Formal Models for Computer Security

ACM Computing Surveys (CSUR)

Volumn 13, Issue 3, 1981, Pages 247-278

  Landwehr, Carl E ^a  

^a NAVAL RESEARCH LABORATORY   (United States)

Author keywords

access matrix; aggregation; capabilltms; computer; confidentiality; confinement; information flow; integmty; operating system; privacy; protection; samtlzatlon; security; security classes; verification

Indexed keywords

COMPUTER SYSTEMS, DIGITAL;

COMPUTER SECURITY;

DATA PROCESSING;

EID: 0019608720     PISSN: 03600300     EISSN: 15577341     Source Type: Journal    
DOI: 10.1145/356850.356852     Document Type: Article

References (81)

1. Ames, S. R., And Oestreicher, D. R. “Design of a message processing system for a multilevel secure environment,” in Proc AFIPS Nat Computer Conf., vol. 47, AFIPS Press, Arlington, Va, 1978, pp. 765-771.
2. Ames, S. R., And Keeton-Williams, J. G. “Demonstrating security for trusted apphcatlons on a security kernel,” MITRE Corp, Bedford, Mass., April 1980
3. Anderson, J. P. “Computer security technology planning study,” ESD-TR-73-51, vol 1, ESD/AFSC, Hanscom AFB, Bedford, Mass., Oct. 1972 (NTISAD-758 206)
4. Andrews, G. R., And Reitman, R. P. “An axiomatic approach to informahon flow in programs,” ACM Trans Program Lang Syst 2, 1 (Jan. 1980), 56-76.
5. Bell, D. E., And Lapadula, L. J. “Secure computer systems Mathematical foundations,” ESD-TR-73-278, vol. 1, ESD/AFSC, Hanscom AFB, Bedford, Mass., Nov. 1973 (MTR-2547, vol. 1, MITRE Corp., Bedford, Mass.)
6. Bell, D. E., And Lapadula, L. J. “Secure computer systems A mathematmal model,” ESD-TR-73-278, vol. 2, ESD/AFSC, Hanscom AFB, Bedford, Mass., Nov. 1973 (MTR-2547, vol 2, MITRE Corp., Bedford, Mass.).
7. Bell, D. E. “Secure Computer systems: A refinement of the mathematmal model,” ESD-TR-73-278, vol. 3, ESD/AFSC, Hanscom AFB, Bedford, Mass, April 1974 (MTR 2547, vol. 3, MITRE Corp., Bedford, Mass.).
8. Bell, D. E., And Lapadula, L. J. “Secure computer systems. Mathematical foundations and model,” M74-244, MITRE Corp, Bedford, Mass., Oct. 1974.
9. Bell, D. E., And Lapadula, L. J. “Secure computer system. Unified exposition and multIcs interpretatmn,” MTR-2997, MITRE Corp., Bedford, Mass., July 1975.
10. Biea, K. J. “Integrity considerations for secure computer systems,” ESD-TR-76-372, ESD/AFSC, Hanscom AFB, Bedford, Mass., April 1977 (MITRE MTR-3153, NTIS AD A039324)
11. Birkhoff, G., And Barter, T. C. Modern Applied Algebra, McGraw-Hill, New York, 1970, p. 260.
12. Bishop, M., And Snyder, L. “The transfer of reformation and authomty in a protection system,” Proc. 7th Syrup Operating Systems Pnnciples, ACM SIGOPS Operating Syst. Rev. 13, 4 (Dec. 1979), 45-54.
13. Bonneau, C. H. “Secure communications processor kernel software, detailed specification, part I, rev. D,” Honeywell Inc, Avionics Diwsion, St. Petersburg, Fla., 1980.
14. Bonyun, D. “A new model of computer security with integrity and aggregatmn consideratmns,” I. P. Sharp Assoc, Ottawa, Ont., Canada, March 1978.
15. Boyer, R. S., And Moore, J. S. “A theorem-prover for recursive functions A user's manual,” Tech. Rep. CSL-91, SRI Internatmnal, Menlo Park, Calif, June 1979.
16. Cohen, E. “Information transmission in computational systems,” Proc. 6th Syrup. Operating Systems Principles, ACM SIGOPS Operating Syst Rev. 11, 5 (Nov. 1977), 133-140.
17. Cohen, E. “Information transmission in sequential programs,” in Foundation of secure computation, R. A. DeMillo, D. P., Dobkin, A. K Jones, and R. J. Lipton (Eds.), Academic Press, New York, 1978, pp. 297-336.
18. Demillo, R. A., Dobkin, D., And Lipton, R.J. “Even databases that lie can be compromised,” IEEE Trans Softw. Eng. SE-4, 1 (Jan. 1977), 74-75.
19. Denning, P. J. “Third generation computer systems,”Computing Surveys 3, 4 (Dec. 1971), 171-216.
20. Denning, D. E. “Secure information flow in computer systems,” Ph D. dissertation, Purdue Univ., West Lafayette, Ind., May 1975.
21. Denning, D. E. “A lattice model of secure information flow,” Commun. ACM 19, 5 (May 1976), 236-243.
22. Denning, D. E., And Denning, P. J.“Certification of programs for secure information flow,” Commun ACM 20, 7 (July 1977), 504-512.
23. Denning, D. E., Denning, P. J., And Schwartz, M. D. “The tracker: A threat to statmtical database security,” ACM Trans. Database Syst. 4, 1 (March 1979), 76-96.
24. Denning, D. E., And Denning, P. J. “Data security,” Comput. Surv 11, 3 (Sept. 1979), 227-249.
25. Dobkin, D., Jones, A. K. And Lipton, R. J. “Secure databases: protection against user Influence [sw],” ACM Trans. Database Syst. 4, (March 1979), 97-106.
26. Feiertag, R. J., Levitt, K. N., And Robinson, L. “Proving multilevel security of a system design,” in Proc. 6th ACM Symp. Operating Systems Prmctples, ACM SIGOPS Operattng Syst Rev 11, 5 (Nov 1977), 57-65.
27. Feiertag, R. J., And Neumann, P. G. “The foundations of a provably secure operating system (PSOS),” in Proc AFIPS Nat. Computer Conf., vol. 48, AFIPS Press, Arlington, Va, 1979, pp. 329-334.
28. Fenton, J. S. “Memoryless subsystems,” Comput. J 17, 2 (May 1974), 143-147.
29. Furtek, F. C.“A validation technique for computer security based on the theory of constraints,” ESD-TR-78-182, ESD/AFSC, Hanscom AFB, Bedford, Mass., Dec 1978 (MITRE MTR-3661, NTIS ADA065111).
30. Furtek, F. C. “Constraints and compromise,” in Foundations of secure computation, R. A. DeMillo, D. P Dobkin, A K. Jones, and R. J. Lipton (Eds.), Academic Press, New York, 1978, pp. 189-204.
31. Furtek, F. C. “Doing without values,” Proc. 9th Int. Symp. Multiple-Valued Logic, April 1979, pp. 114-120 (IEEE Cat. no. CH1408-4C)
32. Furtek, F. C. “Specification and verification of real-time, distributed systems using the theory of constraints,” Tech Rep. P-1027, Charles Stark Draper Laboratory, Cambridge, Mass., April 1980.
33. “GNOSIS External Specifications,“ Tymshare, Cupertino, Calif., 1980.
34. Gold, B. D., Linde, R. R., Peeler, R. J., Schaefer, M., Scheid, J. F., And Ward, P. D. “A security retrofit of VM/370,” In Proc. AFIPS Nat. Computer Conf., vol. 48, AFIPS Press, Arlington, va., 1979, pp 335-342
35. Graham, G. S., And Denning, P. J. “Protectlon-Prmciples and practice,” in Proc 1972 AFIPS Spring Jt Computer Conf, vol. 40, AFIPS Press, Arlmgton, Va, pp. 417-429.
36. Grohn, M.J. ”A model of a protected data management system,” ESD-TR-76-289, ESD/AFSC, Hanscom AFB, Bedford, Mass, June 1976 (I P. Sharp, Ottawa, Canada NTIS ADA 035256).
37. Harrison, M. A., Ruzzo, W. L., And Ullman, J.D. “Protection in operating systems,” Commun. ACM 19, 8 (Aug. 1976), 461-471.
38. Hinke, T. H., And Schaefer, M. “Secure data management system,” RADC-TR-75-266, Rome Air Dev. Center, AFSC, GriffiNS AFB, N Y., Nov 1975 (NTIS AD A019201)
39. Hoare, C. A. R. “An axiomatic basis for computer programming,” Commun. ACM 12, 10 (Oct. 1969), 576-583.
40. Jones, A. K., And Lipton, R. J. “The enforcement of security policies for computation,” Proc 5th Syrup Operating Systems Principles, ACM SIGOPS Operatmg Syst Rev. 9, 5 (Nov. 1975), 197-206.
41. Jones, A. K., Lipton, R. J., And Snyder, L. “A linear time algorithm for deciding subject-object security,” Proc 17th Ann Foundatmns Computer Sci Conf., Houston, Tex., 1976, pp. 33-41.
42. Jones, A. K. “Protection mechanism models: Their usefulness,” in Foundatmns of secure computation, R. A. DeMillo, D. P Dobkin, A. K. Jones, and R. J Lipton (Eds.), Academic Press, New York, 1978, pp. 237-254.
43. Jones, A. K., And Lipton, R.J. “The enforcement of security policies for cormputation,” J. Compt. Syst. Sci, 17, 1, (Aug. 1978), 35-55.
44. Kemmerer, R.A. “Verification of the UCLA security kernel: Abstract model, mapping, theorem generatmn and proof,” Ph.D. dissertation, UCLA, Losangeles, Calif., 1979.
45. “KSOS Verification Plan,” WDLTR7809, Ford Aerospace and Communications Corp, Western Development Lab. Div., Palo Alto, Calif., and SRI International, Menlo Park, Calif, 1978.
46. Lampson, B. W. “Protectmn,” in Proc. 5th Princeton Syrup. Informatton Sciences and Systems (March 1971), pp 437-443.
47. Lampson, B.W. “A note on the confinement problem,” Commun ACM 16, 10 (Oct. 1973), 613-615.
48. Landwehr, C. E. “Assertions for verafication of multilevel secure military message systems,” contribution to Workshop on Formal Verification, SRI International, Menlo Park, Calif., April 1980
49. Lipton, R. J., And Snyder, L. “A linear time algorithm for deciding subject security,” J ACM 24, 3 (July 1977), 455-464.
50. Mccauley, E. J., And Drongowski, P.J. “KSOS: The design of a secure operating system,” in Proc. AFIPS Nat Computer Conf., vol 48, AFIPS Press, Arlington, Va., 1979, pp. 345-353.
51. Millen, J. K. “Security kernel validation in practme,” Commun. ACM 19, 5 (May 1976), 243-250.
52. Millen, J. K. “An example of a formal flow violation,” in Proc IEEE Computer Soc. 2nd Int. Computer Software and Apphcatmns Conf, Nov 1978, pp. 204-208
53. Millen, J.K. “Constramts and multilevel security,” In Foundatwns of Secure Computation, R A. DeMfllo, D. P. Dobkin, A. K. Jones, and R. J. Lipton (Eds.), Academic Press, New York, 1978, pp 205-222
54. Millen, J. K. “Causal system security,” ESD-TR-78-171, ESD/AFSC, Hanscom AFB, Bedford, Mass., Oct. 1978 (MITRE MTR-3614).
55. Neumann, P. G., Boyer, R. S., Feiertag, R. J., Levitt, K. N., And Robinson, L. “A provably secure operating system. The system, its applications, and proofs,” SRI International, Menlo Park, Calif., Feb. 1977.
56. Opnavinst 5239.1, Department of the Navy, Chief of Naval Operations, Op-942E, April 2, 1979.
57. Organick, E. I. The MULTICS system An exammatton of its structure, MIT Press, Cambridge, Mass., 1972.
58. Parnas D. L., And Price, W. R. “Using memory access control as the only protection mechanism,” in Proc. Int Workshop Protection in Operattng Systems, IRIA/LABORIA, Rocquencourt, France, Aug. 1974, 177-181.
59. Popek, G.J. “Access control models,” ESD-TR-73-106 ESD/AFSC, L. G Hanscom Field, Bedford, Mass, Feb 1973 (NTIS AD-761 807).
60. Popek, G. J., And Kline, C. “A verifiable protection system,” in Proc Int. Conf. Reliable Software, ACM Sigplan Notices 10, 6 (June 1975), 294-304.
61. Popek, G. J., And Farber, D. A. “A model for verification of data security in operating systems,” Commun ACM 21, 9 (Sept. 1978), 737-749.
62. Popek, G. J., Kline, C. S., And Walton, E. J. “UCLA Secure Unix,” UCLA Tech Rep. (Draft), Feb. 1978.
63. Popek, G. J., Kampe, M., Kline, C. S., Stoughton, A., Urban, M., And Walton, E. J. “UCLA secure Unix,” in Proc. AFIPS Nat. Computer Conf., vol. 48, AFIPS Press, Arlington, Va., 1979, pp 355-364.
64. Price, W.R. “Implications of a vtrtual memory mechanism for implementing protection in a family of operating systems,” Ph.D. dissertation, Carnegie-Mellon University, Pittsburgh, Pa, 1973.
65. Reitman, R.P. “A mechanism for mformation control m parallel systems,” in Proc 7th Symp. Operating Systems Principles, ACM SIGOPS Operating Syst. Rev 13, 4 (Dec 1979), 55-63
66. Roubine, O., And Robinson, L. “Special reference manual,” 3rd ed, SRI International, Menlo Park, Calif., 1977.
67. Schell, R. R., Downey, P. J., And Popek, G.J. “Preliminary notes on the design of secure military computer systems,” MCI-73-1, ESD/AFSC, Hanscom AFB, Bedford, Mass., Jan. 1973
68. Schiller, W. L. “The design and specification of a security kernel for the PDP-11/45,” ESD-TR-75-69, MITRE Corp., Bedford, Mass, March 1975.
69. Schroeder, M. D., Clark, D. D., And Saltzer, J. H. “The Multics kernel design project,” in Proc. 6th ACM Symp. Operating Systems Principles, ACM SIGOPS Operating Syst Rev 11, 5 (Nov. 1977), 43-56.
70. Schwartz, M. D., Denning, D. E., And Denning, P. J. “Linear queries in statistical databases,“ ACM Trans Database Syst. 4, 2 (June 1979), 156-167
71. Snyder, L. “On the synthesis and analysis of protection systems,” Proc 6th Symp Operating Systems Principles, ACM SIGOPS Operating Syst. Rev 11, 5 (Nov. 1977), 141-150
72. Snyder, L. “Formal models of capability-based protection systems,” Tech Rep 151, Dept. Computer Science, Yale Univ., New Haven, Conn, April 1979.
73. Walker, B J, Kemmerer, R A, And Popek, G.J. “Specification and verification of the UCLA Unix security kernel,” Commun. ACM 23, 2 (Feb. 1980), 118-131
74. Walter, K. G., Ogden, W. F., Rounds, W. C., Bradshaw, F. T., Ames, S. R., And Shumway, D. G. “Primitive models for computer security,” ESDTR-4-117, AF/ESD, Hanscom AFB, Bedford, Mass., Jan., 1974 (NTIS AD-778 467).
75. Walter, K. G., Schaen, S. I., Ogden, W. F., Rounds, W. C., Shumway, D. G., Schaeffer, D. D., Biba, K. J., Bradshaw, F. T., Ames, S. R., And Gilligan, J. M. “Structured specification of a security kernel,” in Proc. Int. Conf. Reliable Software, ACM SIGPLAN Notices 10, 6 (June 75), 285-293.
76. Walter, K. G., Ogden, W. F., Gilligan, J. M., Schaeffer, D. D., Schaen, S. I., And Shumway, D. G. “Initial Structured Specifications for an uncompromlsable computer security system,” ESD-TR-75-82, ESD/AFSC, Hanscom AFB, Bedford, Mass., July 1975 (NTIS AD-A022 49O).
77. Weissman, C. “Security controls in the ADEPT-50 time sharing system,” Proc. 1969 AFIPS Fall Jt Computer Conf., vol. 35, AFIPS Press, Arlington, Va., pp. 119-133.
78. Wilson, S. H., Kallander, J. W., Thomas, N. M., III, Klitzkie, L. C., And Bunch, J. R., Jr. “Military message experiment quick look report,” NRL Memorandum Rep. 3992, Naval Research Lab., Washington, D.C., April 1979, p. 10.
79. Withington, P.T. “The trusted function in secure decentralized processing,” MITRE MTR-3892, MITRE Corp., Bedford, Mass, Sept. 1979.
80. Yonke, M. D. “The XIVUS environment XIVUS working paper no. 1,” USC/Information Sciences Institute, Marina del Rey, Calif., April 1976.
81. Anderson, J.P. “Computer security technology planning study,” Tech. Rep ESD-TR-73-51, vols. 1 and 2, James P. Anderson and Co., Fort Washington, Pa., Oct. 1972.