Year: 1989
Type: dissertation
Abstract: The state of a protection system contains a collection of access privileges, and the system is secure only if the state satisfies the system security policy. In a distributed system, the state is decentralized and may be concurrently updated by processes that reside on multiple, distinct machines. As a result, a distributed system utilizes decentralized, yet synchronized control to assure that every state reachable from a secure initial state is secure. A security model serves as both a formalization of a security policy and a formal correctness criterion for a specification. A system is provably secure if its implementation enforces its specification, its specification satisfies its security model, and its security model correctly formalizes its security policy.
This thesis formally presents the Distributed Model (D-Model)--a security model of non-disclosure and integrity in distributed, and centralized systems. The D-Model is defined in terms of three components: a security predicate, a model of computation, and an interpretation, which define the set of secure states, the set of state transitions, and the set of information-flow paths, respectively. The distinguishing features of the D-Model are that it provides concurrency and synchronization. Other security models do not provide these features because of the difficulty in validating security for each concurrent execution history. However, the D-Model proves a concurrency theorem that poses assumptions and conditions which, if satisfied, establish a tractable (linear) validation requirement.
Three detailed example applications of the D-Model that satisfy the concurrency theorem's assumptions and conditions are presented. The first example is a distributed version of the Bell-La Padula model--the most widely accepted security model of centralized systems. The second example is a model of a secure file server. The file server distributes information to multiple network modes, yet assures that information is not disclosed to unauthorized parties. The third example is a downgrade model. The down-grade model permits authorized users to selectively lower the classification of sensitive information.
The three detailed examples demonstrate that the D-Model is a general purpose security model. Furthermore, the examples illustrate that the assumptions and conditions used by the D-Model concurrency theorem are not overly restrictive, and the D-Model is a practical model of distributed systems.
Author: Glenn S. Benson
Language: English
Topic: Access Control and Trust
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W72977389