© Ravi Sandhu HRU and TAM Ravi Sandhu Laboratory for Information Security Technology George Mason University [email protected]

© Ravi Sandhuwww.list.gmu.edu

HRU and TAM

Ravi SandhuLaboratory for Information Security Technology

George Mason [email protected]

2

© 2004 Ravi Sandhuwww.list.gmu.edu

The Access Matrix Model, Lampson 1971

3


The HRU (Harrison-Ruzzo-Ullman) Model, 1976

U r w

V

F

r w

G

r

4



U r w

V

F

r w own

G

r

5



U r w

V

F

r w own

G

r

r

6


HRU Commands and Operations

• command α(X1, X2 , . . ., Xk)if rl in (Xs1, Xo1) and r2 in (Xs2, Xo2) and ri in (Xsi, Xoi)

thenop1; op2; … opn

end• enter r into (Xs, Xo)

delete r from (Xs, Xo)create subject Xscreate object Xodestroy subject Xsdestroy object Xo

7


HRU Examples

8


HRU Examples

9


HRU Examples

10


HRU Examples

11


The Safety Problem

Given• initial state• protection scheme (HRU commands)

Can r appear in a cell that exists in the initial state and does not contain r in the initial state?

More specific question might be:can r appear in a specific cell [s,o]

12


The Safety Problem

Initial state: r’ in (o,o) and nowhere else

13


Safety is Undecidable in HRU

14


TAM adds types to HRU

15


TAM adds types to HRU

16


TAM commands

17


TAM primitive operations

18


TAM operations: enter and delete

19


TAM operations: create and destroy

20


TAM operations: create and destroy

21


The Safety Problem

• TAM has much stronger safety properties than HRU

Documents

© Ravi Sandhu HRU and TAM Ravi Sandhu Laboratory for Information Security Technology George Mason University [email protected]