model Sharing rights Take-Grant Systems Stealing rights Conspiracy Lecture 3, Slide 2 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model Why no “or”? Unnecessary! Break conditional expression into sequence of disjuncts Write command with same body for each disjunct Call them sequentially! Lecture 3, Slide 3 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model r , c Commands command grant · read · f i l e · i f r ( p , f ) in A[ p , f ] i f r then into A[ q , f ] ; enter r enter w into A[ q , f ] ; end command grant · read · f i l e · i f c ( p , f ) i f c in A[ p , f ] then enter r into A[ q , f ] ; enter w into A[ q , f ] ; end Lecture 3, Slide 4 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model r or c Command command grant · read · f i l e · i f r o r c ( p , f ) grant · read · f i l e · i f r ( p , f ) grant · read · f i l e · i f c ( p , f ) end Lecture 3, Slide 5 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model What is “Secure”? Leaking Adding a generic right r where there was not one is leaking Safe If a system S , beginning in initial state s 0 , cannot leak right r , it is safe with respect to the right r . Here, “safe” = “secure” for an abstract model Lecture 3, Slide 6 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model What is Does “Decidable” Mean? Safety Question Does there exist an algorithm for determining whether a protection system S with initial state s 0 is safe with respect to a generic right r ? Lecture 3, Slide 7 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model Mono-operational command case Mono-Operational Commands Answer: Yes! Proof sketch: Consider minimal sequence of commands c 1 , . . . , c k to leak the right Can omit delete , destroy Can merge all create s into one Worst case: insert every right into every entry; with s subjects, o objects, and n rights initially, upper bound is k ≤ n ( s + 1)( o + 1) Lecture 3, Slide 8 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model Mono-operational command case Proof (1) Consider minimal sequences of commands (of length m ) needed to leak r from system with initial state s 0 Identify each command by the type of primitive operation it invokes Cannot test for absence of rights, so delete , destroy not relevant Ignore them Reorder sequences of commands so all create s come first Can be done because enter s require subject, object to exist Commands after these create s check only for existence of right Lecture 3, Slide 9 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model Mono-operational command case Proof (2) It can be shown (see homework): Suppose s 1 , s 2 are created, and commands test rights in A [ s 1 , o 1 ], A [ s 2 , o 2 ] Doing the same tests on A [ s 1 , o 1 ] and A [ s 1 , o 2 ] = A [ s 1 , o 2 ] ∪ A [ s 2 , o 2 ] gives same result Thus all create s unnecessary Unless s 0 is empty; then you need to create it (1 create ) In s 0 : | S 0 | number of subjects, | O 0 | number of objects, n number of (generic) rights In worst case, 1 create So a total of at most ( | S 0 | + 1)( | O 0 | + 1) elements So m ≤ n ( | S 0 | + 1)( | O 0 | + 1) Lecture 3, Slide 10 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model General case General Case Answer: No Proof sketch: 1 Show arbitrary Turing machine can be reduced to safety problem 2 Then deciding safety problem means deciding the halting problem Lecture 3, Slide 11 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model General case Turing Machine Review Infinite tape in one direction States K , symbols M , distinguished blank b / State transition function δ ( k , m ) = ( k ′ , m ′ , L) in state k with symbol m under the TM head replace m with m ′ , move head left one square, enter state k ′ Halting state is q f Lecture 3, Slide 12 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model General case Mapping Turing machine access control matrix representation s 1 s 2 s 3 s 4 · · · s 1 A o · · · 1 2 3 4 · · · B · · · s 2 o A B C D · · · ⇒ s 3 C k o · · · ↑ D e · · · s 4 k . . . . . ... . . . . . . . . . . Turing machine with head over square 3 on tape, in state k and its representation as an access control matrix o is own right e is end right Lecture 3, Slide 13 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model General case Mapping Turing machine access control matrix representation · · · s 1 s 2 s 3 s 4 s 1 A o · · · 1 2 3 4 · · · s 2 B o · · · A B X D · · · ⇒ X · · · s 3 o ↑ s 4 D k 1 e · · · k 1 . . . . . ... . . . . . . . . . . After δ ( k , C) = ( k 1 , X, R), where k is the previous state and k 1 the current state Lecture 3, Slide 14 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model General case Command Mapping δ ( k , C) = ( k 1 , X, R) at intermediate becomes: command c k , C ( s i , s i +1 ) i f o in A[ s i , s i +1 ] and k in A[ s i , s i ] and C in A[ s i , s i ] then delete k from A[ s i , s i ] ; delete C from A[ s i , s i ] ; enter X into A[ s i , s i ] ; enter k 1 into A[ s i +1 , s i +1 ] ; end Lecture 3, Slide 15 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model General case Mapping Turing machine access control matrix representation s 1 s 2 s 3 s 4 s 5 A s 1 o 1 2 3 4 5 A B X Y / b s 2 B o ⇒ X ↑ s 3 o s 4 Y o k 2 s 5 k 2 e After δ ( k 1 , D) = ( k 2 , Y, R), where k 1 is the previous state and k 2 the current state Lecture 3, Slide 16 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model General case Command Mapping δ ( k 1 , D) = ( k 2 , Y, R) at intermediate becomes: command crightmost k , D ( s i , s i +1 ) i f e in A[ s i , s i ] and k 1 in A[ s i , s i ] and D in A[ s i , s i ] then e from A[ s i , s i ] ; delete create subject y ; enter o into A[ s i , s i +1 ] ; enter e into A[ s i +1 , s i +1 ] ; delete k 1 from A[ s i , s i ] ; delete D from A[ s i , s i ] ; enter Y into A[ s i , s i ] ; enter k 2 into A[ s i +1 , s i +1 ] ; end Lecture 3, Slide 17 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model General case Rest of Proof Protection system exactly simulates a Turing machine Exactly 1 end ( e ) right in access control matrix 1 right in entries corresponds to state Thus, at most 1 applicable command If Turing machine enters state q f , then right has leaked If safety question decidable, then represent TM as protection system and determine if q f leaks This implies halting problem is decidable Conclusion: safety question undecidable Lecture 3, Slide 18 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model General case Other Results Set of unsafe symbols is recursively enumerable Delete create primitive; then safety question is complete in P-SPACE Delete destroy , delete primitives; then safety question is undecidable Such systems are called monotonic Safety question for monoconditional, monotonic protection systems is decidable Safety question for monoconditional protection systems with create , enter , delete (and no destroy ) is decidable Lecture 3, Slide 19 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Outline Review Decidability of security Take-Grant Protection Model Take-Grant Protection Model A specific (not generic) system Set of rules for state transitions Safety decidable, and in time linear with the size of the system Goal: find conditions under which rights can be transferred from one entity to another in the system Lecture 3, Slide 20 ECS 235B, Foundations of Information and Computer Security January 11, 2011
Recommend
More recommend
