A lattice model of secure information flow

ABSTRACT

This paper investigates mechanisms that guarantee secure information flow in a computer system. These mechanisms are examined within a mathematical framework suitable for formulating the requirements of secure information flow among security classes. The central component of the model is a lattice structure derived from the security classes and justified by the semantics of information flow. The lattice properties permit concise formulations of the security requirements of different existing systems and facilitate the construction of mechanisms that enforce security. The model provides a unifying view of all systems that restrict information flow, enables a classification of them according to security objectives, and suggests some new approaches. It also leads to the construction of automatic program certification mechanisms for verifying the secure flow of information through a program.

REFERENCES

• 1: Gregory Richard Andrews, Cops--a protection mechanism for computer systems., 1974
• 2: Bell, D.E., and LaPadula, L.J. Secure computer systems: mathematical foundations and model. M74-244, The MITRE Corp., Bedford, Mass., May 1973.
• 3: Birkhoff, G. Lattice Theory. Amer. Math. Soc. Col. Pub., XXV, 3rd. ed., 1967.
• 4: Dorothy Elizabeth Robling Denning, Secure information flow in computer systems., 1975
• 5: Denning, D.E., Denning, P.J., and Graham, G.S. Selectively confined subsystems. Proc. International Workshop on Protection in Operating Systems. IRIA, Aug. 1974, pp. 55-61.
• 6: Fenton, J.S. Information protection systems. Ph.D. Th., U. of Cambridge, 1973.
• 7: Fenton, J.S. Memoryless subsystems. Computer J. 17, 2 (May 1974), 143-147.
• 8: Fenton, J.S. An abstract computer model demonstrating directional information flow. U. of Cambridge, 1974.
• 9: R. Stockton Gaines, An operating system based on the concept of a supervisory computer, Communications of the ACM, v.15 n.3, p.150-156, March 1972 [doi>10.1145/361268.361274]
• 10: Gat, I., and Saal, H.J. Memoryless execution: a programmer's viewpoint. IBM Tech. Rep. 025, IBM Israeli Scientific Center, March 1975.
• 11: Graham, G.S., and Denning, P.J. Protection-principles and practice. AFIPS Conf. Proc., Vol. 40, 1972 SJCC, AFIPS Press, Montvale, N.J., pp. 417-429.
• 12: Michael A. Harrison , Walter L. Ruzzo , Jeffrey D. Ullman, On protection in operating systems, Proceedings of the fifth ACM symposium on Operating systems principles, p.14-24, November 19-21, 1975, Austin, Texas, United States
• 13: Anita Katherine Jones, Protection in programmed systems., 1973
• 14: Anita K. Jones , Richard J. Lipton, The enforcement of security policies for computation, Proceedings of the fifth ACM symposium on Operating systems principles, p.197-206, November 19-21, 1975, Austin, Texas, United States
• 15: Lampson, B.W. Protection. Proc. Fifth Princeton Symposium on Information Sciences and Systems, Princeton U., March 1971, pp. 437-443.
• 16: Butler W. Lampson, A note on the confinement problem, Communications of the ACM, v.16 n.10, p.613-615, Oct. 1973 [doi>10.1145/362375.362389]
• 17: Marvin Lee Minsky, Computation: Finite and Infinite Machines, Prentice-Hall, Inc., Upper Saddle River, NJ, 1967
• 18: Elliott I. Organick, The Multics System: An Examination of Its Structure, The MIT Press, 1972
• 19: Rotenberg, L.J. Making computers keep secrets. Ph.D. Th., MIT, MAC TR-115, Feb. 1974.
• 20: Michael D. Schroeder , Jerome H. Saltzer, A hardware architecture for implementing protection rings, Communications of the ACM, v.15 n.3, p.157-170, March 1972 [doi>10.1145/361268.361275]
• 21: Stone, H.S. Discrete Mathematical Structures and their Applications. SRI, Chicago 1973.
• 22: Walter, K.G., et al. Modeling the security interface. Rep. No. 1158, Jennings Computing Center, Case Western Reserve U., Aug. 1974.
• 23: Weissman, C. Security controls in the ADEPT-50 time-sharing system. AFIPS Conf. Proc., Vol. 35, 1969 FJCC, AFIPS Press, Montvale, N.J., pp. 417-429.
• 24: W. Wulf , E. Cohen , W. Corwin , A. Jones , R. Levin , C. Pierson , F. Pollack, HYDRA: the kernel of a multiprocessor operating system, Communications of the ACM, v.17 n.6, p.337-345, June 1974 [doi>10.1145/355616.364017]

INDEX TERMS

Keywords:
information flow, lattice, program certification, protection, security, security class