Access Control
Access Control Example • Access Control Policy for son Edward • Allowed access: • House • Disallowed access: • Automobile
Access Control Example • Access Control Policy for son Edward • Allowed access: • House • Disallowed access: • Automobile
Access Control Example • Access Control policy • Allowed access: • House: • Disallowed access: • Automobile Problem! Unauthorized access
Access Control Example • Access Control Policy for son Edward • Allowed access: • House • Kitchen • Disallowed access: • Automobile • Car key
Access Control Example • Correct Access Control Policy for son Edward • Allowed access: • House • Kitchen • Disallowed access: • Automobile • Car key
Access Control • Protection objects: system resources for which protection is desirable • Memory, file, directory, hardware resource, software resources, etc. • Subjects: active entities requesting accesses to resources • User, owner, program, etc. • Access mode: type of access • Read, write, execute
Access Control Requirement • Cannot be bypassed • Enforce least-privilege and need-to-know restrictions • Enforce organizational policy
Access Control • Access control: ensures that all direct accesses to object are authorized • Protects against accidental and malicious threats by regulating the reading, writing and execution of data and programs • Need: • Proper user identification and authentication • Information specifying the access rights is protected form modification
Access Control • Access control components: • Access control policy: specifies the authorized accesses of a system • Access control mechanism: implements and enforces the policy • Separation of components allows to: • Define access requirements independently from implementation • Compare different policies • Implement mechanisms that can enforce a wide range of policies
Closed v.s. Open Systems Closed system Open System (minimum privilege) (maximum privilege) Access requ. Access requ. Allowed accesses Disallowed accesses Exists Rule? Exists Rule? yes no no yes Access permitted Access denied Access permitted Access denied
Authorization Management • Who can grant and revoke access rights? • Centralized administration: security officer • Decentralized administration: locally autonomous systems • Hierarchical decentralization: security officer > departmental system administrator > Windows NT administrator • Ownership based: owner of data may grant access to other to his/her data (possibly with grant option) • Cooperative authorization: predefined groups of users or predefined number of users may access data
Access Control Models All accesses Discretionary AC Mandatory AC Role-Based AC
Discretionary Access Control • Access control is based on • User’s identity and • Access control rules • Most common administration: owner based • Users can protect what they own • Owner may grant access to others • Owner may define the type of access given to others
Access Matrix Model OBJECTS AND SUBJECTS File 1 File 2 S U B J E C T S Joe Sam
Implementation File 1 File 2 Joe:Read Joe:Read Joe:Write Sam:Read Joe:Own Sam:Write Sam:Own Access Control List (column) (ACL) Capability List (row) Joe: File 1/Read, File 1/Write, File 1/Own, File 2/Read Sam: File 2/Read, File 2/Write, File 2/Own Subject Access Object Joe Read File 1 Joe Write File 1 Joe Own File 1 Joe Read File 2 Sam Read File 2 Sam Write File 2 Sam Own File 2 Access Control Triples
ACL v.s. Capabilities • ACL: • Per object based • Good for file systems • Capabilities: • Per subject based • Good for environment with dynamic, short-lived subjects
Access Control Conditions • Data-dependent conditions: access constraints based on the value of the accessed data • Time-dependent: access constraints based on the time of the data access • Context-dependent: access constraints based on combinations on data which can be accessed • History-dependent: access constraints based on previously accessed data
Access Control Mechanisms • Security through Views • Stored Procedures • Grant and Revoke • Query modification
Security Through Views • Assign rights to access predefined views CREATE VIEW Outstanding-Student AS SELECT NAME, COURSE, GRADE FROM Student WHERE GRADE > B Problem: Difficult to maintain updates.
Security Through Views Studentrelation
Security Through Views CREATE VIEW Outstanding-Student AS SELECT NAME, COURSE, GRADE FROM Student WHERE GRADE > B Outstanding-Student
Security Through Views CREATE VIEW Fall-Student AS SELECT NAME, COURSE FROM Student WHERE SEMESTER=“Fall 2000” Fall-Student
Stored Procedures • Assign rights to execute compiled programs • GRANT RUN ON <program> TO <user> Problem: Programs may access resources for which the user who runs the program does not have permission.
Grant and Revoke GRANT <privilege> ON <relation> To <user> [WITH GRANT OPTION] ------------------------------------------------------------------------------------------------------------------------------------ • GRANT SELECT * ON Student TO Matthews • GRANT SELECT *, UPDATE(GRADE) ON Student TO FARKAS • GRANT SELECT(NAME) ON Student TO Brown GRANT command applies to base relations as well as views
Grant and Revoke REVOKE <privileges> [ON <relation>] FROM <user> ------------------------------------------------------------------------------------------------------------------------- • REVOKE SELECT* ON Student FROM Blue • REVOKE UPDATE ON Student FROM Black • REVOKE SELECT(NAME) ON Student FROM Brown
B E A D C F Non-cascading Revoke A revokes D’s privileges E B A F C
B E A D C F Cascading Revoke A revokes D’s privileges B A C
- B E + + D A - C Positive and Negative Authorization • Problem: • Contradictory authorizations • GRANT <privilege> ON X TO <user> • DENY <privilege> ON X TO <user>
- B E + + D A - C Negative Authorization - Positive authorization granted By A to D becomes blocked but NOT deleted.
- B E + + D A - C Negative Authorization - + F What should happen with the privilege given by D To F? (Blocked but not deleted)
Query Modification • GRANT SELECT(NAME) ON Student TO Blue WHERE COURSE=“CSCE 590” • Blue’s query: SELECT * FROM Student • Modified query: SELECT NAME FROM Student WHERE COURSE=“CSCE 580”
