varialesojects资料.ppt

CIS 551 563.14.1 Tamper Resistant Architecture:Decentralized Label Model for Information Flow Control Presented by: Soumyadeb Mitra PISCES Group: Soumyadeb Mitra, Sruthi Bandhakavi, Ragib Hasan, Raman Sharikyn University of Illinois Spring 2006 Motivation for Decentralized Label Models Security models have two goals Prevent malicious destruction of information Control release and propagation of information Traditional security models: Access control lists, capabilities First goal supported Second Information release can be restricted Information propagation is not well supported Motivating Example Java applet Downloaded from remote site and run locally Code not trustworthy Security assurances Restrict malicious transfer of information No way to control information propagation Current approach: Sandbox Too restrictive Possible Solution Control information flow The Basic Idea Assign security labels to data Who created it? Who is allowed to see it? Track data flowing through the system Check violations Main Entities Principals, representing users Who create data Values Computation manipulate values Slots Variables/objects acting as source and sink of values Channels Input/Output : Values obtained from input channel and written to output channel Values/Slots/Channels have security labels associated with them Labels Label L = {own: reader1, reader2} Owner Principal who is the source of the information Readers Principals whom the owner is willing to release data Values/Slots/Channels have labels Restriction on the kind of assignment (x:=v) Discussed later Derived Labels During computation, values are derived from other values. The derived value must contain “information” about its source Example: x: { Alice: P, Q } y: { Bob: Q, R } z = x+y: { Alice: P, Q ; Bob : Q, R} Both restrictions apply Effective reader : Q Derived Labels Label of z is a join of labels of x and y L1 U L2 owners(L1 U L2) = owners(L1) U owners(L2) reader(L1 U L2 ,o) = readers(L1 ,