Decentralized Label Model

The Decentralized Label Model (DLM) is an influential model of information flow that allows users of a system to express their own security policies in a dencentralized fashion, while assuming mutual distrust. Finally, the DLM allows users to selectively declassify their data at will.

The DLM was proposed by Andrew Myers and Barbara Liskov in the late 1990s. See Myers and Liskov 1998 for its formal semantics, and Myers and Liskov 2000 for a high-level discussion of the model.

Description

Principals

To begin, the DLM assumes a set of principals. These could be users (e.g. bob), groups (e.g. manager) or roles (e.g. doctor). There is an acts for relation, where p \geq q if principal p can act in the name of principal q. This can encode membership in groups, assigned roles, etc.

Labels

The DLM model assumes that programs run on a trusted execution platform. That is: each program, even if untrusted, must have gone through a static checker verifying that it does not violate the security policies expressed in annotations called labels.

Labels in the DLM consist of a set of policies. Each policy consists of an owner, and a set of readers. Both the owners and the readers are principals of the system.

An example label is

	L = \{ o_1 : r_1, r_2 ; o_2 : r_2, r_3 \}

A datum or program marked by L has two owners (o_1 and o_2), each of which specifies a set of readers (o_1 specifies that r_1 and r_2 may read, whereas o_2 specifies that r_2 and r_3 may read).

A resource marked with L may be read if all owners agree that a principal can read it. In this case only r_2 can read the resource. Thus, if an owner were to add a new reader to their component of L, that could declassify previously confidential data.

Relabelling

To preserve confidentiality, data can flow only towards more restrictive labels. Thus, if we have - say - a variable and a value, then we can assign that value to the variable only when the label of the variable is more restrictive than the label of the value. This causes incremental relabelling.

There are four safe ways to relabel:

• removing a reader
• adding a policy
• adding a reader r' with r' \geq r for an existing reader r
• replacing an owner o by o' with o' \geq o

Owners: decentralized declassification

While the notion of readers is well-known and well-understood (even from the days of Bell and LaPadula, the DLM's innovation is the inclusion of the notion of owner.

Each resource has one or more owners. These owners are able to change labels by adding readers under their name, thereby declassifying that resource. Previous models of information flow only allowed declassification when performed by a 'root' user. Because there are multiple owners, a single one cannot arbitrarily declassify data without consent from everyone else. Thus, the DLM allows a decentralized approach to declassification.

References

• The formal semantics of the DLM were presented at Oakland 1998:

@inproceedings{myers_1998,
	title = {Complete, safe information flow with decentralized labels},
	doi = {10.1109/SECPRI.1998.674834},
	booktitle = {Proceedings. 1998 {IEEE} {Symposium} on {Security} and {Privacy} ({Cat}. {No}.{98CB36186})},
	publisher = {IEEE},
	author = {Myers, A.C. and Liskov, B.},
	year = {1998},
	pages = {186--197}
}

• The model is also described in a ACM TSEM journal paper from 2000:

@article{myers_protecting_2000,
	title = {Protecting privacy using the decentralized label model},
	volume = {9},
	doi = {10.1145/363516.363526},
	number = {4},
	journal = {ACM Transactions on Software Engineering and Methodology},
	author = {Myers, Andrew C. and Liskov, Barbara},
	year = {2000},
	pages = {410--442}
}