- Copyright
- Preface
- 1. Introduction
- 2. Foundations
- 2. Access Control Matrix
- 3. Foundational Results
- 3. Policy
- 4. Security Policies
- 5. Confidentiality Policies
- 5.1. Goals of Confidentiality Policies
- 5.2. The Bell-LaPadula Model
- 5.3. Tranquility
- 5.4. The Controversy over the Bell-LaPadula Model
- 5.5. Summary
- 5.6. Research Issues
- 5.7. Further Reading
- 5.8. Exercises
- 6. Integrity Policies
- 7. Hybrid Policies
- 8. Noninterference and Policy Composition
- 4. Implementation I: Cryptography
- 9. Basic Cryptography
- 10. Key Management
- 11. Cipher Techniques
- 11.1. Problems
- 11.2. Stream and Block Ciphers
- 11.3. Networks and Cryptography
- 11.4. Example Protocols
- 11.5. Summary
- 11.6. Research Issues
- 11.7. Further Reading
- 11.8. Exercises
- 12. Authentication
- 5. Implementation II: Systems
- 13. Design Principles
- 13.1. Overview
- 13.2. Design Principles
- 13.2.1. Principle of Least Privilege
- 13.2.2. Principle of Fail-Safe Defaults
- 13.2.3. Principle of Economy of Mechanism
- 13.2.4. Principle of Complete Mediation
- 13.2.5. Principle of Open Design
- 13.2.6. Principle of Separation of Privilege
- 13.2.7. Principle of Least Common Mechanism
- 13.2.8. Principle of Psychological Acceptability
- 13.3. Summary
- 13.4. Research Issues
- 13.5. Further Reading
- 13.6. Exercises
- 14. Representing Identity
- 15. Access Control Mechanisms
- 15.1. Access Control Lists
- 15.2. Capabilities
- 15.3. Locks and Keys
- 15.4. Ring-Based Access Control
- 15.5. Propagated Access Control Lists
- 15.6. Summary
- 15.7. Research Issues
- 15.8. Further Reading
- 15.9. Exercises
- 16. Information Flow
- 16.1. Basics and Background
- 16.2. Nonlattice Information Flow Policies
- 16.3. Compiler-Based Mechanisms
- 16.4. Execution-Based Mechanisms
- 16.5. Example Information Flow Controls
- 16.6. Summary
- 16.7. Research Issues
- 16.8. Further Reading
- 16.9. Exercises
- 17. Confinement Problem
- 13. Design Principles
- 6. Assurance
- 18. Introduction to Assurance
- 19. Building Systems with Assurance
- 19.1. Assurance in Requirements Definition and Analysis
- 19.2. Assurance During System and Software Design
- 19.3. Assurance in Implementation and Integration
- 19.4. Assurance During Operation and Maintenance
- 19.5. Summary
- 19.6. Research Issues
- 19.7. Further Reading
- 19.8. Exercises
- 20. Formal Methods
- 20.1. Formal Verification Techniques
- 20.2. Formal Specification
- 20.3. Early Formal Verification Techniques
- 20.4. Current Verification Systems
- 20.5. Summary
- 20.6. Research Issues
- 20.7. Further Reading
- 20.8. Exercises
- 21. Evaluating Systems
- 21.1. Goals of Formal Evaluation
- 21.2. TCSEC: 1983–1999
- 21.3. International Efforts and the ITSEC: 1991–2001
- 21.4. Commercial International Security Requirements: 1991
- 21.5. Other Commercial Efforts: Early 1990s
- 21.6. The Federal Criteria: 1992
- 21.7. FIPS 140: 1994–Present
- 21.8. The Common Criteria: 1998–Present
- 21.9. SSE-CMM: 1997–Present
- 21.10. Summary
- 21.11. Research Issues
- 21.12. Further Reading
- 21.13. Exercises
- 7. Special Topics
- 22. Malicious Logic
- 22.1. Introduction
- 22.2. Trojan Horses
- 22.3. Computer Viruses
- 22.4. Computer Worms
- 22.5. Other Forms of Malicious Logic
- 22.6. Theory of Malicious Logic
- 22.7. Defenses
- 22.7.1. Malicious Logic Acting as Both Data and Instructions
- 22.7.2. Malicious Logic Assuming the Identity of a User
- 22.7.3. Malicious Logic Crossing Protection Domain Boundaries by Sharing
- 22.7.4. Malicious Logic Altering Files
- 22.7.5. Malicious Logic Performing Actions Beyond Specification
- 22.7.6. Malicious Logic Altering Statistical Characteristics
- 22.7.7. The Notion of Trust
- 22.8. Summary
- 22.9. Research Issues
- 22.10. Further Reading
- 22.11. Exercises
- 23. Vulnerability Analysis
- 23.1. Introduction
- 23.2. Penetration Studies
- 23.2.1. Goals
- 23.2.2. Layering of Tests
- 23.2.3. Methodology at Each Layer
- 23.2.4. Flaw Hypothesis Methodology
- 23.2.5. Example: Penetration of the Michigan Terminal System
- 23.2.6. Example: Compromise of a Burroughs System
- 23.2.7. Example: Penetration of a Corporate Computer System
- 23.2.8. Example: Penetrating a UNIX System
- 23.2.9. Example: Penetrating a Windows NT System
- 23.2.10. Debate
- 23.2.11. Conclusion
- 23.3. Vulnerability Classification
- 23.4. Frameworks
- 23.5. Gupta and Gligor's Theory of Penetration Analysis
- 23.6. Summary
- 23.7. Research Issues
- 23.8. Further Reading
- 23.9. Exercises
- 24. Auditing
- 25. Intrusion Detection
- 22. Malicious Logic
- 8. Practicum
- 26. Network Security
- 26.1. Introduction
- 26.2. Policy Development
- 26.3. Network Organization
- 26.4. Availability and Network Flooding
- 26.5. Anticipating Attacks
- 26.6. Summary
- 26.7. Research Issues
- 26.8. Further Reading
- 26.9. Exercises
- 27. System Security
- 28. User Security
- 29. Program Security
- 29.1. Introduction
- 29.2. Requirements and Policy
- 29.3. Design
- 29.4. Refinement and Implementation
- 29.5. Common Security-Related Programming Problems
- 29.5.1. Improper Choice of Initial Protection Domain
- 29.5.2. Improper Isolation of Implementation Detail
- 29.5.3. Improper Change
- 29.5.4. Improper Naming
- 29.5.5. Improper Deallocation or Deletion
- 29.5.6. Improper Validation
- 29.5.7. Improper Indivisibility
- 29.5.8. Improper Sequencing
- 29.5.9. Improper Choice of Operand or Operation
- 29.5.10. Summary
- 29.6. Testing, Maintenance, and Operation
- 29.7. Distribution
- 29.8. Conclusion
- 29.9. Summary
- 29.10. Research Issues
- 29.11. Further Reading
- 29.12. Exercises
- 26. Network Security
- 9. End Matter
- 30. Lattices
- 31. The Extended Euclidean Algorithm
- 32. Entropy and Uncertainty
- 33. Virtual Machines
- 34. Symbolic Logic
- 35. Example Academic Security Policy
- 35.1. University of California E-mail Policy
- 35.1.1. Summary: E-mail Policy Highlights
- 35.1.2. University of California Electronic Mail Policy
- 35.1.2.1. Introduction
- 35.1.2.2. Purpose
- 35.1.2.3. Definitions
- 35.1.2.4. Scope
- 35.1.2.5. General Provisions
- 35.1.2.6. Specific Provisions
- 35.1.2.7. Policy Violations
- 35.1.2.8. Responsibility for Policy
- 35.1.2.9. Campus Responsibilities and Discretion
- 35.1.2.10. Appendix A—Definitions
- 35.1.2.11. Appendix B—References
- 35.1.2.12. Appendix C—Policies Relating to Nonconsensual Access
- 35.1.3. UC Davis Implementation of the Electronic Mail Policy
- 35.1.4. References and Related Policy
- 35.2. The Acceptable Use Policy for the University of California, Davis
- 35.1. University of California E-mail Policy
- Bibliography
A lattice is a mathematical construction built on the notion of a group. First, we review some basic terms. Then we discuss lattices.
For a set S, a relation R is any subset of S × S. For convenience, if (a, b) ∊ R, we write aRb.
EXAMPLE: Let S = { 1, 2, 3 }. Then the relation less than or equal to (written ≤) is defined by the set R = { (1, 1), (1, 2), (1, 3), (2, 2), (2, 3), (3, 3) }. We write 1 ≤ 1 and 2 ≤ 3 for convenience, because (1, 2) ∊ R and (2, 3) ∊ R, but not 3 ≤ 2, because (3, 2) ∉ R.
The following definitions describe properties of relations.
Definition 30–1. A relation R defined over a set S is reflexive if aRa for all a ∊ S.
Definition 30–2. A relation R defined over a set S is antisymmetric if aRb and bRa imply a = b for all a, b ∊ S.
Definition 30–3. A relation R defined over a set S is transitive if aRb and bRc imply aRc for all a, b, c ∊ S.
EXAMPLE: Consider the set of complex numbers C. For any a ∊ C, define aR as the real component and aI as the imaginary component (that is, a = aR + aIi). Let a ≤ b if and only if aR ≤ bR and aI ≤ bI. This relation is reflexive, antisymmetric, and transitive.
A partial ordering occurs when a relation orders some, but not all, elements of a set. Such a set and relation are often called a poset. If the relation imposes an ordering among all elements, it is a total ordering.
EXAMPLE: The relation less than or equal to, as defined in the usual sense, imposes a total ordering on the set of integers, because, given any two integers, one will be less than or equal to the other. However, the relation in the preceding example imposes a partial ordering on the set C. Specifically, the numbers 1 + 4i and 2 + 3i are not related under that relation (because 1 ≤ 2 but 4 ≤ 3).
Under a partial ordering (and a total ordering), we define the “upper bound” of two elements to be any element that follows both in the relation.
Definition 30–4. For two elements a, b ∊ S, if there exists a u ∊ S such that aRu and bRu, then u is an upper bound of a and b.
A pair of elements may have many upper bounds. The one “closest” to the two elements is the least upper bound.
Definition 30–5. Let U be the set of upper bounds of a and b. Let u ∊ U be an element such that there is no t ∊ U for which tRu. Then u is the least upper bound of a and b (written lub(a, b) or a ⊗ b).
Lower bounds, and greatest lower bounds, are defined similarly.
Definition 30–6. For two elements a, b ∊ S, if there exists an l ∊ S such that lRa and lRb, then l is a lower bound of a and b.
Definition 30–7. Let L be the set of lower bounds of a and b. Let l ∊ L be an element such that there is no m ∊ L for which lRm. Then l is the greatest lower bound of a and b (written glb(a, b) or a ⊕ b).
EXAMPLE: Consider the subset of the set of complex numbers for which the real and imaginary parts are integers from 0 to 10, inclusive, and the relation defined in the second example in this chapter. The set of upper bounds for 1 + 9i and 9 + 3i is { 9 + 9i, 9 + 10i, 10 + 9i, 10 + 10i }. The least upper bound of 1 + 9i and 9 + 3i is 9 + 9i. The set of lower bounds is { 1 + 1i, 1 + 0i, 0 + 0i }. The greatest lower bound is 1 + 1i.
A lattice is the combination of a set of elements S and a relation R meeting the following criteria.
R is reflexive, antisymmetric, and transitive on the elements of S.
For every s, t ∊ S, there exists a greatest lower bound.
For every s, t ∊ S, there exists a least upper bound.
EXAMPLE: The set {0, 1, 2} forms a lattice under the relation “less than or equal to” (≤). By the laws of arithmetic, the relation is reflexive, antisymmetric, and transitive. The greatest lower bound of any two integers is the smaller, and the least upper bound is the larger.
EXAMPLE: Consider the subset C´ of the set of complex numbers for which the real and imaginary parts are integers from 0 to 10, inclusive. For any a ∊ C´, define aR as the real component and aI as the imaginary component (that is, a = aR + aIi). Let a ≤ b if and only if aR ≤ bR and aI ≤ bI. This set and relation define a lattice, because the relation is reflexive, antisymmetric, and transitive (see the second example of this chapter) and any pair of elements a, b have a least upper bound and a greatest lower bound.
-
No Comment