polysec/examples/polysec-auth/security.json at main · cognitive-fab/polysec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
{
  "//": "PolySec security manifest for the auth machine (UC-3) — the MEDIATED partition. Per docs/polysec-spec.md §4.2. Two forbidden regions: no privileged action pre-auth, and the handshake-precedes-appData ordering.",
  "projection": [
    "handshake",
    "authenticated",
    "appData",
    "privileged",
    "peerClosed"
  ],
  "protected": [
    "handshake",
    "authenticated",
    "appData",
    "privileged"
  ],
  "adversarial": [
    "peerClosed"
  ],
  "sensor": "peerClosed",
  "domains": {
    "peerClosed": [
      false,
      true
    ],
    "privileged": [
      false,
      true
    ]
  },
  "forbiddenRegions": [
    {
      "name": "no-privileged-pre-auth",
      "predicate": "privileged && !authenticated"
    },
    {
      "name": "handshake-precedes-appdata",
      "predicate": "appData && !handshake"
    }
  ],
  "gates": [
    "COMPLETE_HANDSHAKE",
    "AUTHENTICATE"
  ],
  "taint": {
    "sources": [
      "AUTHENTICATE"
    ],
    "sinks": [
      "DO_PRIVILEGED"
    ]
  },
  "recovery": {
    "//": "Recovery here is RESTORATION, not containment — TEARDOWN returns to the pristine unauthenticated start (§2 UC-3: no external damage, so it is genuinely reversible).",
    "desiredStates": "!handshake && !authenticated && !appData && !privileged",
    "correctiveNaps": [
      "TEARDOWN"
    ]
  },
  "alarm": {
    "no-privileged-pre-auth": "possible",
    "handshake-precedes-appdata": "possible"
  }
}