Ring Policy

The ring policy $[196]$ ignores the issue of indirect modification and focuses on direct modification only. This solves the problems described above. The rules are as follows:

Any subject may read any object, regardless of integrity levels.

s in S can write to o in O if and only if i$($o$)<=$ i$($s$).$

s$1$ in S can execute s$2$ in S if and only if i$($s$2)<=$ i$($s$1).$

The difference between this policy and the low$-$water$-$mark policy is simply that any subject can read any object.

Theorem $6\mathrm{.}1.[196]$ If there is an information transfer path from object o$1$ in O to object on$+1$ in O$,$ then enforcement of the low$-$water$-$mark policy requires that i$($on$+1)<=$ i$($o$1)$ for all n $>1.$

Proof If an information transfer path exists between o$1$ and on$+1,$ then Definition $61$ gives a sequence of subjects and objects identifying the entities on the path. Without loss of generality, assume that each read and write was performed in the order of the indices of the vertices. By induction, for any $1<=$ k $<=$ n$,$ i$($sk$)=$ min$\{$i$($oj$)|1<=$ j $<=$ k$\}$ after k reads. As the nth write succeeds, by rule $1,$ i$($on$+1)<=$ i$($sn$).$ Thus, by transitivity, i$($on$+1)<=$ i$($o$1).$

This policy prevents direct modifications that would lower integrity labels. It also prevents indirect modification by lowering the integrity label of a subject that reads from an object with a lower integrity level.

The problem with this policy is that, in practice, the subjects change integrity levels. In particular, the level of a subject is nonincreasing, which means that it will soon be unable to access objects at a high integrity level. An alternative policy is to decrease object integrity levels rather than subject integrity levels, but this policy has the property of downgrading object integrity levels to the lowest level.

now with this information Prove or disprove: Theorem $61$ holds for Biba$$s ring policy $($described in Section $6\mathrm{.}2\mathrm{.}2).$