Computer Security Handbook, Fifth Edition

CHAPTER 9

MATHEMATICAL MODELS OF COMPUTER SECURITY

Matt Bishop

9.1 WHY MODELS ARE IMPORTANT

9.2 MODELS AND SECURITY

9.2.1 Access-Control Matrix Model

9.2.2 Harrison, Ruzzo, and Ullman and Other Results

9.2.3 Typed Access Control Model

9.3 MODELS AND CONTROLS

9.3.1 Mandatory and Discretionary Access-Control Models

9.3.2 Originator-Controlled Access-Control Model and DRM

9.3.3 Role-Based Access Control Models and Groups

9.3.4 Summary

9.4 CLASSIC MODELS

9.4.1 Bell-LaPadula Model

9.4.2 Biba's Strict Integrity Policy Model

9.4.3 Clark-Wilson Model

9.4.4 Chinese Wall Model

9.4.5 Summary

9.5 OTHER MODELS

9.6 CONCLUSION

9.7 FURTHER READING

9.8 NOTES

9.1 WHY MODELS ARE IMPORTANT.

When you drive a new car, you look for specific items that will help you control the car: the accelerator, the brake, the shift, and the steering wheel. These exist on all cars and perform the function of speeding the car up, slowing it down, and turning it left and right. This forms a model of the car. With these items properly working, you can make a convincing argument that the model correctly describes what a car must have in order to move and be steered properly.

A model in computer security serves the same purpose. It presents a general description of a computer system (or collection of systems). The model provides a definition of “protect” (e.g., “keep confidential” or “prevent unauthorized change to”) and conditions under which the protection is provided. With mathematical models, the conditions can be ...