Theft of information in the take-grant protection model.pdfVIP

THEFr OF INFORMATION INTHE TAKE-GRANT PROTECTION MODEL 22 4 7-J7 m 7 Matt Bishop Technical Report PCS-TR88-137 Theft of Information in the Take-Grant Protection Model Matt Bishop Department of Mathematics and Computer Science Dartmouth College Hanover, NH 03755 ABSTRACT Using the information transfer extensions to the Take-Grant Protection Model, the concept of “theft of information” is defined and necessary and sufficient conditions for such theft to occur are presented, as well as bounds on the number of actors involved in such theft. Finally, the application of these results to reference monitors are explored. 1. Introduction The terms security and safety are often used interchangeably; in fact, they are not synonyms. The term “safe” applies to an abstract model; its initial state is called “safe” if it is not possible to reach a new state in which a right can be transferred. The term “secure” applies to a nonabstract system; it requires not only that the abstract model of the system be safe, but also that the nonabstract system correctly implement the abstract model. Harrison, Ruzzo, and Ullman showed that in general, it cannot be determined whether or not a system is safe [4].. The Take-Grant model, developed as a theoretical model to test the limits of this result [5], describes a simpler type of system, called a mrw-operational system (because each command pe