November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-1 Chapter 2: Access Control Matrix Overview Access Control Matrix Model Protection State Transitions –Commands –Conditional Commands

November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-2 Overview Protection state of system –Describes current settings, values of system relevant to protection Access control matrix –Describes protection state precisely –Matrix describing rights of subjects –State transitions change elements of matrix

November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-3 Description objects (entities) subjects s1s2…sns1s2…sn o 1 … o m s 1 … s n Subjects S = { s 1,…,s n } Objects O = { o 1,…,o m } Rights R = { r 1,…,r k } Entries A[s i, o j ]   R A[s i, o j ] = { r x, …, r y } means subject s i has rights r x, …, r y over object o j

November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-4 Example 1 Processes p, q Files f, g Rights r, w, x, a, o fgpq prworrwxow qarorrwxo

November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-5 Example 2 Procedures inc_ctr, dec_ctr, manage Variable counter Rights +, –, call counterinc_ctrdec_ctrmanage inc_ctr+ dec_ctr– managecallcallcall

Important Points Access Control Matrix can be used as a model of the static access permissions in any type of access control system. It does not model the rules by which permissions can change in any particular system, and therefore only gives an incomplete description of the system's access control security policy. November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-6

November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-7 State Transitions Change the protection state of system |– represents transition –X i |–  X i+1 : command  moves system from state X i to X i+1 –X i |– * X i+1 : a sequence of commands moves system from state X i to X i+1 Commands often called transformation procedures

November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-8 Primitive Operations create subject s; create object o –Creates new row, column in ACM; creates new column in ACM destroy subject s; destroy object o –Deletes row, column from ACM; deletes column from ACM enter r into A[s, o] –Adds r rights for subject s over object o delete r from A[s, o] –Removes r rights from subject s over object o

November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-9 Creating File Process p creates file f with r and w permission command createfile(p, f) create object f; enter own into A[p, f]; enter r into A[p, f]; enter w into A[p, f]; end

November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-10 Mono-Operational Commands Make process p the owner of file g command makeowner(p, g) enter own into A[p, g]; end Mono-operational command –Single primitive operation in this command

November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-11 Conditional Commands Let p give q r rights over f, if p owns f command grantreadfile1(p, f, q) if own in A[p, f] then enter r into A[q, f]; end Mono-conditional command –Single condition in this command

November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-12 Multiple Conditions Let p give q r and w rights over f, if p owns f and p has c rights over q command grantreadfile2(p, f, q) if own in A[p, f] and c in A[p, q] then enter r into A[q, f]; enter w into A[q, f]; end

November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-13 Key Points Access control matrix simplest abstraction mechanism for representing protection state Transitions alter protection state 6 primitive operations alter matrix –Transitions can be expressed as commands composed of these operations and, possibly, conditions

Key Points An Access Control Matrix should be thought of only as an abstract model of permissions at a given point in time November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-14

Key Points An implementation of it as a two- dimensional array would have excessive memory requirements. Capability-based security and access control lists are categories of concrete access control mechanisms whose static permissions can be modeled using Access Control Matrices. November 1, 2004Introduction to Computer Security © 2004 Matt Bishop Slide #2-15