1
Principles of Information Security
CS 5323 Lecture 14
Prof. William Winsborough
October 23, 2007
23 October 2007 Winsborough CS 5323 Lecture 14 2
Business
• For Tuesday 10/23, read Gollman Chapter 8
• Tuesday 10/30 and Thursday 11/1 you will have
guest lectures by Prof. Hugh Maynard about
intrusion attacks and their detection
23 October 2007 Winsborough CS 5323 Lecture 14 3
Security Models
• A security model is a formal specification
of a system for expressing and enforcing a
security policy
23 October 2007 Winsborough CS 5323 Lecture 14 4
State Machines
• Transition systems
– A set of states
– A set of inputs Σ
– Optionally, a set of outputs
– A transition function S x Σ→S
23 October 2007 Winsborough CS 5323 Lecture 14 5
State Machines
• Transition systems
– A set of stat es, S
– A set of in puts, Σ
– Optiona lly, a set of outputs, Γ
– A transiti on function δ: S x Σ→S x Γ
• Security properties can be modeled as sets of
states that are deemed secure
• If the transition function can be shown to
preserve the security property, then when the
system is started in a secure state, all reachable
states will also be secure
23 October 2007 Winsborough CS 5323 Lecture 14 6
Bell-LaPadula Model (BLP)
• Enforces the multilevel security (MLS) policy
• State machine model
– Confidentiality
– Uses an access control matrix and security levels
• Components
– S, set of subjects
– O, set of objects
– A = {execute, read, append, write}, access operations
–(L, ≤), security levels
• Access matrix
– B = ℘(S x O x A), set of all access matrix tables
– b ∈ B, an individual access matrix table
