Multilevel thematic-hierarchical access control (MLTHS-system)

N. A. Gaydamakin

Prikladnaâ diskretnaâ matematika, no. 1 (2018), pp. 42-57.

Résumé

Access control in computer systems is based on the combination of confidence-mandatory and thematic principles. Composite security labels (tags) containing a security level (classification grade for objects and access level for subjects) and a thematic index (object themes and thematic permissions for subjects) are assigned to the access objects and subjects. In contrast to the known MLS-model that uses so called non-hierarchical (i.e. unordered) thematic categories in the form of thematic rubrics, our model (MLTS-system) uses thematic object indexes and thematic subject permissions which appear as hierarchical thematic classifier elements widely used in document storage technologies. Mathematically, the security labels are elements of the product of the security level algebraic lattice used in Bell–LaPadula model and of a special multirubric lattice based on hierarchical classifiers. Special dominance relations (wider–narrower) and binary operations (greatest lower and least upper multirubric bounds) that cannot be expressed by using ordinary set-theoretic inclusion relation and union and intersection operations are introduced. In MLTHS-system, for assigning security tags to users and to user-initiated subjects, some specific procedures are defined. Authorization rules to subject-to-object read, write and execute access are defined for security monitor as well as security tag assignment procedures for newly created objects. Multiple access (a single subject to many objects and many subjects to a single object) authorization rules are established. It is proven that MLTHS-system is secure by criteria of flow absence between security tag-incomparable entities (objects or subjects) and of top down flow absence. MLTHS-system allows combining access control and document storage text search technologies to create secure search engines with no functional limitations.

Détail

Keywords: access control (management), security model, hierarchical thematic classifier, multirubric lattice, documentary information retrieval systems, thematic indexing, MLS-model.
Mots-clés : multirubric

Bibliographie

[1] Grusho A. A., Primenko E. A., Timonina E. E., Theoretical Foundations of Computer Security, Akademiya Publ., Moscow, 2009, 272 pp. (in Russian)

[2] Devyanin P. N., Models of Computer Systems Security. Control of Access and Information Flows, Goryachaya liniya – Telekom, Moscow, 2011, 320 pp. (in Russian)

[3] Gaydamakin N. A., Differentiation of Access to Information in Computer Systems, USU Publ., Ekaterinburg, 2003, 328 pp. (in Russian)

[4] Bell D. E., LaPadula L. J., Secure Computers Systems: Unified Exposition and Multics Interpretation, MITRE Corp., Bedford, Mass., 1976

[5] Kryukov K. V., Pankova L. A., Pronina V. A., et al., “Semantic similarity measures in ontology”, Control Science, 2010, no. 5, 2–14 (in Russian)

[6] Gaidamakin N. A., “A model of thematic differentiation of access to information for the hierarchical classifier in automatic control systems”, Automaton and Remote Control, 64:3 (2003), 505–516 | DOI | MR | Zbl

[7] Shcherbakov A. Yu., Modern Computer Security. Theoretical Basis. Practical Aspects, Knizhnyy mir, Moscow, 2009, 352 pp. (in Russian)