clark-wilson_model.md

Clark-Wilson Model

The Clark-Wilson model is a security framework designed to ensure that computer systems process transactions securely and maintain data integrity. It revolves around two main concepts:

1. Constrained Data Items (CDIs): These are sensitive data elements that must be protected to ensure they remain accurate and reliable. The model ensures that CDIs can only be modified through specific, authorized procedures.
2. Transformation Procedures (TPs): These are the only processes that can change CDIs. Each TP must be certified to meet certain integrity conditions, ensuring they only manipulate data in allowed ways.

In practical terms, the model requires users to be authenticated before accessing the system and ensures they have permission to execute TPs. It monitors and logs all transactions, both successful and those denied due to integrity issues or unauthorized access attempts. This framework is particularly useful in environments requiring strict audit capabilities and rigorous data integrity, such as financial and critical information systems.

UML Activity Diagram

PlantUML Code for the Diagram

@startuml
start

:User Requests to Write Data;

:Authenticate User;

:Check if User has Permission to Execute TP;
if (Yes) then (User has Permission)
  :Execute Transformation Procedure (TP);

  :Is the Data a CDI or UDI?;
  if (CDI) then (Data is a CDI)
    :Verify CDI Integrity (IVPs);
    if (Integrity Maintained) then (Integrity Maintained)
      :Write CDI and Update;
      :Log Successful Write (CDI);
      end
    else (Integrity Not Maintained)
      :Deny Write Request;
      :Log Integrity Violation;
      end
    endif
  else (Data is a UDI)
    :Write UDI and Update;
    :Log Successful Write (UDI);
    end
  endif
else (User has No Permission)
  :Deny Write Request;
  :Log Denied Request;
  end
endif
@enduml