1 / 18

The Jajodia & Sandhu model

The Jajodia & Sandhu model. Jajodia & Sandhu (1991), a model for the application of mandatory policies in relational database systems. Based on the sec classifications introduced in BLP. It extends the standard relational model to consider the sec classification.

malory
Download Presentation

The Jajodia & Sandhu model

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. The Jajodia & Sandhu model • Jajodia & Sandhu (1991), a model for the application of mandatory policies in relational database systems. Based on the sec classifications introduced in BLP. It extends the standard relational model to consider the sec classification. • Multilevel relations: Schema and multiple instances based on each access class. A multi-level relation consists of two parts: Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  2. (1) A state-independent multilevel relation scheme R (A1, C1,…, Cn, TC), where each Ai is a data attribute defined over domain Di, each Ci is a classification attribute for Ai, and TC is the tuple class attribute. The domain of Ci is specified by a range [Li, Hi] which is specified as a sub-lattice of access classes. The domain of TC is [lub (Li) , lub (Hi)]. Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  3. The Jajodia & Sandhu model (cont.) (2) A collection of state-dependant relation instances Rc(A1, C1,…, An, Cn, TC), one for each access class c in the given lattice; each instance is a set of distinct tuples of the form (a1, c1, …, an, cn, tc) where each element ai is either a value of domain Di or null, each ci is a value of the specified range and smaller than tc, that is, ci[ Li, Hi] citc, and tc is the least upper bound of the classes of the attribute in the tuple: that is, tc = lub { ci: i=1, …,n} Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  4. The Jajodia & Sandhu model (cont.) Example of a multilevel relation Employee TS Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  5. The Jajodia & Sandhu model (cont.) Instances at the S-level and TS-level of the Employee relation Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  6. The Jajodia & Sandhu model (cont.) Properties of the model: Read and writes are controlled to the satisfaction of the No-Read-Up and No-Write-Down principles. Other restrictions are put to regulate polyinstantiation. (1) Entity integrity: Let AK be the apparent key of a relation R. A multilevel relation R satisfies entity integrity if, and only if, for all instances Rc of R and t Rc (1) AiAK t[Ai] null (2) Ai , Aj  AK  t[Ci]=t[Cj], ie. AK is uniformly classified, and (3) Ai AK t[Ci] t[CAK] (where CAK is defined as the classification of the apparent key) Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  7. Null values! • Null values have two meanings: • Corresponding to real null values or • To attributes at a classification higher than the classification of the instance. • Two similar value tuples with different attribute sec class (so hidden, turned to null)! • Subsumtion relationship: t subsumes s, if for every attribute Ai: • t [Ai, Ci] = s [Ai, Ci] or • t[Ai] != Null and s [Ai] == Null. Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  8. The Jajodia & Sandhu model (cont.) Properties of the model (cont.): (2) Null integrity: A mutilevel relation R satisfies null integrity if and only if for each instance Rc of R both the following conditions are satisfied: (1) For all t Rc, t[Ai] = null  t[Ci] = t[CAK]: that is, null values are classified at the level of the key. (2) Rc is subsumption free in the sense that it does not contain two distinct tuples such that one subsumes the other A tuple t subsumes s if for every attribute Ai • t[Ai, Ci] = s[Ai, Ci] or • t[Ai] != null and s[Ai] = null. Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  9. 3) Inter-instance integrity Controlling the consistency among the different instances of a relation A multilevel relation R satisfies inter-instance integrity if and only if for all c´ c, Rc´ = (Rc, c´ ), where the filter function  produces the c’-instance Rc´ from Rc as follows: (1) For every tuplet Rc such that t[CAK]  c´, there is a tuple t´  Rc´, with t´[AK,CAK]=t[AK,CAK] and for Ai AK t´ [ Ai, Ci] = t [ Ai, Ci] if t [Ci]  c´, && = <null, CAK> otherwise Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  10. Inter-instance integrity (cont.): (2) There are no tuples in R c´ other than those derived by the above rule. (3) The end result is made subsumption free by exhaustive elimination of subsumed tuples . Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  11. (4) Polyinstantiation integrity property: A multilevel relation R satisfies Polyinstantiation integrity iff, for every Rc, for all Ai: (AK, CAK, Ci) Ai.That is, the apparent key, together with the classification of the key and the classification of the attribute functionally determines the value of this attribute. Informally: null integrity and interinstance integrity ensure that, if a tuple value at some security level can be filtered or derived from a higher-classified tuple, then it is sufficient to store the higher classified tuple in the multi-level relation. Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  12. Access to Multilevel relations: • Deal with the write operations (Insert, Update, Delete) • Read is processed through the Read-Down principle. Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  13. The Jajodia & Sandhu model (cont.) Insert operation: The insert operation, from a c-user, has the following from: INSERT INTO Rc [Ai [, Aj]…)] VALUES (ai[, aj]…) The insert operation is granted, if and only if, the following conditions are satisfied: (1) t [AK] does not contain any nulls (2) For all u Rc : u [AK]  t[AK] Ifthe conditions are satisfied, the tuple is inserted into Rc and all the instances Rc’>c Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  14. The Jajodia & Sandhu model (cont.) Results of the operation INSERT VALUES “ John, Dept2,20K” on S and TS instances of Employee from S subject S S TS Instance Rasool Jalili; 2nd semester 1384-1385; Database Security, Sharif Uni. of Tech.

  15. The Jajodia & Sandhu model (cont.) Update operation: An update operation from a c user has the following form: UPDATE Rc SET Ai = Si [, Aj = Sj]… [WHERE P] Where each si is a scalar expression, and p is a predicate expression which identifies those tuples in Rc that are to be modified Ifthe conditions are satisfied, the update is propagated into Rc’>c according to the minimum propagation delay policy: only those tuples which are needed to preserve the inter-instance property are inserted in Rc’>c Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  16. The Jajodia & Sandhu model (cont.) Results of the operation UPDATE salary = “30K” WHERE Name = “Ann” on S and TS instances of Employee from TS subject Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  17. The Jajodia & Sandhu model (cont.) Result of the operation UPDATE Department= “Dept1” WHERE Name = “Ann”” and S and TS instances of Employee from TS subject Sam Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

  18. Delete • Propagation of Delete to Rc’>c due to DELETE FROM RC [WHERE P] • If t[CAK] = c, delete any polyinstantiatedtuple in Rc’>c • If t[CAK] < c, the tuple will continue to exist in all instances Rc’>=t[AK]. Rasool Jalili; 2nd semester 1387-1388; Database Security, Sharif Uni. of Tech.

More Related