Fine-grained Privilege Propagation in DIFC Model

Abstract

In Decentralized Information Flow Control Model, Label is used for marking security level of sensitive data (such as static file, memory data or network packet). Anyone who wants to access the labeled data must obtain relative label first, so authorization is a process that the data owner give data receiver the capability to get the label. Traditionally, most researchers focus on the DIFC model innovation and application, few pay attention to how to disseminate the privilege of adding tag or removing tag. Fine-grained privilege propagation is the foundation for sharing sensitive data securely. In this paper we propose the model of fine-grained privilege propagation. The model provides label privilege granting and revocation in process level and describes four level of authorization for more flexible privilege propagation. The experiments demonstrate that FPPM improves the flexibility of data sharing.