![](bg4.png)
An Access Policy Descriptive Object is defined
by the tuple < FID; LD; LAP; LAMT; LMT; {role}
>. FID is the Federated Identifier of the local
system; LD is the Local Designation. LAP is the
Local Access Policy which can be chosen in the set
{ DAC; RBAC; MACS; MACL } with DAC for
Discretionary Access Control (Lampson 71), RBAC
for Role-Based Access Control, MACS and MACL
for respectively mandatory model with strict I-
property and mandatory model with liberal I-
property (Bell 76). LAMT is the Local Access Mode
Table and defines the correspondences between the
local access modes and the federated access modes.
The Local Mandatory Table (LMT) defines the
correspondences between the local secrecy hierarchy
level of a mandatory system and the federated
secrecy level hierarchy. LMT attribute is null-valued
in case of DAC or RBAC system description. {role}
is a set of Roles which describe discretionary user
group, role and mandatory category.
At the federated level we use five logical access
modes: read-only (r), execute (x), append (a),
upgrade (u) and delete (d) with r ^ x ^ a ^ u ^ d.
Each local access mode is described by a federated
access mode combination. For example, in Unix
system the “write” access mode is described by the
federated access mode combination a + u + d. All
the local access mode descriptions are defined in the
Local Access Mode Table.
The Local Access Mode Table contains the
federated access mode combinations which is
equivalent to each local access mode (mainly read-
only and write-only local access modes). Then the
Local Mandatory Table is created to translate the
local secrecy level hierarchy.The dominate level is
always the first. For example, a local system with
the hierarchy of sensibility Non-Classified <
Classified < Secret < Top Secret is described by the
LMT {(Non-Classified; 1); (Classified; 2);
(Secret; 3); (Top Secret; 4)}.
A Security Object represents a secured entity of
the local access schema. A SO is defined by the
tuple < FID; LD; ML; DDO >. FID is the Federated
Identifier of the local resource. LD is the Local
Designation. FSL is the Federated Sensibility Level.
This attribute is null in case of DAC or RBAC
model description. DDO is a referenced Data
Descriptive Object. Each local secured data is
described by one to n Security Objects and one Data
Descriptive Object (see section 5).
A User Object describes a physical user of the
local access schema. A User is defined by the tuple
< FID; LD; FSL >. FID is the Federated Identifier of
the local user. LD is the Local Designation and FSL,
the Federated Sensibility Level. This attribute is null
in DAC or RBAC model description.
A Permission defines the access mode
combination the Subjects Descriptive Object of a
given role is allowed to execute on one Security
Object.
An Access Rule is defined by the tuple < so; m >
with so, a SO reference and m, a federated access
mode combination.
Our access model is a closed security system: all
non-authorized accesses are forbidden.
A Role is used in two cases: to represent a local
discretionary user group, or to extract each
sensibility level of a local mandatory category.
A Role is described by the tuple < FID; LD;
FSL; {Permission}; {User}; {AHL} {CLO};
{AELO} >. FID is the Federated Identifier of the
described element. LD is the Local Designation of
the described element. FSL is the Federated
Sensibility Level. This attribute is null in case of
DAC or RBAC model description. {Permission} is
the set of Permissions which defines access modes
to Security Object allowed for the Subject
Descriptive Object. {AHL} is the set of Access
Heritage Links. {CLO} is the set of Constraint Link
Objects, and {AELO}, the set of Access Equivalent
Link Objects (see the section 6).
An Access Heritage Link defines an access mode
combination from a “father” role to a “son” role with
the tuple < “father”; “son”; Mode > where “father”
is the “father” role reference, “son” is the “son” role
reference and Mode is a federated access mode
combination that Subject Descriptive Objects of the
“father” role are allowed to execute on all the
Security Objects of the “son” role. A null Mode
means that all SDO of the “father” role may execute
Access Rules of the “son” role (complete access).
Two types of Constraints are used in our system:
An Exclusion Constraint Link Object (ECLO)
references two or more roles. A User can be
referenced in only one role in a set of roles which
references the same ECLO (static constraint).
An Activation Constraint Link Object (ACLO)
references two or more roles. For a given user
session, the user actives only one role, in a set of
roles which references the same ACLO (dynamic
constraint).
5 A EXAMPLE OF MAC POLICY
SCHEMATA DESCRIPTION
Mandatory security models govern the access to
information by classifying the subjects and objects
in the system (Bell et al. 76). Objects are passive
entities storing information. Subjects are active
entities accessing the objects. Generally, a subject is
considered to be an active process operating on
ICEIS 2004 - DATABASES AND INFORMATION SYSTEMS INTEGRATION
262