Enhanced by Information Flow . . . Flow Channel . . . with Chain - of - Logic Assertion Dependencies

Boundary flow modeling (BFM) is a method of modeling information security constraints and behavior of a system element — the system, its subsystems, and its components — in terms of information flows associated with each element. The development of BFM has been motivated over a number of years by the need to model security attributes in a distributed system environment. The BFM approach is in contrast with state-oriented modeling. The feature of “state” cannot reasonably be associated with a distributed system. Within the BFM scheme, modeling is expressed in terms of relationships among information flows at interfaces appearing in the external boundaries of elements. The flow across an interface in a boundary is expressed as a history of the information entities that have flowed across the interface up to some point in time. These histories are the building blocks of BFM. As a whole, a BFM model of a system consists of relationships among sets of histories associated with each system element. Such relationships express the element’s security attributes. BFM also keeps track of dependency relationships among system elements nested (or layered) within a system. These relationships express logical dependencies among the security attributes of the elements. For example, asserted flow-modeled security constraints of lower-level components can be used to demonstrate logically that a higherlevel component meets its own security constraints. This in particular contributes to addressing the security composition problem. The BFM approach has been used for a number of distributed systems, including an internet gateway in its network context; a file system in the context of an operating system; a major weapon system; and a major modeling and simulation warfighter training system. As the development of BFM progressed, we began to focus on three areas of improvement: more sophisticated methods of relating flow histories; integration of flowbased models with state-based models; and tool support for BFM. This paper concludes by summarizing those areas of BFM