Access Control

Access Control Example  Access Control Policy for son Edward Allowed access: House Disallowed access: Automobile 4/4/2019

Access Control Example Access Control Policy for son Edward Allowed access: House Disallowed access: Automobile 4/4/2019

 Access Control Example Access Control policy Allowed access: House: Disallowed access: Automobile Problem! Unauthorized access 4/4/2019

Access Control Example Access Control Policy for son Edward Allowed access: House Kitchen Disallowed access: Automobile Car key 4/4/2019

 Access Control Example Correct Access Control Policy for son Edward Allowed access: House Kitchen Disallowed access: Automobile Car key 4/4/2019

Access Control Protection objects: system resources for which protection is desirable Memory, file, directory, hardware resource, software resources, etc. Subjects: active entities requesting accesses to resources User, owner, program, etc. Access mode: type of access Read, write, execute 4/4/2019

Access Control Requirement Cannot be bypassed Enforce least-privilege and need-to-know restrictions Enforce organizational policy 4/4/2019

Access Control Access control: ensures that all direct accesses to object are authorized Protects against accidental and malicious threats by regulating the reading, writing and execution of data and programs Need: Proper user identification and authentication Information specifying the access rights is protected form modification 4/4/2019

Access Control Access control components: Access control policy: specifies the authorized accesses of a system Access control mechanism: implements and enforces the policy Separation of components allows to: Define access requirements independently from implementation Compare different policies Implement mechanisms that can enforce a wide range of policies 4/4/2019

Closed v.s. Open Systems Closed system Open System yes no no yes (minimum privilege) (maximum privilege) Access requ. Access requ. Allowed accesses Disallowed accesses Exists Rule? Exists Rule? yes no no yes Access permitted Access denied Access permitted Access denied 4/4/2019

Authorization Management Who can grant and revoke access rights? Centralized administration: security officer Decentralized administration: locally autonomous systems Hierarchical decentralization: security officer > departmental system administrator > Windows NT administrator Ownership based: owner of data may grant access to other to his/her data (possibly with grant option) Cooperative authorization: predefined groups of users or predefined number of users may access data 4/4/2019

Access Control Models All accesses Discretionary AC Mandatory AC Role-Based AC 4/4/2019

Discretionary Access Control Access control is based on User’s identity and Access control rules Most common administration: owner based Users can protect what they own Owner may grant access to others Owner may define the type of access given to others 4/4/2019

Access Matrix Model OBJECTS AND SUBJECTS File 1 File 2 S U B J E C T Read Write Own Joe Sam 4/4/2019

Implementation Access Control List (column) (ACL) File 1 File 2 Joe:Read Joe:Read Joe:Write Sam:Read Joe:Own Sam:Write Sam:Own Access Control List (column) (ACL) Capability List (row) Joe: File 1/Read, File 1/Write, File 1/Own, File 2/Read Sam: File 2/Read, File 2/Write, File 2/Own Subject Access Object Joe Read File 1 Joe Write File 1 Joe Own File 1 Joe Read File 2 Sam Read File 2 Sam Write File 2 Sam Own File 2 Access Control Triples 4/4/2019

ACL v.s. Capabilities ACL: Capabilities: Per object based Good for file systems Capabilities: Per subject based Good for environment with dynamic, short-lived subjects 4/4/2019

Access Control Conditions Data-dependent conditions: access constraints based on the value of the accessed data Time-dependent: access constraints based on the time of the data access Context-dependent: access constraints based on combinations on data which can be accessed History-dependent: access constraints based on previously accessed data 4/4/2019

Access Control Mechanisms Security through Views Stored Procedures Grant and Revoke Query modification 4/4/2019

Security Through Views Assign rights to access predefined views CREATE VIEW Outstanding-Student AS SELECT NAME, COURSE, GRADE FROM Student WHERE GRADE > B Problem: Difficult to maintain updates. 4/4/2019

Security Through Views Student relation NAME COURSE GRADE SEMESTER White CSCE 122 C+ Fall 2000 Black CSCE 313 A Brown CSCE 580 Spring 2000 Green CSCE 850 B+ Blue B 4/4/2019

Security Through Views CREATE VIEW Outstanding-Student AS SELECT NAME, COURSE, GRADE FROM Student WHERE GRADE > B Outstanding-Student NAME COURSE GRADE Black CSCE 313 A Brown CSCE 580 Green CSCE 850 B+ 4/4/2019

Security Through Views CREATE VIEW Fall-Student AS SELECT NAME, COURSE FROM Student WHERE SEMESTER=“Fall 2000” NAME COURSE White CSCE 122 Black CSCE 313 Green CSCE 850 Blue Fall-Student 4/4/2019

Stored Procedures Assign rights to execute compiled programs GRANT RUN ON <program> TO <user> Problem: Programs may access resources for which the user who runs the program does not have permission. 4/4/2019

Grant and Revoke GRANT <privilege> ON <relation> To <user> [WITH GRANT OPTION] ------------------------------------------------------------------------------------------------------------------------------------ GRANT SELECT * ON Student TO Matthews GRANT SELECT *, UPDATE(GRADE) ON Student TO FARKAS GRANT SELECT(NAME) ON Student TO Brown GRANT command applies to base relations as well as views 4/4/2019

Grant and Revoke REVOKE <privileges> [ON <relation>] FROM <user> ------------------------------------------------------------------------------------------------------------------------- REVOKE SELECT* ON Student FROM Blue REVOKE UPDATE ON Student FROM Black REVOKE SELECT(NAME) ON Student FROM Brown 4/4/2019

Non-cascading Revoke A B C D E F A revokes D’s privileges E B A F C 4/4/2019

Cascading Revoke A B C D E F A revokes D’s privileges B A C 4/4/2019

Positive and Negative Authorization B C E D + - Problem: Contradictory authorizations GRANT <privilege> ON X TO <user> DENY <privilege> ON X TO <user> 4/4/2019

Negative Authorization B C E D + - - Positive authorization granted By A to D becomes blocked but NOT deleted. 4/4/2019

Negative Authorization B C E D + - - + F What should happen with the privilege given by D To F? (Blocked but not deleted) 4/4/2019

Query Modification GRANT SELECT(NAME) ON Student TO Blue WHERE COURSE=“CSCE 590” Blue’s query: SELECT * FROM Student Modified query: SELECT NAME WHERE COURSE=“CSCE 580” 4/4/2019