Chapter 3: Foundational Results
• Overview
• Harrison-Ruzzo-Ullman result
– Corollaries
• Take-Grant Protection Model
• SPM and successors
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-1
Overview
•
•
•
•
Safety Question
HRU Model
Take-Grant Protection Model
SPM, ESPM
– Multiparent joint creation
• Expressive power
• Typed Access Matrix Model
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-2
What Is “Secure”?
• Adding a generic right r where there was
not one is “leaking”
• If a system S, beginning in initial state s0,
cannot leak right r, it is safe with respect to
the right r.
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-3
Safety Question
• Does there exist an algorithm for
determining whether a protection system S
with initial state s0 is safe with respect to a
generic right r?
– Here, “safe” = “secure” for an abstract model
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-4
Mono-Operational Commands
• Answer: yes
• Sketch of proof:
Consider minimal sequence of commands c1, …,
ck to leak the right.
– Can omit delete, destroy
– Can merge all creates into one
Worst case: insert every right into every entry;
with s subjects and o objects initially, and n
rights, upper bound is k ≤ n(s+1)(o+1)
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-5
General Case
• Answer: no
• Sketch of proof:
Reduce halting problem to safety problem
Turing Machine review:
– Infinite tape in one direction
– States K, symbols M; distinguished blank b
– Transition function (k, m) = (k, m, L) means in state
k, symbol m on tape location replaced by symbol m,
head moves to left one square, and enters state k
– Halting state is qf; TM halts when it enters this state
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-6
Mapping
1
2
3
4
A
B C D …
s1
head
Current state is k
s2
s1
s2
A
own
B
s3
s4
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
s3
s4
own
Ck
own
D end
Slide #3-7
Mapping
1
2
3
4
A
B X D …
s1
head
s2
After (k, C) = (k1, X, R)
where k is the current
state and k1 the next state
July 1, 2004
s1
s2
A
own
B
s3
s4
Computer Security: Art and Science
©2002-2004 Matt Bishop
s3
s4
own
X
own
D k1 end
Slide #3-8
Command Mapping
(k, C) = (k1, X, R) at intermediate becomes
command ck,C(s3,s4)
if own in A[s3,s4] and k in A[s3,s3]
and C in A[s3,s3]
then
delete k from A[s3,s3];
delete C from A[s3,s3];
enter X into A[s3,s3];
enter k1 into A[s4,s4];
end
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-9
Mapping
1
2
3
4
A
B X D …
s1
head
s2
After (k, C) = (k1, X, R)
where k is the current
state and k1 the next state
July 1, 2004
s1
s2
A
own
B
s3
s4
Computer Security: Art and Science
©2002-2004 Matt Bishop
s3
s4
own
X
own
D k1 end
Slide #3-10
Mapping
1
2
3
4
5
A
B X Y
b
s1
head
s2
After (k1, D) = (k2, Y, R)
where k1 is the current
state and k2 the next state
July 1, 2004
s1
s2
A
own
B
s3
s4
s5
Computer Security: Art and Science
©2002-2004 Matt Bishop
s3
s4
s5
own
X
own
Y
own
b k2 end
Slide #3-11
Command Mapping
(k1, D) = (k2, Y, R) at end becomes
command crightmostk,C(s4,s5)
if end in A[s4,s4] and k1 in A[s4,s4]
and D in A[s4,s4]
then
delete end from A[s4,s4];
create subject s5;
enter own into A[s4,s5];
enter end into A[s5,s5];
delete k1 from A[s4,s4];
delete D from A[s4,s4];
enter Y into A[s4,s4];
enter k2 into A[s5,s5];
end
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-12
Rest of Proof
• Protection system exactly simulates a TM
– Exactly 1 end right in ACM
– 1 right in entries corresponds to state
– Thus, at most 1 applicable command
• If TM enters state qf, then right has leaked
• If safety question decidable, then represent TM as
above and determine if qf leaks
– Implies halting problem decidable
• Conclusion: safety question undecidable
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-13
Other Results
• Set of unsafe systems is recursively enumerable
• Delete create primitive; then safety question is complete in
P-SPACE
• Delete destroy, delete primitives; then safety question is
undecidable
– Systems are monotonic
• Safety question for monoconditional, monotonic protection
systems is decidable
• Safety question for monoconditional protection systems
with create, enter, delete (and no destroy) is decidable.
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-14
Take-Grant Protection Model
• A specific (not generic) system
– Set of rules for state transitions
• Safety decidable, and in time linear with the
size of the system
• Goal: find conditions under which rights
can be transferred from one entity to
another in the system
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-15
System

l

objects (files, …)
subjects (users, processes, …)
don't care (either a subject or an object)
G |–x G'
apply a rewriting rule x (witness) to
G to get G'
G |–* G'
apply a sequence of rewriting rules
(witness) to G to get G'
R = { t, g, r, w, … } set of rights
t and g are special rights
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-16
System
Digraph G = <V,E>
V = O  S, O = set of objects, S = set of subjects
E = directed edges, E  V x V
L = label function, L: E → 2R, subset of rights
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-17
de jure Rules
take
xl

t
z
xl

z

t
y
y
Subject x with take rights to node y can acquire any rights
 that y already has to node z.
grant
y
g
x

z
y
l

g
x

z
l
Subject x with grant rights to node y can grant any rights 
that x already has to node z.
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-18
More de jure Rules
create
l
l


Subject x can create new node y with any rights  to y.
remove
l


l
–

Subject x can remove any rights  it already has to node y.
These four rules are called the de jure rules
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-19
Symmetry
x
l

t

y
x
|–

l
lz

t

y
lz
t and g rights are symmetric for subjects in the
sense that the direction of the arc does not matter
when it comes to acquiring rights!
Nota bene: endpoints must be subjects!
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-20
Symmetry of take
x

l
t
tg


lz

y
|–

l
t


l
v
Witness is 4 steps long
1. x creates (tg to new) v
2. z takes (g to v) from x
Similar result for grant
3. z grants ( to y) to v
Exercise: prove it!
4. x takes ( to y) from v (yes, now!)
(Extra arcs are removed
for sake of clarity
July 1, 2004
Computer Security: Art and Science
Slide #3-21

g
©2002-2004 Matt Bishop
Islands
• tg-path: path of distinct vertices connected
by edges labeled t or g
– Call them “tg-connected”
• island: maximal tg-connected subject-only
subgraph
– Any right one vertex has can be shared with
any other vertex
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-22
Islands
• island: maximal tg-connected subject-only
subgraph
– Any right one vertex has can be shared with
any other vertex
ul
g
l
v
July 1, 2004



t
l
w

t
l
x

g
z

ly
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-23
Bridges
• For a right to be transferred from second
island to first island requires that either:
– Subject in first island be able to take a right
from a vertex in the second island, or
– Subject in second island be able to grant a right
to an intermediate object, from which a subject
in the first island may take the right
• Word associated with path (ν is null)
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-24
Bridges
• bridge: tg-path between subjects x, y, with
associated word in
      
{ t*, t*, t*g t*, t*g t* }
– rights can be transferred between the two
endpoints
– not an island as intermediate vertices are
objects
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-25
Bridges
• bridge: tg-path between subjects x, y, with
associated word in
      
{ t*, t*, t*g t*, t*g t* }


xl
t
u
July 1, 2004
t

t
t
t
z
ly
t
v
t
w
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-26
Bridges
• bridge: tg-path between subjects x, y, with
associated word in
      
{ t*, t*, t*g t*, t*g t* }
Now you try it!


xl
July 1, 2004

t
t
u
z
t
t
t
v
t
ly
t
Because…
Symmetry of take
for subjects
w
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-27
Bridges
• bridge: tg-path between subjects x, y, with
associated word in
      
{ t*, t*, t*g t*, t*g t* }


xl
t
u
July 1, 2004
z


g
t
t
v
g
ly
t
w
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-28
Bridges
• bridge: tg-path between subjects x, y, with
associated word in
      
{ t*, t*, t*g t*, t*g t* }
Now you try it!

q
tg


g
xl
t
u
July 1, 2004
t
t
v

ly
t
g
g
z
g
w
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-29
Initial, Terminal Spans
• initial span from x to y
– x subject

– tg-path between x, y with word in { t*g }  {  }
– Means x can give rights it has to y
• terminal span from x to y
– x subject

– tg-path between x, y with word in { t* }  {  }
– Means x can acquire any rights y has
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-30
Initial Span
• initial span from x to y
– x subject

– tg-path between x, y with word in { t*g }  {  }
– Means x can give rights it has to y
q

xl
t
u
July 1, 2004
g
t
t

v
g

y
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-31
Terminal Span
• terminal span from x to y
– x subject

– tg-path between x, y with word in { t* }  {  }
– Means x can acquire any rights y has


xl
t
u
July 1, 2004
t

t
t
t
z
y
t
v
t
w
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-32
Example
p gets r right to q
pl
r
r
s

g
t
u
t
s'l
l
•
•
•
•
t
r

v
g
islands
bridges
initial span
terminal span
July 1, 2004
l
w
g

x
r q

r
r
t
l
y
< p, u > < w > < y, s' >
<u, v, w>; <w, x, y>
<p> (associated word )

<s’, s> (associated word t)
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-34
can•share Predicate
Definition:
• can•share(r, x, y, G0) if, and only if, there is
a sequence of protection graphs G0, …, Gn
such that G0 |–* Gn using only de jure rules
and in Gn there is an edge from x to y
labeled r.
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-35
can•share Theorem
• can•share(r, x, y, G0) if, and only if, there is
an edge from x to y labeled r in G0, or the
following hold simultaneously:
–
–
–
–
There is an s in G0 with an s-to-y edge labeled r
There is a subject x = x or initially spans to x
There is a subject s = s or terminally spans to s
There are islands I1,…, Ik connected by bridges,
and x in I1 and s in Ik
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-36
Proof Sketch (=>)
xl
IS
g
t
…

…
B1
terminal span
initial span
islands
bridges
July 1, 2004
g
…
t
l
I2
…
Ik
…
x’l
t/g t
l
I1 l
t/g
l
t
TS
s
t
s'l
… t 
r
t/g
t/g
…. . . . . . . … l
t
t B
2
Bk-1
y
Can x get r right to y?
There is s in G0 with an s-to-y edge labeled r
There is subject s = s or terminally spans to s
There is subject x = x or initially spans to x
There are islands I1,…, Ik with x in I1 and s in Ik
Each island Ij is connected to Ij+1 by bridge Bj
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-37
Proof Sketch (=>)
IS g
r
g
t
…

r
TS
s
t
s'l
… t 
r
t/g
r
Ik
y
…
…
x’l
t/g t
l
I1 l
t/g
l
t
xl
r
…
B1
g
…
t
l
I2
t/g
r
…. . . . . . . … l
t
t B
2
Bk-1
r
Can x get r right to y?
YES!
s’ takes r to y over TS
x’ gets r to y over islands and bridges
x’ grants x r to y over IS
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-38
Outline of Proof (=>)
• s has r rights over y
• s acquires r rights over y from s
– Definition of terminal span
• x acquires r rights over y from s
– Repeated application of sharing among vertices
in islands, passing rights along bridges
• x gives r rights over y to x
– Definition of initial span
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-39
Outline of Proof (<=)
For x to get r to y, it must be be the case that:
• There is an s in G0 with an s-to-y edge labeled r
• There is a subject x = x or initially spans to x
• There is a subject s = s or terminally spans to s
• There are islands I1,…, Ik connected by bridges,
and x in I1 and s in Ik
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-40
Outline of Proof (<=)
• There is an s in G0 with an s-to-y edge labeled r
– If no node s with r rights to y, then there is no way
for any node to get r rights to y ever:
– Create can’t do it (can only add rights to new node)
– x take (r to y) from z requires z to have (r to y)
– z grant (r to y) to x requires z to have (r to y)
– Remove clearly cannot add any rights
– Hence, there must be such a node s in G0.
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-41
Outline of Proof (<=)
• Either s is a subject or there is a subject s that
terminally spans to s
– The only way for a node u to acquire (r to y) from s
is though the take or grant de jure rule
– Grant requires s to be a subject (we’re done!)
– If not, then there must be a subject s that either has
(t to s) or can acquire (t to s)
– If s is a subject that can acquire (t to s) in the fewest
steps, then s terminally spans to s
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-42
Outline of Proof (<=)
• There is a subject x = x or x initially spans to x
– If x is not a subject, then it can only acquire (r to y)
if some subject x that already has (r to y) uses the
grant rule
– If x does not have (g to x) then it must either be
granted (g to x) by some other subject z (hence they
are in the same island and let z be x) or take (g to x)
from some object u
– Hence there must be a subject x that initially spans
to x if x is not a subject
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-43
Outline of Proof (<=)
• There are islands I1,…, Ik connected by bridges,
and x in I1 and s in Ik
– If x is not s, then s must be able to share (r to y)
with x
– If x and s are not in the same island, then let x be in
I1 and s be in I’. I1 must be able to acquire (r to y)
from some other island I2 that has or can get (r to y)
– The only way to transfer rights between islands is
through bridges, so there must be a sequence of
bridges and islands between I1 and I’.
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-44
can•steal Predicate
Definition:
• can•steal(, x, y, G0) if, and only if, there is
no edge in G0 from x to y labeled , and
there is a sequence of protection graphs G0,
…, Gn such that
– there is an edge from x to y labeled  in Gn;
– G0 |–* Gn using only de jure rules; and
– no subject grants ( rights to y) to another node
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-45
can•steal Predicate
The first two stipulations say that x gets 
rights to y properly
The last stipulation says that owners of (
rights to y) don’t give them away
Note that a subject can grant other rights
Note that ( rights to y) may be taken (in fact,
they must be taken!)
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-46
can•steal Example
v
t
xl

t
g
l
u
July 1, 2004
1. u grants (t to v) to x
2. x takes (t to u) from v
3. x takes ( to y) from u
t
t


y
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-47
can•steal Theorem
• can•steal(, x, y, G0) if, and only if the
following hold simultaneously:
– There is no edge from x to y labeled  in G0
– There is a subject x = x or initially spans to x
– There is an s in G0 with an s-to-y edge labeled
 for which can•share(t, x, s, G0) holds
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-48
Key Question
• Characterize class of models for which
safety is decidable
– Existence: Take-Grant Protection Model is a
member of such a class
– Universality: In general, question undecidable,
so for some models it is not decidable
• What is the dividing line?
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-49
Schematic Protection Model
• Type-based model
– Protection type: entity label determining how control
rights affect the entity
• Set at creation and cannot be changed
– Ticket: description of a single right over an entity
• Entity has sets of tickets (called a domain)
• Ticket is X/r, where X is entity and r right
• Rights have flag set if copyable - r:c is a copyable right
– Functions determine rights transfer
• Link: are source, target “connected”?
• Filter: is transfer of ticket authorized?
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-50
Link Predicate
• Idea: linki(X, Y) if X can assert some control right
over Y
• Conjunction of disjunction of:
–
–
–
–
–
X/z  dom(X)
X/z  dom(Y)
Y/z  dom(X)
Y/z  dom(Y)
true
Some right z
Tickets of X
Tickets of Y
• Transfer of rights is subject to filter function!
• Finite set of link predicates is called a scheme
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-51
Examples
• Take-Grant:
link(X, Y) = Y/g  dom(X) v X/t  dom(Y)
X has (g to Y) or Y has (t to X)
• Broadcast:
link(X, Y) = X/b  dom(X)
X has broadcast rights (still need filter to OK it)
• Pull:
link(X, Y) = Y/p  dom(Y)
Y has pull rights (still need filter to OK it)
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-52
Filter Function
• Range is set of copyable ticket prototypes
– Entity type, right
• Domain is subject entity type pairs
• Copy a ticket X/r:c from dom(Y) to dom(Z)
– X/r:c  dom(Y)
Y can’t give what it doesn’t have
Predicate i specifies link exists
– linki(Y, Z)
Filter i allows copy for types
– (X)/r:c  fi((Y), (Z))
and right r
• One filter function per link function
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-53
Example
• f((Y), (Z)) = T  R
– Any ticket can be transferred (if other
conditions met)
• f((Y), (Z)) = T  RI
– Only tickets with inert rights can be transferred
(if other conditions met)
• f((Y), (Z)) = 
– No tickets can be transferred
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-54
Example
• Take-Grant Protection Model
–
–
–
–
TS = {subject }, TO = {object }
RC = { tc, gc }, RI = { rc, wc }
link(p, q) = p/t  dom(q)  q/g  dom(p)
f(subject, subject) =
{subject, object }  { tc, gc, rc, wc }
Recall: (T3, r) in f(T1, T2) means entities of type T1
are allowed to transfer (r rights to entities of type T3)
to entities of type T2
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-55
Example
• Take-Grant Protection Model
• Is this predicate and filter sufficient?
– link(p, q) = p/t  dom(q)  q/g  dom(p)
– f(subject, subject) =
{subject, object }  { tc, gc, rc, wc }
What does this say?
This says that any right to any entity can be copied
from any subject p to another subject q as long as p
has grant rights to q or q has take rights to p, and p has
the right that is toComputer
be copied
July 1, 2004
Security: Art and Science
Slide #3-56
©2002-2004 Matt Bishop
Example
• Take-Grant Protection Model
• Is this predicate and filter sufficient?
– What about transfers of rights to objects?
– link(p, q) = q/g  dom(p)
– f(subject, object ) =
{subject, object }  { tc, gc, rc, wc }
Any subject can give any object any copyable right to
any entity, provided that the subject has grant rights to
the object, and the subject has the right to be copied
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-57
Example
• Take-Grant Protection Model
• Is this predicate and filter sufficient?
– What about transfers of rights from objects?
– link(p, q) = p/t  dom(q)
– f(object, subject ) =
{subject, object}  { tc, gc, rc, wc }
Any subject can take from any object any copyable right
to any entity, provided that the subject has take rights to
the object, and the object has the right to be copied
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-58
Practice
• Simple Discretionary Access
– There are users and files (these will be types)
– The owner of a file can give r/w access to that
file any other user
• What are link predicates?
– link(p, q) = TRUE
Any pair of subjects may possibly transfer rights between
them – subject to filter function
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-59
Practice
• Simple Discretionary Access
– There are users and files (these will be types)
– The owner of a file can give r/w access to that
file any other user
• What is filter?
– f(user, user) = {file}  { r:c, w:c }
Any user can give any read or write rights it has to a file
to any other user
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-60
Demand Operation
• Demand function d:TS → 2TR
– Authorizes subject of type a to demand a
specific right r from any entity of type b if
(b,r)  d(a)
• If (X) = b, and (Y) = a, and Z/r in dom(X)
then Y can demand that X give it Z/r
provided that (b,r)  d(a)
• Generalizes take rule in Take-Grant Model
– Turns out it can be eliminated (Sandhu)
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-61
Create Operation
• Must handle type, tickets of new entity
• Relation can•create(a, b)
– Subject of type a can create entity of type b
• Rule of acyclic creates:
a
b
cyclic
d
b
acyclic
c
c
July 1, 2004
a
d
NB: self-loop allowed
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-62
Create-Rule
• cr(a, b): specifies tickets introduced when
subject of type a creates entity of type b
• cr(a, b): T  T → 2TR
• If B is an object, (B)=b, then:
cr(a, b)  { b/r:c | r:c  RI }
– i.e., only tickets with inert rights can be created
– Tickets prototyped in cr(a, b) are added to
dom(A) for entity B that A created
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-63
Create-Rule (2)
• cr(a, b): specifies tickets introduced when
subject of type a creates entity of type b
• If B is a subject then cr(a, b) has two parts:
–
–
–
–
Parent part crP(a, b) for dom(A), and
Child part crC(a, b) for dom(B)
dom(A) gets B/r:c if b/r:c in crP(a, b)
dom(B) gets A/r:c if a/r:c in crC(a, b)
• Write cr(a, b) = crP(a, b)  crC(a, b)
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-64
Non-Distinct Types
Write cr(a, b) = crP(a, b)  crC(a, b)
– Use types to distinguish parent & child
What if a = b? cr(a, a): Who gets what?
– Can’t use types to distinguish parent & child!
• self/r:c are tickets for creator
• a/r:c tickets for created entity
cr(a, a)  { a/r:c, self/r:c | r:c  R}
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-65
Attenuating Create Rule
cr(a, a) is attenuating if:
1. crC(a, b)  crP(a, b) and
2. a/r:c  crP(a, b)  self/r:c  crP(a, b)
i.e., the child has no ticket the parent doesn’t have
A scheme is attenuating if, for all types such
that cc(a,a), then cr(a,a) is attenuating.
If the graph for cc has no loops, then it is attenuating
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-66
Safety Result
• If the scheme is acyclic and attenuating, the
safety question is decidable
• Approach: define derivable states from an initial
state in the obvious way
• Define flow within a protection state for a pair of
entities as the rights that can be sent
• Define a relation based on flow containment
• Partition states into equivalence classes
• Maximal states in one EC, define possible flows
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-67
Expressive Power
• How do the sets of systems that models can
describe compare?
– If HRU equivalent to SPM, SPM provides more
specific answer to safety question
– If HRU describes more systems, SPM applies
only to the systems it can describe
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-68
HRU vs. SPM
• SPM more abstract
– Analyses focus on limits of model, not details of
representation
• HRU allows revocation
– SMP has no equivalent to delete, destroy
– Fairer to compare SPM to monotonic HRU
• HRU allows multiparent creates
– SMP cannot express multiparent creates easily, and not
at all if the parents are of different types because
can•create allows for only one type of creator
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-69
Multiparent Create
• Solves mutual suspicion problem
– Create proxy jointly, each gives it needed rights
• In HRU:
command multicreate(s0, s1, o)
if p in a[s0, s1] and p in a[s1, s0]
then
create object o;
enter r into a[s0, o];
enter r into a[s1, o];
end
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-70
ESPM and Multiparent Create
• can•create extended in obvious way
– cc  TS  …  TS  T
So, what does R1,i represent?
What about R2,i?
• Symbols
– X1, …, Xn parents, Y created What about R3? And why no i?
What about R4,i?
– R1,i, R2,i, R3, R4,i  R
• Rules
– crP,i((X1), …, (Xn)) = Y/R1,i  Xi/R2,i
– crC((X1), …, (Xn)) = Y/R3  X1/R4,1  …  Xn/R4,n
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-71
Example
• Anna, Bill must do something cooperatively
– But they don’t trust each other
• Jointly create a proxy
– Each gives proxy only necessary rights
• In ESPM:
–
–
–
–
Anna, Bill type a; proxy type p; right x  R
cc(a, a) = p
crAnna(a, a, p) = crBill(a, a, p) = 
crproxy(a, a, p) = { Anna/x, Bill//x }
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-72
2-Parent Joint Create Suffices
• Goal: emulate 3-parent joint create with 2parent joint create
• Definition of 3-parent joint create (subjects P1, P2,
P3; child C):
–
–
–
–
–
cc((P1), (P2), (P3), (C)) = TRUE
crP1((P1), (P2), (P3), (C)) = C/R1,1  P1/R2,1
crP2((P1), (P2), (P3), (C)) = C/R2,1  P2/R2,2
crP3((P1), (P2), (P3), (C)) = C/R3,1  P3/R2,3
crC((P1),(P2),(P3),(C)) =
Y/R3  P1/R4,1  P2/R4,2  P3/R4,3
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-73
General 2-Parent Approach
• Define agents for parents and child
• Chain creations through agents
– Agents act as surrogates for parents
– If create fails, parents have no extra rights
– If create succeeds, parents, child have exactly
same rights as in 3-parent creates
• Only extra rights are to agents (which are never used
again, and so these rights are irrelevant)
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-74
Entities and Types
•
•
•
•
•
Parents P1, P2, P3 have types p1, p2, p3
Child C of type c
Parent agents A1, A2, A3 of types a1, a2, a3
Child agent S of type s
Type t is parentage
– if X/t  dom(Y), X is Y’s parent
• Types t, a1, a2, a3, s are new types
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-75
Can•Create
• Following added to can•create:
– cc(p1) = a1
– cc(p2, a1) = a2
– cc(p3, a2) = a3
Inconsistent use of cc
Should be cc(p1, a1)=True
• Parents creating their agents; note agents have maximum of 2
parents
– cc(a3) = s
• Agent of all parents creates agent of child
– cc(s) = c
• Agent of child creates child
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-76
Creation Rules
• Following added to create rule:
– crP(p1, a1) = 
– crC(p1, a1) = p1/Rtc
• Agent’s parent set to creating parent; agent has all rights over
parent
– crPfirst(p2, a1, a2) = 
– crPsecond(p2, a1, a2) = 
– crC(p2, a1, a2) = p2/Rtc  a1/tc
• Agent’s parent set to creating parent and agent; agent has all
rights over parent (but not over agent)
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-77
Creation Rules
– crPfirst(p3, a2, a3) = 
– crPsecond(p3, a2, a3) = 
– crC(p3, a2, a3) = p3/Rtc  a2/tc
• Agent’s parent set to creating parent and agent; agent has all
rights over parent (but not over agent)
– crP(a3, s) = 
– crC(a3, s) = a3/tc
• Child’s agent has third agent as parent crP(a3, s) = 
– crP(s, c) = C/Rtc
– crC(s, c) = c/R3t
July 1, 2004
• Child’s agent gets full rights over child; child gets R3 rights
over agent
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-78
Link Predicates
• Idea: no tickets to parents until child created
– Done by requiring each agent to have its own parent
rights
–
–
–
–
–
–
–
–
–
link1(A1, A2) = A1/t  dom(A2)  A2/t  dom(A2)
link1(A2, A3) = A2/t  dom(A3)  A3/t  dom(A3)
link2(S, A3) = A3/t  dom(S)  C/t  dom(C)
link3(A1, C) = C/t  dom(A1)
link3(A2, C) = C/t  dom(A2)
link3(A3, C) = C/t  dom(A3)
link4(A1, P1) = P1/t  dom(A1)  A1/t  dom(A1)
link4(A2, P2) = P2/t  dom(A2)  A2/t  dom(A2)
link4(A3, P3) = P3/t  dom(A3)  A3/t  dom(A3)
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-79
Filter Functions
•
•
•
•
•
•
•
•
•
f1(a2, a1) = a1/t  c/Rtc
f1(a3, a2) = a2/t  c/Rtc
f2(s, a3) = a3/t  c/Rtc
f3(a1, c) = p1/R4,1
f3(a2, c) = p2/R4,2
f3(a3, c) = p3/R4,3
f4(a1, p1) = c/R1,1  p1/R2,1
f4(a2, p2) = c/R1,2  p2/R2,2
f4(a3, p3) = c/R1,3  p3/R2,3
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-80
Construction
Create A1, A2, A3, S, C; then
• P1 has no relevant tickets
• P2 has no relevant tickets
• P3 has no relevant tickets
• A1 has P1/Rtc
• A2 has P2/Rtc  A1/tc
• A3 has P3/Rtc  A2/tc
• S has A3/tc  C/Rtc
• C has C/tR3
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-81
Construction
• Only link2(S, A3) true  apply f2
– A3 has P3/Rtc  A2/t  A3/t  C/Rtc
• Now link1(A3, A2) true  apply f1
– A2 has P2/Rtc  A1/tc  A2/t  C/Rtc
• Now link1(A2, A1) true  apply f1
– A1 has P2/Rtc  A1/tc  A1/t  C/Rtc
• Now all link3s true  apply f3
– C has C/R3  P1/R4,1  P2/R4,2  P3/R4,3
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-82
Finish Construction
• Now link4s true  apply f4
– P1 has C/R1,1  P1/R2,1
– P2 has C/R1,2  P2/R2,2
– P3 has C/R1,3  P3/R2,3
• 3-parent joint create gives same rights to P1,
P2, P3, C
• If create of C fails, link2 fails, so
construction fails
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-83
Theorem
• The two-parent joint creation operation can
implement an n-parent joint creation
operation with a fixed number of additional
types and rights, and augmentations to the
link predicates and filter functions.
• Proof: by construction, as above
– Difference is that the two systems need not start
at the same initial state
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-84
Theorems
• Monotonic ESPM and the monotonic HRU
model are equivalent.
• Safety question in ESPM also decidable if
acyclic attenuating scheme
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-85
Expressiveness
• Graph-based representation to compare models
• Graph
– Vertex: represents entity, has static type
– Edge: represents right, has static type
• Graph rewriting rules:
– Initial state operations create graph in a particular state
– Node creation operations add nodes, incoming edges
– Edge adding operations add new edges between
existing vertices
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-86
Example: 3-Parent Joint Creation
• Simulate with 2-parent
– Nodes P1, P2, P3 parents
– To create node C with type c with edges of type e
– First add node A1 of type a and edge from P1 to
A1 of type e´
P2
P1
P3
e'
A1
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-87
Next Step
• A1, P2 create A2; A2, P3 create A3
• Type of nodes, edges are a and e´
P2
P1
e'
A1
July 1, 2004
P3
e'
a
A2
Computer Security: Art and Science
©2002-2004 Matt Bishop
e'
a
A3
Slide #3-88
Next Step
• A3 creates S, of type a
• S creates C, of type c
P2
P1
e'
A1
P3
e'
a
A2
C
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
e'
a
A3
S
Slide #3-89
Last Step
• Edge adding operations:
– P1A1A2A3SC: P1 to C edge type e
– P2A2A3SC: P2 to C edge type e
– P3A3SC: P3 to C edge type e
P2
P1
e
A1
A2
e
P3
e
A3
S
C
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-90
Definitions
• Simulation formally requires notion of scheme
and correspondence between schemes
• Scheme: graph representation as above
• Model: set of schemes
• Schemes A, B correspond if graph for both is
identical when all nodes with types not in A
and edges with types not in A are deleted
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-91
Example
• Above 2-parent joint creation simulation in
scheme TWO
• Equivalent to 3-parent joint creation scheme
THREE in which P1, P2, P3, C are of same
type as in TWO, and edges from P1, P2, P3
to C are of type e, and no types a and e´
exist in TWO
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-92
Example
• Remove nodes and edges with types not in
original scheme:
P1
e'
P2
e
A1 a e
e'
A2
P3
e'
a
e
A3
S
C
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-93
Simulation
Scheme A simulates scheme B iff
• every state B can reach has a corresponding state
in A that A can reach; and
• every state that A can reach either corresponds to a
state B can reach, or has a successor state that
corresponds to a state B can reach
– The last means that A can have intermediate states not
corresponding to states in B, like the intermediate ones
in TWO in the simulation of THREE
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-94
Expressive Power
• If  scheme in MA no scheme in MB can
simulate, MB is less expressive than MA
• If every scheme in MA can be simulated by
a scheme in MB, MB as expressive as MA
• If MA is as expressive as MB and vice
versa, MA and MB are equivalent
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-95
Example
• Scheme A in model M
–
–
–
–
–
Nodes X1, X2, X3
2-parent joint create
1 node type, 1 edge type
No edge adding operations
Initial state: X1, X2, X3, no edges
• Scheme B in model N
– All same as A except no 2-parent joint create
– 1-parent create
• Which is more expressive?
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-96
Can A Simulate B?
• Scheme A simulates 1-parent create: have
both parents be same node
– Model M as expressive as model N
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-97
Can B Simulate A?
• Suppose X1, X2 jointly create Y in A
– Edges from X1, X2 to Y, no edge from X3 to Y
• Can B simulate this?
– Without loss of generality, X1 creates Y
– Must have edge adding operation to add edge
from X2 to Y
– One type of node, one type of edge, so
operation can add edge between any 2 nodes
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-98
No
Can B Simulate
A?
• All nodes in A have even number of incoming
edges
– 2-parent create adds 2 incoming edges
• Edge adding operation in B that can add edge from
X2 to C can add one from X3 to C
– A cannot enter this state
– B cannot transition to a state in which Y has even
number of incoming edges
• No remove rule
• So B cannot simulate A; N less expressive than M
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-99
Theorem
• Monotonic single-parent models are less
expressive than monotonic multiparent
models
• ESPM more expressive than SPM
– ESPM multiparent and monotonic
– SPM monotonic but single parent
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-100
Typed Access Matrix Model
• Like ACM, but with set of types T
– All subjects, objects have types
– Set of types for subjects TS
• Protection state is (S, O, , A)
– :OT specifies type of each object
– If X subject, (X) in TS
– If X object, (X) in T – TS
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-101
Create Rules
• Subject creation
– create subject s of type ts
– s must not exist as subject or object when operation
executed
– ts  TS
• Object creation
– create object o of type to
– o must not exist as subject or object when operation
executed
– to  T – TS
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-102
Create Subject
• Precondition: s  S
• Primitive command:
create subject s of type t
• Postconditions:
–
–
–
–
S´ = S { s }, O´ = O { s }
(y  O)[´(y) =  (y)], ´(s) = t
(y  O´)[a´[s, y] = ], (x  S´)[a´[x, s] = ]
(x  S)(y  O)[a´[x, y] = a[x, y]]
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-103
Create Object
• Precondition: o  O
• Primitive command:
create object o of type t
• Postconditions:
–
–
–
–
S´ = S, O´ = O  { o }
(y  O)[´(y) =  (y)], ´(o) = t
(x  S´)[a´[x, o] = ]
(x  S)(y  O)[a´[x, y] = a[x, y]]
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-104
Definitions
• MTAM Model: TAM model without delete,
destroy
– MTAM is Monotonic TAM
• (x1:t1, ..., xn:tn) create command
– ti child type in  if any of create subject xi of
type ti or create object xi of type ti occur in 
– ti parent type otherwise
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-105
Definitions
• Creation Graph of an MTAM scheme
– Digraph G=<V,E> where V corresponds to
types of scheme, and <u,v> in E iff there is a
creation command with u as a parent type and v
as a child type
• Example:
command (x:user, f:file)
create subject f of type file;
enter own into a[x,f];
end
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
user
file
Slide #3-106
Cyclic Creates
command havoc(s1:u, s2:u, o1:v, o2:v, o3:w, o4:w)
create subject s1 of type u;
create object o1 of type v;
create object o3 of type w;
enter r into a[s2, s1];
enter r into a[s2, o2];
enter r into a[s2, o4]
end
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-107
Creation Graph
u
v
July 1, 2004
w
• u, v, w child types
• u, v, w also parent
types
• Graph: lines from
parent types to child
types
• This one has cycles
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-108
Theorems
• Safety decidable for systems with acyclic
MTAM schemes
• Safety for acyclic ternary MTAM decidable
in time polynomial in the size of initial
ACM
– “ternary” means commands have no more than
3 parameters
– Equivalent in expressive power to MTAM
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-109
Key Points
• Safety problem undecidable
• Limiting scope of systems can make
problem decidable
• Types seem critical to safety problem’s
analysis
July 1, 2004
Computer Security: Art and Science
©2002-2004 Matt Bishop
Slide #3-110