1.3
Page 3:
Access control is the ability to restrict or allow particular actions
Access control implements a security policy that specifies who or what may have access to each specific system resource
Page 4:
Authentication is the verification of user credentials
Authorization is the granting of permission to access a system resource
Audit is the review of system records and activities to ensure compliance with policies
Page 5:
Question: Do we always need both authentication and access control?
Access control policies dictate what types of access are permitted, under what circumstances, and by whom
Categories of access control policies include discretionary access control (DAC), mandatory access control (MAC), role-based access control (RBAC), and attribute-based access control (ABAC)
Page 6:
Subjects are entities capable of accessing objects (users and processes)
Objects are entities (resources) that are used (files, directories, memory)
Access rights describe the way in which a subject may access an object (read, write, execute, delete, create, search)
Page 8:
Access control matrices (ACMs) model access control in terms of state and state transitions
The state of a system is defined by a set of subjects, a set of objects, and an access control matrix
Access control matrices specify the access rights of subjects on objects
Page 11:
Advantages of access control matrices include fast determination of access control rights and a simple visual representation of access control relationships
Disadvantages of access control matrices include their large size and the need for a separate cell for each subject-object pair
Page 12:
Access Control Lists (ACLs) contain access control information from the viewpoint of an object
Capabilities correspond to the viewpoint of a subject and are presented to an object
Page 13:
Access Control Lists (ACLs) are lists of subjects authorized to access an object
Identity-based policies can be realized using ACLs
Maintenance and enforcement of ACLs are the responsibility of the systems and environment surrounding the object
Page 14:
Access control lists are used to protect owned objects
The owner can confer/invoke rights by adding, deleting, or modifying entries for users
Page 15:
Unix files have access control lists with entries for the owner, group, and other users
The type of access is represented by r (read), w (write), and x (execute)
Page 16:
Permissions in Unix can be represented as a permission string or a 3-digit octal number
Page 19:
Advantages of ACLs include their smaller size and the ability to store them directly with the object
Disadvantages of ACLs include the lack of an efficient way to enumerate all access rights for a given subject
Page 20:
Capabilities describe what a subject is capable of doing
Classical Capability System uses a triplet: <Object, Rights, Check>
Check is used for authentication, such as a message authentication code or digital signature
Capabilities are difficult to revoke
Page 21:
To obtain access, an access request and capability are transmitted to the appropriate server
Access decision is made by applying the function f to detect tampering
If the capability passes, access is granted
Page 22:
Objects: User A, File 1, File 3, File 2, File 4
Subjects: User A, User B, User C
User A owns File 1 and File 3
User A has read and write rights to File 1 and File 3
User B has read and write rights to File 1 and File 2
User C has read and write rights to File 1 and File 2
Page 23:
Advantages of capabilities:
Same advantage in space over the access control matrix as ACL
System administrator only needs to create and maintain access control relationships for subject-object pairs with nonempty access control rights
Makes it easy for an administrator to quickly determine all the access rights for any subject
Disadvantages of capabilities:
Not associated directly with objects
Need to search all the capabilities lists for all the subjects to determine all the access rights for an object
Page 24:
Sandhu & Samarati's authorization table is a more concise representation of the access control matrix
One row of the table is used for each allowed access triplet
The table can be sorted by Subject or Object to give equivalence to a capability list or an ACL, respectively
A relational database can easily implement an authorization table of this type
Page 25:
Same content as Page 24
Page 26:
Authorization table for files in Figure 4.2
Shows the access modes for each subject and object
Page 27:
Summary of access control structures: Subject, Object/Target, Access Control
Mentions capability, access control list, access control matrix, and security policy
Page 28:
Intermediate controls in access control: Group-based access control, Privileges, Role-based access control, Protection ring
Page 29:
Group-based access control:
Users are assigned to groups
Groups are given permissions to access objects
Each user has the permissions assigned to the group(s) they are a member of
Page 30:
Figure 5.6: Groups serve as an intermediate access control layer
All access permissions can be mediated through group membership
Page 31:
Negative permission is an entry in an access control structure that specifies the access operations a user is not allowed to perform
Conflict in policies associated with s1, requires a reference monitor policy to resolve
Page 32:
Privileges are intermediate between subjects and actions/operations
Privileges allow a subject to execute certain operations, usually related to system administration or network access
Page 33:
Example of role-based access in a banking environment
Different roles have different permissions, such as Teller, Branch Manager, Customer, System Administrator, Auditor
Page 34:
Permissions for each role in the banking environment example
Teller, Branch Manager, Customer, System Administrator, Auditor have different permissions
Page 35:
Role-based access control assigns access rights to roles instead of individual users
Users are assigned to different roles, and a single user may be assigned multiple roles
Page 36:
ACM for RBAC (Role-Based Access Control)
Shows the access control matrix representation of RBAC
Page 37:
RBAC implements the principle of least privilege
Each role contains the minimum set of access rights needed for that role
Multiple users assigned to the same role enjoy the same minimal set of access rights
Page 38:
Four models related to RBAC
Page 39:
RBAC1: Role hierarchies reflect the hierarchical structure of roles in an organization
Page 40:
RBAC2: Constraints include mutually exclusive roles, cardinality, and prerequisite roles
Page 41:
Protection rings: Each subject or object is assigned a number depending on its importance
Numbers are compared to make decisions about access control
Page 42:
Multilevel access control
Protection rings are a special case of multilevel.
The numbers are generalized into security labels.
Subjects and objects have these security labels assignment to them, possibly using the same name but generally with different meanings.
For subjects the labels correspond to clearances.
Think of every user having a clearance.
For objects the labels correspond to classifications or sensitivity.
The access relationship between security labels of the two types are governed by a series of rules.
Multilevel/multilayer models are also referred to as data flow models → This is somewhat restrictive.
Page 43:
Security labels
A Security label is a set of information security attributes bound to an object or a subject.
The most common use is in supporting multilevel access control policies.
When a subject makes an access request, a label is generated and attached to the request, by a trusted process.
Each object has a label bound to it, identifying it with a classification level.
To process a request, a security server in the object environment compares the request label with the object label and applies policy rules, such as the Bell-LaPadula rules, to decide whether to grant or deny access.
We will talk about this later.
Page 44:
Significance of labels in different domains
Labels generated in one security domain may or may not be significant in another domain.
Consider, for example, labels of identical format in two different organizations or in parts of a single organization.
Information classified as confidential in the first organization, or part thereof, should generally not be disclosed to the persons with confidential clearance in the other organization, or other part thereof.
Access control models taking into account “horizontal” structures are referred to as multi-lateral, more on this later.
Page 45:
Multilevel policies: An example
We need to describe whether a particular attempted action will be allowed as a function of the relevant labels, using policies.
Example:
Labels: Our sensitivity levels are Top secret Secret Confidential Unclassified
Policy: An object can only be accessed by a subject with a clearance level as high as the object classification.
This is somewhat vague … we will look at BLP very soon and this will be clarified.
Page 46:
Attribute-based Access Control (ABAC)
This is a relatively new approach to access control.
In this approach we can construct more complex authorisation statements based on attributes associated with subjects, objects, operations, and the environment.
It doesn’t have the subject focus on RBAC.
The flexibility is its upside, the performance cost, checks per access, its downside.
Page 47:
ABAC elements
Attributes: Defined for entities.
Policy Model: Defines the policies – so the rules and relationships for governing what’s allowed and what’s disallowed.
Architecture: This is the infrastructure used to manage requests, at the policy and enforcement levels, and carry out the interactions with the sources of attributes.
Page 48:
Type of ABAC Attributes
Attributes are characteristics defining specific aspects.
Subject attributes:
Define identity and characteristics of the subject.
Examples: Name, age, job title, roles, …
Object attributes:
As above but for an object.
Examples: File name, file title, creation date, …
Environment attributes:
Largely only lightly used.
Examples: Date, time, attacker activity,…
Page 49:
ABAC Logical Architecture Figure 4.10 in [SB18]
A subject requests to an object
The access control mechanism is governed by a set of rules (2a) that are defined by a preconfigured access control policy to determine authorization.
Allow/deny access.