A Rule-Set Approach to Formal Modeling of a Trusted Computer System

This article describes a rule-set approach to formal modeling of a trusted computer system. A finite state machine models the access operations of the trusted system while a separate rule set expresses the system's trust policies. A powerful feature of this approach is its ability to fit several widely differing trust policies easily within the same model. The paper shows how this approach to modeling relates to general ideas of access control. Departing from the traditional abstractness of discussions of formal models, the paper also relates this approach to the implementation of real systems by connecting the rule set of the model to the system operations of a UNIX System V system. This gives high confidence that a real system could clearly derive from the elements of the formal model instead of additionally depending on numerous design and policy decisions not addressed in the model. Neither are the trust policies left largely to the imagination of the reader-the rule base has detailed specifications of the mandatory access control policy of UNIX System V/IVILS, a version of the Clark-Wilson integrity policy, and two supporting policies that implement roles. A fundamental point established by the work reported in this article is that formal modeling can be moved considerably closer to implementation of real systems, a fact that has great beneficial impact on the possibility of building high assurance trusted systems.