The Clark-Wilson Model
Author : Yongge Wang
Confidentiality, integrity, and availability are three essential properties for both military and commercial information security systems. In a military environment, the main objective is to prevent disclosure of information. For a commercial system (like a bank system), however, the main concern is to ensure that data integrity is protected from improper modifications and inappropriate actions performed by unauthorized users. The Clark- Wilson security policy model seeks to formalize the principles of accounting security that have accumulated over centuries of experiential bookkeeping. The Clark-Wilson (CW) model consists of subject/program/object triples and rules about data, application programs and triples. In the following, we will briefly discuss the triples and rules.
All formal access control models that pre-date the Clark-Wilson model use the concept of an ordered subject/object pair — that is, a user and an item or collection of data, with a fixed relationship (e.g. read or write) between the two. Clark and Wilson recognized that the relationship could be implemented by an arbitrary program. Accordingly, they devised an ordered subject/program/object triple. They use the term transformational procedure (TP) for a program to make it clear that it has integrity-relevance because it modifies or transforms data according to a rule or procedure. Data modified by transformational procedures are called constrained data items (CDI). This is because they are constrained in the sense that only transformational procedures may modify them and that integrity verification procedures (IVP) exercise constraints on them to ensure that they have certain properties, of which consistency and conformance to the real world are two of the most significant.
Unconstrained data items (UDI) are all other data – chiefly the keyed input to transformational procedures. Once subjects have been constrained so that they can gain access to objects only through specified transformational procedures, transformational procedures can be embedded with whatever logic is needed to effect limitation of privilege and separation of duties. Transformational procedures can themselves control access of subjects to objects at a finer level of granularity than that available to the system. What is more, they can exercise finer controls (e.g. reasonableness and consistency checks on unconstrained data items) for such purposes as double-entry bookkeeping, thus making sure that whatever is subtracted from one account is added to another. To be specific, access control is by means of triples (subject, TP, CDI) which are so structured that a shared control policy is enforced. According to Amoroso’s formulation (as illustrated in the textbook):
- The system will have an IVP for validating the integrity of any CDI
- The application of a TP to CDI must maintain its integrity
- A CDI can only be changed by TP
- Subjects can only initiate certain TPs on certain CDIs
- Triples must enforce an appropriate separation of duty policy on subjects
- Certain special TPs on UDI can produce CDIs as output
- Each application of a TP must cause enough information to reconstruct it to bewritten to a special append-only CDI
- The system must authenticate subjects attempting to initiate a TP
- The system must only permit special subjects (i.e. security officers) to make anyauthorization-related lists.
We can split these principles into two categories: well-formed transactions and separation of duty.
Separation of duty states that no single person should perform a task from beginning to end, but that the task should be divided among two or more people to prevent fraud by one person acting alone.
"blogger, InfoSec specialist, super hero ... and all round good guy" CYBER & INFOSEC
This article relies largely or entirely on a single source. Relevant discussion may be found on the talk page. Please help improve this article by introducing citations to additional sources. The Clark–Wilson integrity model provides a foundation for specifying and analyzing an integrity policy for a computing system.
The model is primarily concerned with formalizing the notion of information integrity. Information integrity is maintained by preventing corruption of data items in a system due to either error or malicious intent. An integrity policy describes how the data items in the system should be kept valid from one state of the system to the next and specifies the capabilities of various principals in the system. The model uses security labels to grant access to objects via transformation procedures and a restricted interface model.
The model was described in a 1987 paper (A Comparison of Commercial and Military Computer Security Policies) by David D. Clark and David R. Wilson. The paper develops the model as a way to formalize the notion of information integrity, especially as compared to the requirements for multilevel security (MLS) systems described in the Orange Book. Clark and Wilson argue that the existing integrity models such as Biba (read-up/write-down) were better suited to enforcing data integrity rather than information confidentiality. The Biba models are more clearly useful in, for example, banking classification systems to prevent the untrusted modification of information and the tainting of information at higher classification levels. In contrast, Clark–Wilson is more clearly applicable to business and industry processes in which the integrity of the information content is paramount at any level of classification (although the authors stress that all three models are obviously of use to both government and industry organizations).
According to Stewart and Chapple's CISSP Study Guide Sixth Edition, the Clark–Wilson model uses a multi-faceted approach in order to enforce data integrity. Instead of defining a formal state machine, the model defines each data item and allows modifications through only a small set of programs. The model uses a three-part relationship of subject/program/object (where program is interchangeable with transaction) known as a triple or an access control triple. Within this relationship, subjects do not have direct access to objects. Objects can only be accessed through programs. Look here to see how this differs from other access control models.
Find sources: "Clark–Wilson model" – news · newspapers · books · scholar · JSTOR (September 2018)
The model's enforcement and certification rules define data items and processes that provide the basis for an integrity policy. The core of the model is based on the notion of a transaction.
- A well-formed transaction is a series of operations that transition a system from one consistent state to another consistent state.
- In this model the integrity policy addresses the integrity of the transactions.
- The principle of separation of duty requires that the certifier of a transaction and the implementer be different entities.
The model contains a number of basic constructs that represent both data items and processes that operate on those data items. The key data type in the Clark–Wilson model is a Constrained Data Item (CDI). An Integrity Verification Procedure (IVP) ensures that all CDIs in the system are valid at a certain state. Transactions that enforce the integrity policy are represented by Transformation Procedures (TPs). A TP takes as input a CDI or Unconstrained Data Item (UDI) and produces a CDI. A TP must transition the system from one valid state to another valid state. UDIs represent system input (such as that provided by a user or adversary). A TP must guarantee (via certification) that it transforms all possible values of a UDI to a “safe” CDI.
At the heart of the model is the notion of a relationship between an authenticated principal (i.e., user) and a set of programs (i.e., TPs) that operate on a set of data items (e.g., UDIs and CDIs). The components of such a relation, taken together, are referred to as a Clark–Wilson triple. The model must also ensure that different entities are responsible for manipulating the relationships between principals, transactions, and data items. As a short example, a user capable of certifying or creating a relation should not be able to execute the programs specified in that relation.
The model consists of two sets of rules: Certification Rules (C) and Enforcement Rules (E). The nine rules ensure the external and internal integrity of the data items. To paraphrase these:
C1—When an IVP is executed, it must ensure the CDIs are valid.C2—For some associated set of CDIs, a TP must transform those CDIs from one valid state to another.Since we must make sure that these TPs are certified to operate on a particular CDI, we must have E1 and E2.
E1—System must maintain a list of certified relations and ensure only TPs certified to run on a CDI change that CDI.E2—System must associate a user with each TP and set of CDIs. The TP may access the CDI on behalf of the user if it is "legal".E3-The system must authenticate the identity of each user attempting to execute a TP.This requires keeping track of triples (user, TP, {CDIs}) called "allowed relations".
C3—Allowed relations must meet the requirements of "separation of duty".We need authentication to keep track of this.
C4—All TPs must append to a log enough information to reconstruct the operation.When information enters the system it need not be trusted or constrained (i.e. can be a UDI). We must deal with this appropriately.
C5—Any TP that takes a UDI as input may only perform valid transactions for all possible values of the UDI. The TP will either accept (convert to CDI) or reject the UDI.Finally, to prevent people from gaining access by changing qualifications of a TP:
E4—Only the certifier of a TP may change the list of entities associated with that TP.A variant of Clark-Wilson is the CW-lite model, which relaxes the original requirement of formal verification of TP semantics. The semantic verification is deferred to a separate model and general formal proof tools.
- Confused deputy problem
- Clark, David D.; and Wilson, David R.; A Comparison of Commercial and Military Computer Security Policies; in Proceedings of the 1987 IEEE Symposium on Research in Security and Privacy (SP'87), May 1987, Oakland, CA; IEEE Press, pp. 184–193
- Chapple, Mike; Stewart, James and Gibson Darril ; Certified Information Systems Security Professional; Official Study Guide (8th Edition) 2018, John Wiley & Sons, Indiana
- Shankar, Umesh; Jaeger, Trent; and Sailer, Reiner ; "Toward Automated Information-Flow Integrity Verification for Security-Critical Applications"; in "Proceedings of the 2006 Network and Distributed Systems Security Symposium (NDSS '06), February 2006, San Diego, CA“; Internet Society, pp. 267-280
- Slides about Clark–Wilson used by professor Matt Bishop to teach computer security
- //doi.ieeecomputersociety.org/10.1109/SP.1987.10001
Retrieved from "//en.wikipedia.org/w/index.php?title=Clark–Wilson_model&oldid=1061054543"