This paper presents a general theory of system composition for possibilistic" security properties. We see that these properties fall outside of the AlpernSchneider safety liveness domain and hence, are not subject to the Abadi-Lamport Composition Principle. We then introduce a set of trace constructors called selective interleaving functions and show that possibilistic security properties are closure properties with respect to di erent classes of selective i n terleaving functions. This provides a uniform framework for analyzing these properties and allows us to construct a partial ordering for them. We present a n umber of composition constructs, show the extent to which each preserves closure with respect to di erent classes of selective i n terleaving functions, and show that they are su cient for forming the general hook-up construction. We see that although closure under a class of selective i n terleaving functions is generally preserved by product and cascading, it is not generally preserved by feedback, internal system composition constructs, or re nement. We examine the reason for this.

No abstract

No abstract

No abstract

The term security model has been used to describe any formal statement of a system's confidentiality, availability, or integrity requirements. In this article we focus on the primary use of security models, which has been to describe general confidentiality requirements. We then give pointers to security model work in other areas. Even if we limit ourselves to models of confidentiality, there are two related, but distinct, senses of the term security model in the computer security literature. In the more limited use of the term, a security model specifies a particular mechanism for enforcing confidentiality, called access control , which was brought over into computer security from the world of documents and safes. In the more general usage of the term, security models are specifications of a system's confidentiality requirements and are not “models” at all in that they specify security requirements without describing any particular mechanism for implementing these requirements. These models specify restrictions on a system's interface (usually its input/output relation) that are sufficient to ensure that any implementation that satisfies these restrictions will enforce confidentiality. We consider access control models and interface models in turn after types are also descussed.