U4. Clark Wilson

U4. Clark Wilson

1. May be better thought of as a security 'framework'

   • Addresses security requirements of commercial applications and is primarily concerned with integrity
     • Is aimed at security in the commercial environment rather than the military arena.

2. Concerned with

   • Internal consistency
     • the relation of the internal state of a system to the outside world
   • external consistency
     • properties of the internal state of a system
   • Integrity
     • Being authorised to apply a program to a data item that may be accessed through the program

3. Primary mechanisims

   • Well-formed Transactions
     • Data items can only be manipulated by a specific set of programs and users have access to programs rather than to data items
   • Separation of duties
     • Individuals may only perform certain tasks
       • in general, individuals would need to collude in order to get round the security system
     • Separation of duties is a crucial concept in many security systems

4. Access control

   • subjects and objects are grouped together
     • Subjects are assigned roles
       • roles are then are 'labelled' with programs
         • programs serve as an 'intermediate layer' between the roles and the data types.
       • Objects with the same structure are grouped together as data types
       • Frequently, roles relate to some form of hierarchical structure within an organisation.

5. Requirements

   • subjects have to be identified and authenticated;
   • objects can be manipulated only by a restricted set of programs;
   • the system has to be certified to work properly.
   • subjects can execute only a restricted set of programs;
   • a proper audit log must be maintained;

6. Certification Rules

   • Certification rules The five certification rules are: 1. Integrity Verification Procedures must ensure that all Constrained Data Items are in a valid state when the IVP is run. 2. Transformation Procedures must be certified to be valid, i.e. valid CDIs must always be transformed into valid CDIs. Each TP is certified to access a specific set of CDIs. 3. The access rules must satisfy any separation of duties requirements. 4. All TPs must write to an append-only log.  5. Any TP that takes a Unconstrained Data Item as input must either convert the UDI into a CDI or reject the UDI and perform no transformation at all. All the above rules are 'reasonable'. Indeed, you may think they are just common sense! Perhaps, in some ways this mirrors commercial thinking rather than military thinking!Enforcement rules1. The system must maintain and protect the list of entries {(TPi:CDIa,CDIb, …)} giving the CDIs the TP is certified to access. 2. The system must maintain and protect the list of entries {(UserID,TPi:CDIa,CDIb, …)} specifying the TPs users can execute. 3. The system must authenticate each user requesting to execute a TP. 4. Only a subject that may certify an access rule for a TP may modify the respective entry in the list. This subject must not have execute rights on that TP. Again, all fairly sensible!