Models of Multilevel Computer Security

Abstract

Some multilevel access-control models are surveyed in the chapter. This survey includes more recent models and also presents a few models in greater depth. The first access-control models were for operating systems, and modeled the policy by which an operating system grants requests by processes for access to controllable segments of main memory. This chapter focuses on the design decisions behind these models, and their intended application to secure computer system development. Some new ideas arise in database system models, which impose additional structure on data objects, raising questions about how to assign labels. There is a brief discussion of network model. Mandatory access-control (MAC) system models are used with some success to help design secure computer systems. There are two levels at which the MAC approach can be used. One level is at an external interface, where objects are complex abstractions such as relations, views, virtual connections, or datagrams. The other level is at the interface to the underlying secure operating system kernel, if there is one, where objects are segments of memory. This is the level at which access control is enforced, and where one has the most assurance that a simple information-flow policy is implemented.