Download Presentation
## Information Flow

- - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - -

**Information Flow**CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute April 22, 2004**Overview**• Information Flow Models • Confinement Flow Model • Compiler-Based Mechanisms**Bell-LaPadula Model**• Information flows from A to B iff B dom A TS{R,P} TS{P} TS{R} S{R} S{P} S{}**Entropy-Based Analysis**• Command sequence takes a system from state s to state t • xs is the value of x at state s • H(a | b) is the uncertainty of a given b • Def: A command sequence causes a flow of information from x to y if H(xs | yt) < H(xs | ys). If y does not exist in s, then H(xs | ys) = H(xs)**Example Flows**y := x H(xs | yt) = 0 tmp := x; y := tmp; H(xs | yt) = 0**Another Example**if (x==1) then y:= 0 else y := 1 Suppose x is equally likely to be 0 or 1, soH(xs) = 1 But, H(xs | yt) = 0 So, H(xs | yt) < H(xs | ys) = H(xs) Thus, information flows from x to y. Def. An implicit flow of information occurs when information flows from x to y without an explicit assignment of the form y := f(x)**Requirements for Information Flow Models**• Reflexivity: information should flow freely among members of a class • Transitivity: If b reads something from c and saves it, and if a reads from b, then a can read from c A lattice has a relation R that is reflexive and transitive (and antisymmetric)**Information Flow Models**• An Information flow policy I is a triple I = (SCI, I, joinI), where SCI is a set of security classes, I is an ordering relation on the elements of SCI, and joinI combines two elements of SCI • Example: Bell-LaPadula has security compartments for SCI, dom for I and lub as joinI**Confinement Flow Model**• Associate with each object x a security class x • Def: The confinement flow model is a 4-tuple (I, O, confine, ) in which • I = (SCI, I, join I) is a lattice-based info. flow policy • O is a set of entities • : O O is a relation with (a, b) iff information can flow from a to b • for each a O, confine(a) is a pair (aL, aU) SCI SCI, with aLIaU • if x aU then information can flow from x to a • if aL x the information can flow from a to x**Example Confinement Model**Let a, b, and c O confine(a) = [ CONFIDENTIAL, CONFIDENTIAL] confine(b) = [SECRET, SECRET] confine(c) = [TOPSECRET, TOPSECRET] Then a b, a c, and b c are the legal flows**Another Example**Let a, b, and c O confine(a) = [ CONFIDENTIAL, CONFIDENTIAL] confine(b) = [SECRET, SECRET] confine(c) = [CONFIDENTIAL, TOPSECRET] Then a b, a c, b c, and c a are the legal flows Note that b c and c a, but information cannot flow from b to a because bLIaU is false So, transitivity fails to hold**Non-LatticeInformation Flow Policies**Government agency has public relation officers (PRO), analysts (A), and spymasters (S) 4 classifications of data: public analysis, public covert analysis top-level, covert top-level confine(PRO) = [public, analysis] confine(A) = [analysis, top-level] confine(S) = [covert, top-level] PRO A, A PRO, PRO S, A S, and S A**Complier-Based Mechanisms**• Assignment statements • Compound statements • Conditional statements • Iterative statements**Assignment Statements**y := f(x1, ..., xn) Requirement for information flow to be secure is: lub {x1, ..., xn} y Example: x := y + z; lub{y, z} x**Compound Statements**begin S1; ... Sn; end; Requirement for information flow to be secure: S1 secure AND ... AND Sn secure**Conditional Statements**if f(x1, ..., xn) then S1; else S2; end; Requirement for information flow to be secure: S1 secure AND S2 secure AND lub{x1, ..., xn} glb{y | y is the target of an assignment in S1 or S2}**Example Conditional Statement**if x + y < z then a := b; else d := b * c - x; end; ba for S1 lub{b, c, x} d for S2 lub{x, y, z} glb{a, d} for condition**Iterative Statements**while f(x1, ..., xn) do S; Requirement for information flow to be secure: Iteration terminates S secure lub{x1, ..., xn} glb{y | y is the target of an assignment in S}**Example Iteration Statement**while i < n do begin a[i] := b[i]; i := i + 1; end; Loop terminates i a[i] AND b[i]a[i] for S1 lub{i, b[i]} a[i] for compound statement lub{b[i], i, n} glb{a[i], i} for while condition