Understanding Multilevel Security (MLS)

1. Multilevel Security (MLS) Database Security and Auditing

2. Multilevel Security (MLS) Definition and need for MLS Security Classification Secrecy-Based Mandatory Policies: Bell- LaPadula Model Integrity-based Mandatory Policies: The Biba Model Limitation of Mandatory Policies Hybrid Policies The Chinese Wall Policy

3. Definition and need for MLS Multilevel security involves a database in which the data stored has an associated classification and consequently constraints for their access MLS allows users with different classification levels to get different views from the same data MLS cannot allow downward leaking , meaning that a user with a lower classification views data stored with a higher classification

4. Definition and need for MLS Usually multilevel systems are with the federal government Some private systems also have multilevel security needs MLS relation is split into several single-level relations, A recovery algorithm reconstructs the MLS relation from the decomposed single-level relations At times MLS updates cannot be completed because it would result in leakage or destruction of secret information

5. Definition and need for MLS In relational model, relations are tables and relations consist of tuples (rows) and attributes (columns) Example : Consider the relation SOD(Starship, Objective, Destination) Starship Objective Destination Enterprise Voyager Exploration Spying Talos Mars

6. Definition and need for MLS The relation in the example has no classification associated with it in a relational model The same example in MLS with classification will be as follows: Starship Objective Destination Enterprise U Voyager U Exploration U Spying S Talos U Mars S

7. Definition and need for MLS In MLS, access classes can be assigned to: Individual tuple in a relation Individual attribute of a relation Individual data element of tuples in a relation Bell LaPadula Model Biba Model

8. Bell LaPadula Model Bell-LaPadula model was developed in 1973 This is an extension of the Access Matrix model with classified data This model has two components: Classification Set of categories Bell-LaPadula model shows how to use Mandatory Access Control to prevent the Trojan Horse

9. Bell LaPadula Model Example : In USA, a SECRET clearance involves checking FBI fingerprint files. Classification has four values {U, C, S, TS} Classification has four values {U, C, S, TS} U = unclassified U = unclassified C = confidential C = confidential S = secret S = secret TS = top secret TS = top secret Classifications are ordered: TS > S > C > U Classifications are ordered: TS > S > C > U Set of categories consists of the data environment and the application area, i.e., Nuclear, Army, Financial, Research Set of categories consists of the data environment and the application area, i.e., Nuclear, Army, Financial, Research

10. Bell LaPadula Model An access class c1 dominates an access class c2 iff Security level of c1 is greater than or equal to that of c2 The categories of c1 include those of c2

11. Bell LaPadula Model Bell-LaPadula model is based on a subject- object paradigm Subjects are active elements of the system that execute actions Objects are passive elements of the system that contain information Subjects act on behalf of users who have a security level associated with them (indicating the level of system trust)

12. Bell LaPadula Model Subjects execute access modes on objects Access modes are: Read-only Append (writing without reading) Execute Read-write (writing known data) Decentralized administration of privileges on objects

13. Bell LaPadula Model Control direct and indirect flows of information Prevent leakage to unauthorized subjects User can connect to the system with any access class dominated by their clearance

14. Two Principles To protect information confidentiality No-read-up , a subject is allowed a read access to an object only if the access class of the subject dominate the access class of the object No-write-down , a subject is allowed a write access to an object only if the access class of the subject is dominated by the access class of the object

15. No-read-up & No-write-down Can TS subject write to S object? Can TS subject write to S object? Can S subject write to U object? Can S subject write to U object? How to apply to the Trojan Horse case? How to apply to the Trojan Horse case?

16. Solution to Trojan Horse Possible classification reflecting the access restrictions: Secret for Vicky and Market Unclassified to John and Stolen If Vicky connect to system as secret , write is blocked If Vicky connects to system as unclassified , read is blocked Is Vicky allowed to write to the unclassified object? How?

17. Applying BLP: An Example Alice has (Secret, {NUC, EUR}) clearance David has (Secret, {EUR}) clearance David can talk to Alice ( write up or read down ) Alice cannot talk to David ( read up or write down ) Alice is a user, and she can login with a different ID (as a different principle) with reduced clearance Alias1 (Secret, {NUC, EUR}) Alias2 (Secret, {EUR})

18. BLP: Problem If I can write up, then how about writing files with blanks? Blind writing up may cause integrity problems, but not a confidentiality breach

19. Bell LaPadula Model Two main properties of this model for a secure system are: Simple security property Star property Simple security means: A subject may have read or write access to an object only if the clearance of the subject dominates the security level of the object

20. Bell LaPadula Model Star property means: An untrusted subject may: append if object security dominates subject security write if object security equals subject security read if object security is less than subject security This model guarantees secrecy by preventing unauthorized release of information This model does not protect from unauthorized modification of information

21. Key Points Confidentiality models restrict flow of information Bell-LaPadula (BLP) models multilevel security Cornerstone of much work in computer security Simple security property says no read up and Star property says no write down Both ensure information can only flow up

22. The Biba Model A model due to Ken Biba which is often referred to as Bell-LaPadula upside down. It deals with integrity alone and ignores confidentiality entirely. Each subject and object in the system is assigned an integrity classification Crucial Important Unknown

23. Integrity Level Integrity level of a user reflects users trustworthiness for inserting, modifying, or deleting information Integrity level of an object reflects both the degree of trust that can be placed on the info stored in the object, and the potential damage could result from unauthorized modification of info

24. Two principles No-read-down: A subject is allowed a read access to an object only if the access class of the object dominates the access class of the subject No-write-up: A subject is allowed a write access to an object only if the access class of the subject is dominated by the access class of the object

25. Q: How to control both the secrecy and integrity?

26. Applying Mandatory Policies to Databases Commercial DBMSs Oracle, Sybase, and TruData have MLS versions of their DBMS Because of Bell-LaPadula restrictions, subjects having different clearances see different versions of a multilevel relation Visible to a user with unclassified level. Visible to a user with secret level.

27. Polyinstantiation Request by low level subject An u nclassified subject request insert of If this update is rejected, then the user would be able to infer something about Ann MLS would allow the secret channel to permit data update and protect data integrity Visible to a user with secret level. Visible to a user with unclassified level.

28. Polyinstantiation Request by high level subjects A secret subject request to insert Inform the subject of the conflict and refuse the insertion (no) Overwrite the existing tuple (no)

29. Challenges Cover Stories Non-true data to hide the existence of the actual value Not released is a cause of information leakage Fine-grained is not easy Aggregation, association Block inference channels

30. Covert Channels A covert channel is an information flow that is not controlled by a security mechanism. In BLP, you could use the access control mechanism itself to construct a covert channel. A low level subject makes an object dummy.obj at its own level. Its high level accomplice either upgrades the security level of dummy.obj to high or leaves it unchanged . Later, the low level subject tries to read dummy.obj . Success or failure of this request disclose the action of the high-level subject. One bit of information has flown from high to low. Failure means dummy.obj has be upgraded; success means dummy.obj has not been changed

31. Covert Channels (contd) Other Examples for Covert Channels: Timing Channels Resource State Hidden Information in downgraded documents Commonly used techniques for reducing covert channels: Reduce abusable functionality High level processes get lowest resource allocation priority and can be preempted by low level processes. Random delays, clock noise, randomized resource availability. Auditing the use of known channels Polyinstantiation

32. Multilevel DBMSs Architecture Trusted subject. The DBMS itself must be trusted to ensure mandatory policy Trusted Computing Base: Data are partitioned in different databases, one for each level

33. Reference Sushil Jajodia and Ravi S. Sandhu, Toward a Multilevel Secure Relational Model, essay 20

34. Discussion (15 min) Customer order scenario from page 161 in the textbook Identify the subject, actions, objects Design the MAC

35. Access Control Mandatory Access Control Security Classification Secrecy-Based Mandatory Policies: Bell- LaPadula Model Integrity-based Mandatory Policies: The Biba Model Limitation of Mandatory Policies Hybrid Policies The Chinese Wall Policy

36. Chinese Wall Model Problem: Tony advises American Bank about investments He is asked to advise Toyland Bank about investments Conflict of interest to accept, because his advice for either bank would affect his advice to the other bank

37. Organization Organize entities into conflict of interest classes Control subject accesses to each class Control writing to all classes to ensure information is not passed along in violation of rules Allow sanitized data to be viewed by everyone

38. Definitions Objects : items of information related to a company Company dataset (CD): contains objects related to a single company Written CD ( O ) Conflict of interest class (COI): contains datasets of companies in competition Written COI ( O ) Assume: each object belongs to exactly one COI class

39. Example Bank of America Citibank Bank of the W est Bank COI Class Shell Oil Union 76 Standard Oil ARCO Gasoline Company COI Class

40. Temporal Element If Anthony reads any CD in a COI, he can never read another CD in that COI Possible that information learned earlier may allow him to make decisions later Let PR ( S ) be set of objects that S has already read Bank of America Citibank Bank of the West Bank COI Class

41. CW-Simple Security Condition s can read o iff : 1. s has read something in os dataset, and object o is in the same company datasets as the objects already access by s, that is within the Wall , or 2. s has not read any objects in os conflict of interest class, what s has read belongs to an entirely different conflict of interest class Ignores sanitized data (see below)

42. Sanitization Public information may belong to a CD As is publicly available, no conflicts of interest arise So, should not affect ability of analysts to read Typically, all sensitive data removed from such information before it is released publicly (called sanitization ) Add third condition to CW-Simple Security Condition: 3. o is a sanitized object

43. Writing Anthony, Susan work in same trading house Anthony can read Bank 1s CD, Gas CD Susan can read Bank 2s CD, Gas CD If Anthony could write to Gas CD, Susan can read it Hence, indirectly, she can read information from Bank 1s CD, a clear conflict of interest

44. CW-*-Property Write access is only permitted if Access is permitted by the CW-simple security rule, and For all unsanitized objects o, if s can read o, then CD(o) = CD(o) Says that s can write to an object if all the (unsanitized) objects he/she can read are in the same dataset

45. Lab 3 (Feb. 21) Install Oracle Label Security & Using Oracle Label Security http://apex.oracle.com/pls/apex/f?p=44785:24: 3634991866798098::NO:24:P24_CONTENT_I D,P24_PREV_PAGE:4509,2 http://apex.oracle.com/pls/apex/f?p=44785:24: 3634991866798098::NO:24:P24_CONTENT_I D,P24_PREV_PAGE:4548,2