The Chinese Wall Security Policy - Purdue University

1 ,Backwater,Camberley,Surrey,GUI79BQ,Unit edKingdomABSTRACTE veryonewhohasseenthemovieWallStreetwi~ (theWorkshoponIntegrityPolicyforComputer InformationSystems)hasdrawnattentiontoth eexistenceofawiderangeofcom-mercialsecur itypolicieswhicharebothsignifi-cantlydif ferentfromeachotherandquitealientocurren t military thinkingasimplementedinproductsforthesec uritymari< ,theChineseWall, ,therefore,perhapsassignificantttothefin ancialworldasBel!-LaPadula ,K2 NUntilrecently, sseminalpaper[1]has,however,drawnattenti ontothefactthatcommercialsecurityneedsar ejustasimportantasthoseofthedefencecom-m unityand,throughtheWIPCIS initiative[2], smodel[3].Oneofthese,theChineseWallsecur itypolicyisperhapsassignificanttosomepar tsofthecommercialworldasBellandLaPadula spolicies[4,5] sclients;thismeanshecannotadvisecor-pora tionswherehehasinsiderknowledgeoftheplan s, ,theanalystisfreetoadvisecorporationswhi charenotincompetitionwitheachother, , ,datasetsaregroupedinto confIictofinterestclasses andbymandatoryrulingallsubject=areallowe daccesstoatmostonedatasetbelongingtoeach suchconflictofin-terestclass; [6]havetheauthorityoflaw[7] ,correctimplementationofthispolicyisimpo rtanttoEnglishFinancialInstitutionssince itprovidesalegitimatedefenceagainstcerta inpe-nalclassesofoffenceundertheirIak[.]

2 CHW% !,mLSA,llml,elItisusefultodeviseamodelof theChineseWallpolicy, ,inparticular,wewishtocompareitwiththeBe ll-LaPadula(BLP)modelwewilladoptthelatte r 13ank-A , OilCompany-A or OilCompany-B )andb)therewouldbetwoconflictofinterestc lasses,oneforbanks(containingBank-A sdataset)andoneforpetroleumcompanies(con tainingOilCompany-A sandOilCompany-B sdatasets), banks or petroleumcompanies Thisstructureisofgreatimportancetothemod elandisrepresentedintheannexasanaxiom(Al ).,Si,mr?l,e?X?Guri, :a)isheldonthecomputer,andb) ,inconsiderationoftheBank-A,OilCompany-A andOilCompany-Bdatasetsmentionedprevi-OU SIy,anewusermayfreelychoosetoaccesswhate verdatasetsheIikes; ,however, ; ,ifherequestsaccesstotheOilCompany-Bdata settherequestmustbedeniedsinceaconflictd oesexistbetweentherequesteddataset(OiICo mpany-B)andonealreadypossessed(OilCompan y-A).THESETOFALLOBJECTS,O1 IConflictof:interest:classes:If:A:,B!C8@ 81;Companyj::datasetsI#:1II1I 1.:f:gih;i;J-:k :I:m:n:1 1 II:1s:jindividualobjects(conflictofinter estclassAcompanydatasetg)F,i,9,Mr%,l.

3 The,m,PQsitiQn,,,,Qt,, ,wereOilCompany-Btobeaccessedbeforethere questtoaccesstheOilCompany-Adataset, { OilCompany-B , Bank-A }(asopposedtotherequesttoaccesstheOilCom pany-Bdatasetbeingdeniedandtheuserposses sing{ OilCompany-A , Bank-A ]). ,inthefirstinstance, ,however,aChineseWalliscreatedforthatuse raroundthatdatasetandwecanthinkof thewrongsideofthisWall ,theuserstillhasfreedomtoaccessanyotherd atasetwhich207isinadifferentconflictofin terestclass,butassconasthatchoiceismade, ,wecanintroduceELP sconceptofasubjecttorepresentauser, ,itisonvenienttobeabletoidentifyanyparti cularsubject, , (DI),N, ,~isamatrixwithaCOIUmnfOreveryobjectinth esystemandarowforeverysubject;anyparticu larcellthereforecorrespondstoaparticular (subject,object)pair.~simplyrecordswhoha saccessedwhat, ,SU,hasaccessedsomeobjectorthen,N(u,r)wo uldbesettrue, ,say,SU,toaccesssomenewob-ject,sayOGisgr antedthen,~,ofcourse,mustbeupdated;inpar ticular~mustbereplacedbysomenewN inwhich,N (u,t)takesthe (axiomA2inAnnexA).}

4 Thisrulemeansthat:Accessisonlygrantedift heobjectrequested:a)isinthesamecompanyda tasetasanobjectalreadyaccessedbythatsubj ect, ,orb)belongstoanentirelydifferentmnflict ofinterestclass(A2).Thisruleis,however,i nsufficientinitself;itisnecessarytoensur ethatinitially, ,thatNhasbeencorrectlyinitialized(everyw herefalse).Moreoveritisnecessarytoformal IYdefinetheno-tionthat,givensuchaninitia lstate, (respectively) ,wewillcallourrule(A2)thesimp/esecurityr uleaswell.(Notsurprisingly,wewilldefinea *-propertyruleaswell,seelater.) , ,inparticular:T1) ) ,andthatishowmanypeopledoyouneedtooperat eone?T3) (L,say)whichwillgiveusthean~ ,becauseofthefreechoicenatureofthepolicy ,shouldtwoormoreuserschoosetoaccessthesa medatasetthenthisnumbermustbe! ,ifwehadanAutomobileclasswith5motorcompa nies(LY=5)andfiveuserseachwithaccesstodi fferentmotorcompanies,butallchoosetoacce ssthesamepetroleumcompany,OilCompany-A,t henwhocanaccessOilCompany-B?Hence,inprac tice, ,theconflictofinterestc!

5 (ausercannevercompareOilCompany-A sdatawithOilCompanyB sdata,norcanhecompareBank-A sdatawithOilCompany-A sdataifhehashadpreviousaccesstoOilCompan y-B sdata).Thisrestrictioncan,however, sinformation,inparticulartopreventthedis coveryofthatcorporation , ,thishasbeenfoundtobethecase[3].Itseemss ensible,therefore,toregardallcompanydata ~ets,barone, ,YO(say),forsanitizedinformationrelating toallcorporations(D2inAnnexA). ,yc.,isthesolememberofsomedistinguishedc on-flictofinterestclass,x~(A5).Inotherwo rds,ifanobjectbearsthesecuritylabely~the nitmustalsobearthelabelx~ ~tellsusthatalIsubjectscanaccessthiscomp anydataset.*-F!wM -tYSupposetwosubjects,User-AandUser-B,ha vebetweenthemaccesstothethreedatasets,Oi ICompany-A,OilCompany-BandBank-A, ,however, :Writeaccessisonlypermittedifa)accees1sp ermittedbythesimplesecurityrule,andb)noo bjectcanbereadwhichisinadifferentcompany datasettotheoneforwhichwriteaccessisrequ estedandcontainsuneani-tizedinformation.

6 (A6).Giventhisrulewecanprovethat:T4)Thef lowofunsanitizedin-formationisconfinedto itsowncompanydatase~ *-propertysecurityruledefinedintheBLPmod el;wewillthereforecallourrule(A6)the~ !.LAItisinstructivetocomparetheChineseWa llpolicywiththatoftheBell-LaPadulamodel[ 4,5].Bothp61iciesaredescribedinsimilarte rms:thecompo-sitionandsecurityattributes oftheobjectscon-cernedandtherulesforacce ss,bothinrespectofsimple-securityand* (BLP) ,,,mmxitismTheBLPmodelplacesnoconstraint supontheinterrelationshipsbetweenobjects , [4]hasasecu-ritylabeloftheform(c/ass,{ca t})wherea)c/assistheclassificationofthei nformation( ,confidential,secret)b)catistheformalcat egoryoftheinformation( ).UnliketheChineseWallpolicy, (c/ear,NTK)where:a)clearisthesubject sclearance, )NTKisthesubject sneed-to-know, ! ,thetwoobjectcompositionscanbebroughttog etherquitesimplyby:a)reservingoneBLPclas sificationforsanitizedinformationandanot herforunsanitizedin-formationb)assigning eachChineseWall(x,y)labeltoauniqueBLPcat egoryc)Iabellingeachobjectcontainingunsa nitlzedinformationwiththeBLPcategorycorr espondingtoits(x,y)labelandtheBLPcategor yofthesanitizeddataset(xo, ::2;:3:I&:(A,f):&:(B,i):&:(C,l)!

7 O::0::0:IE4;:5::6::&i(A,g):&l(B,.j):&:(C ,m):0::0::0:8*7::8::9:1I&:(A,h)~&:(B,k): &:(C,n):0:,0;:0:1Io:111(XO,YO)II1t1t8 BLPalsohasasimple-securityruleanda*-prop -ertyrule:a)EimPbHKXXArltY:accessiSgrant edonlyifthesubject sclearanceisgreaterthantheob-ject sclassificationandthesubject sneed-to-knowinc/udestheobject scategory(ies)b)?! :writeaccessisgrantedonlyiftheoutputobje ct sclassificationisgreaterthantheclassific ationofal!inputobjects,anditscategoryInc ludesthecategory(ies) ,incontrasttotheChineseWallpol-icy,these rulesdonotconstrainaccessbytheobjectsalr eadypossessedbyasubject, )b)c)so, ,forexample,wewouldhave27combinations:{o ,1,2,3},{O,1,2,6},{o,1,2,9},{o,1,5,3},.. { ,8,9}thenassignoneofthesetoeachsubject, ,User-A,LJser-BandUser-C,couldassignthem :User-Ahas{0,1,2,3}User-Bhas{O,4,8,6]Use r-Chas{O,7,5,S}Now, * ; , sabilitytomodeltoChineseWallsecuritypoli cy;theyarenot,however, ,supposeintherealworldmanagementsuddenly requiredUser-Atohaveaccesstocom-panydata set-gbecauseUser-Bwastakensick;whatthen? }

8 WecannotjustchangeUser-A sneed-to-knowto{O,1,8,3]unlessweknowforc ertainthathehasnotyetaccessedcompanydata set-2; , ,thesetrans-formationstotallyignorethefr eechoicenatureoftheChine~ ( ) ,wecanuseBLPtomodel~ !TheChineseWallmodelmustthereforeberegar dedasdistinctfromBLPandimportantinitsown right.(U& [1]definesasetofrules,basedoncommerciald ataprocessingpractices, (E2),cbservedinmanycommercialsystems[3], ithE2isimportantbecauseofthepracticalsig nificanceofthatrule; (user,pro-gram,object)whichrelatesauser, aprogram, ,whichinturnisallowedtoaccessanyobject, ,forexample, ,9d.,9xmi,tiQn,,,,Qf,,,th,e,,,,,Gh~,n,-, ,,M,all,, , (user,process)pairsirice,A2forexample, sob-servationbysimplyrequiringthat:a)use rsmayonlyexecutecertainnamedprOWSSQS(A7) b)thosepKKX3 SSeSmayonlyaccesscertainobjects(A8). <and Wilson sobservationtobeincorporatedintoourmodel :a)withoutchangetoanyoftheforegoingthe-o ry(inparticularwesimplyrestateallax-ioms ,definitionsandtheoremsbyreplacingsiJbj ectwithuse,r)b)redefiningtheoveralIsimpl eand.}

9 *-propertysecurityrulestobethelogicalcon junctionofalIuser-object, ,bytheChineseWallpolicy,isallowedtoacces sthatobjectandthatprocessisalsoallowedto accessthatobject;writeaccessisthenper-mi ttedonlyifthe,* p,ropertyrule(A6) !#i! !&RMA_mtw ~ ,atbest, , , ,theClarkandWilson saccesscontrolobservationsarenotatvarian cewitheitherthepolicyoritsmodelasdevelop edwithinthispaper.[1][21[31[4][5][6][71F w33w , ,andWILSON, AComparisonofCommercialandMilitaryComput erSecurityPolicies IEEES ymposiurnonSecurityandPrivacy,Oakland, ReportoftheInvitationalWorkshoponIn-tegr ityPolicyinComputerInformationSys-tems(w IpcIs) PublishedbytheNIST(formerlytheNBS), , aTheCorporateImplicationsofCommercialSec urityPolicies ,ProceedingsofCorporateComputerSecurity8 9,PLFC ommunications,London, , ,andLaPADULA, SecureComputerSystems:UnifiedExpositiona ndMulticsInterpretation ESD-TR-75-306, ,TheMITREC orporation, ,J. $TheAlgebraofSecurity IEEES ymposiurnonSecurityandPrivacy,Oakland, sStationeryOffice,London,SecuritiesandIn vestmentBoardRules,ChapterIIIPart5 sStationeryOffice,London,FinancialServic esAct1996,S48(2)(h), ,ObeasetofobjectsandLasetofsecuritylabel s(x,y).]]]

10 (o)andY(o) ,theyascompanydatasetsandintroducethenot ationXj,YjtomeanX(oj)andY(oj)respectivey ,Thusforsomeobject~j, ,m,,,,,l,:.Y1qy2--->xl=x2inotherwords,if anytwoobjectsO*and02be-longtothesamecomp anydatzsetthentheyalsobelongtothesamecon flictofinterestclass.,Kkmku,,1,:inotherw ords, !mmylqy2--->xl=x2(Al) (YI=Y2)Qr(xl=x2)xl<>x2--->yl<)yz,Lwmitkm,,l:,~,abooleanmatrixwithelements,~(v,c)corre-spondingtothemembersofSXOwhichtakethevaluetrueifsubjectsvhas,orhashad,accesstoobjectocorthevaluefalseifsvhasnothadac-cesstoobjectOQOncesomerequestR(u,r)bysubjectsutoaccesssomenewobjectorhasbeengrantedthenN(U,r) ,withoutlossofgenerality,anyrequestR(u,r)causesastatetransitionwherebyNisreplacedbysomenew,~,~ . (u,c)=true( )((k~~Xr)!X (Yc=Y.)).Axi,m,dkN(V,c)qfaise,f~r~1(v,c) ~(u,c)iseverywherefaiseforsomeathenanyrequestR(u,r) ,,1 ,OaandOb,whichbeiongtothesameconflictofinter-estciassbutdifferentcompanydatasets, (u,a)=trueandMu,b)qtrueandXaqXbtl~,dYe<> ,whenaccesstoobwasgrantedN(u,a)wasalread ytrueandthusbyA2(Xa<>Xb)w(J s=Yb).