Access Control 1

Given Credit Where It Is Due Most of the lecture notes are based on slides by Dr. Daniel M. Zimmerman at CALTECH Some slides are from Prof. Kenneth Chiu at SUNY Binghamton I have modified them and added new slides 2

3 Access Control Once a client and a server have established a secure channel, the client can issue requests to the server Requests can only be carried out if the client has sufficient access rights The verification of access rights is access control, and the granting of access rights is authorization These two terms are often used interchangeably

4 The Basic Model for Access Control This model is generally used to help understand the various issues involved in access control The subject issues requests to access the object, and protection is enforced by a reference monitor that knows which subjects are allowed to issue which requests

5 Access Control Matrix The access control matrix is a matrix with each subject represented by a row, and each object represented by a column The entry M[s, o] lists the operations that subject s may carry out on object o Of course, we don’t really want to implement it as a matrix in any system of reasonable size, because there would be a whole lot of wasted space… ?

6 Access Control Matrix There are two main approaches that are used instead of an actual matrix: Each object can maintain a list, the access control list, of the access rights of subjects that want to access that object - this effectively distributes the matrix column- wise, leaving out empty entries Each subject can maintain a list of capabilities for each object - this effectively distributes the matrix row-wise, leaving out empty entries Of course, capabilities can’t be totally maintained by the subjects - they must be given to the subjects by some other trusted entity (like the reference monitor)

7 Access Control Lists vs. Capabilities

Access Matrix

Access Control List

Capability Lists

11 Protection Domains ACLs and capabilities help to efficiently implement the access control matrix, but can still become quite cumbersome A protection domain is a set of (object, access rights) pairs, where each pair specifies for a given object exactly what operations can be carried out By associating a protection domain with each request, we can cut down on redundant information in access control lists

12 Protection Domains One approach to using protection domains is to construct groups of users Another approach is to use roles instead of groups Roles: head of a department, manager of a project, member of a personnel search committee