Design of a state machine model to solve conflict of interest in Computer Security

Question

I need to design a state machine model to solve conflict of interest in computer security. [I know Chinese wall model but it is an information flow model]

Are there any such existing models?

Any reason as to why we cannot design it as a state machine model?

Answer 1

Unless you mean something very specific by "state machine model", there is no reason why you couldn't model conflict of interest using a state machine. The Chinese Wall itself can be easily represented as a state-machine, following the traditional BLP approach:

• a state is defined by the set of current accesses, a function associating each object to a company dataset, and a function associating each company dataset to a conflict-of-interest class.
• The transition function takes a state and an access, and if the access request is not in conflict with a current access, it is added, otherwise the access is denied.

Ravi Sandhu actually proposed an enforcement of the Chinese Wall model using a lattice-based model, and some of my PhD work was to define some general state-machine model for access control systems, including the Chinese Wall. The section 3.2 of this paper can give you a formal definition of the CW using a state-machine.

I hope that helps, and I can bring more clarifications if wanted.

Answer 2

Is solving conflict of interest a computable problem? Can we even build a Turing Machine or another type of finite state machine to model somthing like human interest and emotion? Perhaps the CSTheoy Stack Exchange is a better platform for such a question.

Or perhaps State Machines and computablity is the wrong branch of mathmatics... My gut feeling is that Game Theory is a better tool for such a model.