METHOD AND APPARATUS FOR VERIFICATION OF INFORMATION ACCESS IN ICT SYSTEMS HAVING MULTIPLE SECURITY DIMENSIONS AND MULTIPLE SECURITY LEVELS

摘要

We describe a model for multilevel information security. Information security is defined as combinations of confidentiality, integrity and availability. These three aspects are regarded as properties of a generic information object, and are treated as mutually independent. Each aspect is represented by an axis in an n-dimensional vector space, where n is the number of independent security aspects of interest. The model can ensure directed information flow along an arbitrary number of axes simultaneously. An information object is assigned a security label denoting the security level along an arbitrary number of axes. The model is role based. A role is assigned an access label along the same axes. Verification of a role's access to information is performed by comparing access label with security label. Since the aspects represented by each axis are mutually independent, each axis may be treated by itself. This enables a very efficient algorithm for verification of access. The model will therefore be suited for systems having low processing capacity. Based on this model, we describe a method and an apparatus to ensure confidentiality, integrity and availability for information from peripheral equipment in communications networks. Such peripheral equipment may be, but is not limited to personal terminals for rescue personnel, soldiers etc, sensors (detectors) for smoke, gases, motion, intrusion etc. The invention supports decision support systems in that the information has known confidentiality, integrity and availability even from inexpensive sensors, which do not include a processor or the like. The invention differs from prior art in that it, among other features: —Treats an arbitrary number of mutually independent aspects of information security, —Assumes that confidentiality, integrity and availability are mutually independent variables, —On this basis can verify access to information by means of simple binary operations, by a simple logic gate circuit or by a processor.