Bài giảng Bảo mật cơ sở dữ liệu: Chương 3 - Trần Thị Kim Chi (tt)

Bảo mật theo cơ chế MAC
Mandatory Access Control Models


Agenda
1.
2.
3.
4.
5.
6.
7.

Define Mandatory Access Control Models
Secrecy-preserving models
Integrity-preserving models
Multi-Level security
Multi-level databases access control models
Multi-level secure DBMS architecture
MAC trong các hệ QTCSDL thông dụng


Define Mandatory Access Control
Mandatory Access Control : A system-wide policy
decrees who is allowed to have access; individual
user cannot alter that access.
Relies on the system to control access.
Examples:
– The law allows a court to access driving records
without the owners’ permission.

Traditional MAC mechanisms have been tightly
coupled to a few security models.
Recently, systems supporting flexible security
models start to appear (e.g., SELinux, Trusted
Solaris, TrustedBSD, etc.)


Mandatory Access Control vs Discretionary
Access Control
MAC is centrally controlled by a security policy
administrator; users do not have the ability to override the
policy and, for example, grant access to files that would
otherwise be restricted.
DAC, which also governs the ability of subjects to access
objects, allows users the ability to make policy decisions
and/or assign security attributes.
MAC-enabled systems allow policy administrators to
implement organization-wide security policies.
With DAC, users cannot override or modify this policy,
either accidentally or intentionally. This allows security
administrators to define a central policy that is guaranteed
(in principle) to be enforced for all users.


Degrees of MAC system strength
In some systems, users have the authority to decide whether
to grant access to any other user. To allow that, all users
have clearances for all data. This is not necessarily true of a
MAC system. If individuals or processes exist that may be
denied access to any of the data in the system environment,

then the system must be trusted to enforce MAC. Since
there can be various levels of data classification and user
clearances, this implies a quantified scale for robustness.
For example, more robustness is indicated for system
environments containing classified Top Secret information
and uncleared users than for one with Secret information
and users cleared to at least Confidential. To promote
consistency and eliminate subjectivity in degrees of
robustness, an extensive scientific analysis and risk
assessment of the topic produced a landmark benchmark


Evaluation of MAC system strength
The Common Criteria[7] is based on this science and it
intended to preserve the Assurance Level as EAL levels and
the functionality specifications as Protection Profiles. Of
these two essential components of objective robustness
benchmarks, only EAL levels were faithfully preserved. In
one case, TCSEC level C2[8] (not a MAC capable category)
was fairly faithfully preserved in the Common Criteria, as
the Controlled Access Protection Profile (CAPP).[9] 
Multilevel security (MLS) Protection Profiles (such as
MLSOSPP similar to B2)[10] is more general than B2. They
are pursuant to MLS, but lack the detailed implementation
requirements of their Orange Book predecessors, focusing
more on objectives. This gives certifiers more subjective
flexibility in deciding whether the evaluated product’s
technical features adequately achieve the objective,

Multilevel Security (MLS)
Definition and need for MLS
– Security Classification
– Secrecy-Based Mandatory Policies: BellLaPadula Model
– Integrity-based Mandatory Policies: The
Biba Model
– Limitation of Mandatory Policies

Hybrid Policies
– The Chinese Wall Policy


Definition and need for MLS
Multilevel security involves a database in which
the data stored has an associated classification
and consequently constraints for their access
MLS allows users with different classification
levels to get different views from the same data
MLS cannot allow downward leaking, meaning
that a user with a lower classification views data
stored with a higher classification


Definition and need for MLS
Usually multilevel systems are with the federal
government
Some private systems also have multilevel security
needs
MLS relation is split into several single-level relations,
A recovery algorithm reconstructs the MLS relation

from the decomposed single-level relations
At times MLS updates cannot be completed because it
would result in leakage or destruction of secret
information


Definition and need for MLS
In relational model, relations are tables
and relations consist of tuples (rows) and
attributes (columns)
Example:
Consider the relation
SOD(Starship, Objective, Destination)
Starship
Enterprise
Voyager

Objective
Exploration
Spying

Destination
Talos
Mars


Definition and need for MLS
The relation in the example has no
classification associated with it in a
relational model

The same example in MLS with
classification will be as follows:
Starship
Enterprise
Voyager

U
U

Objective
Exploration
Spying

U
S

Destination
Talos
Mars

U
S


Definition and need for MLS
In MLS, access classes can be assigned to:
– Individual tuple in a relation
– Individual attribute of a relation
– Individual data element of tuples in a relation

Bell – LaPadula Model
Biba Model


Bell – LaPadula Model
Proposed by David Bell and Len Lapadula in
1973, in response to U.S. Air Force concerns over
the security of time-sharing mainframe systems.
This model is the most widely recognized Access
Matrix model with classified data
The model deal with confidentiality only.
This model has two components:
– Classification
– Set of categories

Bell-LaPadula model shows how to use
Mandatory Access Control to prevent the Trojan
Horse


Bell – LaPadula Model
Two properties: No read up and No write down.
Simple security property: Subject A is allowed to
read object O only if class(O) class(A).
*-property: Subject A is allowed to write object
O only if class(A) class(O).
The *-property was Bell and LaPadula’s critical
innovation. It was driven by the fear that a user
with “Secret” clearance might be “tricked” by
attackers (e.g., through Trojan horse programs or

software vulnerabilities) to copy down the
information to a ”Unclassified” area where the
attackers can read.


Bell – LaPadula Model
Classification has four values {U, C, S, TS}
 U = unclassified
 C = confidential
 S = secret
 TS = top secret
 Classifications are ordered: TS > S > C > U
 Set of categories consists of the data environment and
the application area, i.e., Nuclear, Army, Financial,
Research
Example: In USA, a “SECRET” clearance
involves
checking FBI fingerprint files.



Bell – LaPadula Model
An access class c1 dominates ≥ an access class
c2 iff
– Security level of c1 is greater than or equal to that of c2
– The categories of c1 include those of c2


Bell – LaPadula Model
Bell-LaPadula model is based on a subjectobject paradigm

Subjects are active elements of the system
that execute actions
Objects are passive elements of the system
that contain information
Subjects act on behalf of users who have a
security level associated with them
(indicating the level of system trust)


Bell – LaPadula Model
Subjects execute access modes on objects
Access modes are:
– Read-only
– Append (writing without reading)
– Execute
– Read-write (writing known data)

Decentralized administration of privileges
on objects


Bell – LaPadula Model
Control direct and indirect flows of information
Prevent leakage to unauthorized subjects
User can connect to the system with any access class
dominated by their clearance


Two Principles
To protect information confidentiality

– No-read-up, a subject is allowed a read access
to an object only if the access class of the
subject dominate the access class of the object
– No-write-down, a subject is allowed a write
access to an object only if the access class of
the subject is dominated by the access class of
the object


No-read-up & No-write-down





Can TS subject write to S object?
Can S subject write to U object?
How to apply to the Trojan Horse case?


Solution to Trojan Horse
Possible classification reflecting the access
restrictions:
– Secret for Vicky and “Market”
– Unclassified to John and “Stolen”

If Vicky connect to system as secret, write is
blocked
If Vicky connects to system as unclassified, read is
blocked

Is Vicky allowed to write to the unclassified object?
How?


Applying BLP: An Example
Alice has (Secret, {NUC, EUR}) clearance
David has (Secret, {EUR}) clearance
– David can talk to Alice (“write up” or “read down”)
– Alice cannot talk to David (“read up” or “write down”)

Alice is a user, and she can login with a different
ID (as a different principle) with reduced
clearance
– Alias1 (Secret, {NUC, EUR})
– Alias2 (Secret, {EUR})


BLP: Problem
If I can write up, then how about writing
files with blanks?
– Blind writing up may cause integrity
problems, but not a confidentiality breach


Bell – LaPadula Model
Two main properties of this model for a
secure system are:
– Simple security property
– Star property

Simple security means: A subject may have
read or write access to an object only if the
clearance of the subject dominates the
security level of the object