Denning's lattice model

Denning's lattice model
Name	Denning's lattice model
Introduced	1976
Field	Computer security
Proponents	Dorothy E. Denning
Related	Lattice-based access control, Bell–LaPadula model, Biba model

Denning's lattice model is a formal framework for specifying and enforcing access control in computer security systems that uses mathematical lattices to represent dominance relations among security labels, enabling formal reasoning about confidentiality, integrity, and information flow in systems designed by researchers such as Dorothy E. Denning, influenced by work from Dorothy Denning and contemporaries in the 1970s and 1980s. The model provided a rigorous foundation for coupling access rights with label algebra, informing subsequent standards and models explored in contexts involving institutions like RAND Corporation, MIT, NSA, and projects influenced by policies from Department of Defense.

History and motivation

Denning's lattice model emerged from efforts in the 1970s to improve formal guarantees for information flow after incidents prompting reviews at organizations like National Research Council, with intellectual roots in lattice theory from mathematicians like Garrett Birkhoff and applications in early secure operating system work at MIT and Stanford Research Institute. The model was motivated by security concerns raised by publications and policies such as the Orange Book and formal analyses by researchers connected to Bell Labs, CMU, and RAND Corporation. Denning and colleagues sought to reconcile military-style confidentiality models exemplified by Bell–LaPadula model and integrity-focused approaches like the Biba model within a unified algebraic structure that could be reasoned about using lattice-theoretic tools traced to work by Richard Dedekind and Emil Artin.

Formal definition

Denning's lattice model defines a set of security labels drawn from a lattice (L, ≤) where elements represent clearance and sensitivity pairs analogous to labels used in systems at NSA and in policies proposed by Department of Defense committees; the lattice order expresses dominance relations similar to orders considered in studies at MITRE Corporation. The core formal objects include a set of subjects S and objects O, a labeling function λ: S ∪ O → L, and an access relation A ⊆ S × O × R where R is a set of rights discussed in literature from IEEE and ACM conferences; permitted accesses satisfy algebraic constraints derived from lattice meet (⊓) and join (⊔) operations studied in works that reference Birkhoff and Noether. Denning framed safe information flow by expressing access and transformation rules in terms of least upper bounds and greatest lower bounds, drawing on algebraic approaches used by researchers at University of California, Berkeley and formal methods communities associated with Cornell University.

Security properties and policies

The model captures confidentiality and integrity policies by mapping classic security properties studied by David Bell and L. LaPadula into lattice constraints that ensure noninterference guarantees comparable to formalizations in work by Joseph Goguen and Jose Meseguer; enforcement is expressed as monotonicity conditions under lattice order that prevent illicit flows similar to constraints in multilevel security frameworks used at NSA testbeds. Policies express permissible flows via lattice-computable dominance, enabling specification of discretionary and mandatory access controls as debated in reports by NIST and implemented in systems influenced by Multics and SELinux design discussions. Denning's formalization influenced policy languages considered at IETF and standards committees, and it provided a basis for proving that particular enforcement mechanisms satisfy confidentiality or integrity properties akin to those analyzed in verification efforts at Carnegie Mellon University.

Examples and applications

Common examples map security classifications used in United States Department of Defense documents (e.g., Top Secret, Secret, Confidential) and compartments like Sensitive Compartmented Information to lattice elements with dominance relations analogous to those studied in models at NSA laboratories. Applications include design and analysis of secure file systems in projects at Bell Labs and access control systems in UNIX variants and Windows enterprise configurations, where label algebra guides enforcement in prototypes and production systems at IBM and Hewlett-Packard. Academic case studies from Stanford University and UC Berkeley applied lattice-based reasoning to distributed systems, databases in projects at Oracle Corporation, and information-flow control in programming languages researched at Princeton University and ETH Zurich.

Extensions and variations

Researchers extended Denning's lattice model to support decentralized label models explored at MIT and Cornell University, to incorporate declassification mechanisms investigated in literature from Microsoft Research and Google, and to combine confidentiality and integrity via product lattices as used in hybrid approaches described by teams at SRI International. Variants include label algebras for role-based access control inspired by work at NIST and temporal extensions studied in real-time systems research at NASA and DARPA projects. Formal refinement and type-system-based enforcement of lattice policies appeared in programming-language research at Carnegie Mellon University and University of Cambridge, and probabilistic information-flow adaptations were explored in collaborations involving EPFL and ETH Zurich.

Limitations and critiques

Critiques note that the model's abstraction can be difficult to map to organizational practices observed in case studies by Harvard University and Yale University, and that lattice granularity and label management scale issues were reported in deployments at NSA and in enterprise settings at Microsoft and IBM. Practical critiques from industry panels at ACM conferences emphasize challenges integrating lattice enforcement with legacy access-control mechanisms in systems from Oracle Corporation and Cisco Systems, and academic critics from Stanford University argue that the model's deterministic flow assumptions do not readily capture covert channels studied in work by Peter Denning and others at SRI International.

Category:Computer security models