September 16, 2004.ppt

September 16, 2004 Introduction to Computer Security Lecture 3 Take Grant Model (Cont) HRU Schematic Protection Model Theorem: Can_share(α,x,y,G0)(for subjects) Subject_can_share(α, x, y,G0) is true iff x and y are subjects and there is an α edge from x to y in G0 OR if: ? a subject s ? G0 with an s-to-y α edge, and ? islands I1, …, In such that x ? I1, s ? In, and there is a bridge from Ij to Ij+1 What about objects?Initial, terminal spans x initially spans to y if x is a subject and there is a tg-path associated with word {t→*g→} between them x can grant a right to y x terminally spans to y if x is a subject and there is a tg-path associated with word {t→*} between them x can take a right from y Theorem: Can_share(α,x,y,G0) Can_share(α,x, y,G0) iff there is an α edge from x to y in G0 or if: ? a vertex s ? G0 with an s to y α edge, ? a subject x’ such that x’=x or x’ initially spans to x, ? a subject s’ such that s’=s or s’ terminally spans to s, and ? islands I1, …, In such that x’ ? I1, s’ ? In, and there is a bridge from Ij to Ij+1 Theorem: Can_share(α,x,y,G0) Corollary: There is an O(|V|+|E|) algorithm to test can_share: Decidable in linear time!! Theorem: Let G0 contain exactly one vertex and no edges, R a set of rights. G0 ├* G iff G is a finite directed acyclic graph, with edges labeled from R, and at least one subject with no incoming edge. Only if part: v is initial subject and G0 ├* G; No rule allows the deletion of a vertex No rule allows an incoming edge to be added to a vertex without any incoming edges. Hence, as v has no incoming edges, it cannot be assigned any Theorem: Can_share(α,x,y,G0) If part : G meets the requirement Assume v is the vertex with no incoming edge and apply rules Perform “v creates (α ? {g} to) new xi” for all 2=i = n, and α is union of all labels on the incoming edges going into xi in G For all pairs x, y with x α over y in G, perform “v grants (α to y) to x” If β is the set of rights x has over y in G, perform “v r