Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I need to design a state machine model to solve conflict of interest in computer security. [I know Chinese wall model but it is an information flow model]

Are there any such existing models?

Any reason as to why we cannot design it as a state machine model?

share|improve this question
    
Can you clarify what you are after here - is it a regulatory Segregation of Duties model or something else? And what do you mean by state machine in this context? Problems phrased as a "here is my problem, here is what I want to achieve, how can I do this" can get better answers than ones which leave people guessing... –  Rory Alsop Jan 31 '12 at 14:27

2 Answers 2

up vote 2 down vote accepted

Unless you mean something very specific by "state machine model", there is no reason why you couldn't model conflict of interest using a state machine. The Chinese Wall itself can be easily represented as a state-machine, following the traditional BLP approach:

  • a state is defined by the set of current accesses, a function associating each object to a company dataset, and a function associating each company dataset to a conflict-of-interest class.
  • The transition function takes a state and an access, and if the access request is not in conflict with a current access, it is added, otherwise the access is denied.

Ravi Sandhu actually proposed an enforcement of the Chinese Wall model using a lattice-based model, and some of my PhD work was to define some general state-machine model for access control systems, including the Chinese Wall. The section 3.2 of this paper can give you a formal definition of the CW using a state-machine.

I hope that helps, and I can bring more clarifications if wanted.

share|improve this answer

Is solving conflict of interest a computable problem? Can we even build a Turing Machine or another type of finite state machine to model somthing like human interest and emotion? Perhaps the CSTheoy Stack Exchange is a better platform for such a question.

Or perhaps State Machines and computablity is the wrong branch of mathmatics... My gut feeling is that Game Theory is a better tool for such a model.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.