Computer Security Access Control 5/8/2019

The Orange Book First published in 1983, the Department of Defense Trusted Computer System Evaluation Criteria, known as the Orange Book is the de facto standard for computer security today. The Orange Book, and others in the Rainbow Series, are still the benchmark for systems produced almost two decades later, and Orange Book classifications such as C2 provide a shorthand for the base level security features of modern operating systems. 5/8/2019

Access Control Terminology subject, object, reference monitor access request Access request Reference monitor Subject Object 5/8/2019

Access Control Terminology Authentication of statement s: . . answers the question: “who said s ? ” Authorization of object o: .. answers the question: “who is trusted to access o ?” Access request Reference monitor Subject s Object o 5/8/2019

Access Control We can specify What a subject is allowed to do Way may be done with an object 5/8/2019

Access Control Who is a subject? A principal, a user identity We might say that a subject `speaks for’ a principal 5/8/2019

Access Operations Access modes Observe  look at the contents of an object Alter  change the contents of an object 5/8/2019

Access Operations Access rights & attributes observe x x x x alter Bell-LaPadula security model Access rights execute append read write observe x x x x alter 5/8/2019

Access Operations Unix file directory read read from a file list directory contents write write to a file create or rename a file in a directory execute execute a (program) file search the directory Access rights specific to a file are changed by my modifying the file’s entry in its directory 5/8/2019

Access Operations Windows NT Permissions of Windows New Technology File System (NTFS) read write execute delete change permission change ownership 5/8/2019

Ownership The owner of a resource decrees who is allowed to access it. A system wide policy decrees who has access. 5/8/2019

Access Control Structures Now we must state which access operations are permitted. We do this by studying their structures. Let S be a set of subjects, O a set of objects, A a set of access operations 5/8/2019

Access Control Matrix Access rights are determined by a matrix M = (Mso)seS,oeO with Mso A The Bell-LaPadula model employs access contol matrices to model discretionary access policies of the Orange Book. 5/8/2019

Access Control Matrix An example bill.doc edit.exe fun.com Alice --- {execute} {execute, read} Bob {read,write} {execute} {execute,read,write} 5/8/2019

Access Control Matrix Access rights can be kept with the subjects or the objects. 5/8/2019

Access Control Matrix Capabilities If the access rights are kept with the subjects then these are the subject’s access rights. Every subject is given a capability. Alice’s capability: edit.exe: execute; fun.com: execute, read Bob’s capability: bill.doc: read, write; edit.exe: execute; fun.com: execute, read, write 5/8/2019

Access Control Matrix Access control lists (ACL) An ACL stores the access rights to an object with the object itself. ACLs are a typical feature of secure operating systems of the Orange Book class C2 ACL for bill.doc: Bob: read write ACL for edit.exe: Alice: execute; Bill: execute ACL for fun.com: Alice: execute, read; Bill: execute, read, write 5/8/2019

Access Control Matrix Access control lists (ACL) Management of access rights can be cumbersome. Therefore users are placed in groups, and derive access from a user’s group. 5/8/2019

Intermediate control Managing a security policy defined by an Access Control Matrix is a complex task in large systems. There are several means of simplifying this task. 5/8/2019

Group permissions s1 s2 s3 s4 s5 groups g1 g2 o3 o4 o5 o6 o1 o2 subjects groups g1 g2 o3 o4 o5 o6 o1 o2 objects 5/8/2019

Group and negative permissions subjects x x groups g1 g2 o3 o4 o5 o6 o1 o2 objects 5/8/2019

Privileges s1 s2 s3 s4 s5 subjects privileges pr1 pr2 operations op3 5/8/2019

Role Based Access Control Privileges come predefined with the OS Roles: a collection of procedures roles are assigned to users; a user can have many roles Procedures: high-level access control methods. Can only be applied to objects of certain data types. Datatypes: each object has a certain datatype and can only be accessed throuhg procedures defined for this datatype. 5/8/2019

Protection rings 0 operating system kernel operating system utilities user processors Each application is assigned a number 0,1,2,3… depending on its importance. 5/8/2019

Protection rings 0 operating system kernel operating system utilities user processors 3 2 1 0 5/8/2019

Protection rings Protection rings are mainly used for integrity protection An example is the QNX Neutrino microkernel OS * The Neutrino microkernel runs in ring 0 The Neutrino process runs in ring 1 All other programs run in ring 3 * A microkernel OS is structured as a tiny kernel that provides the minimal services used by a team of optional cooperating processes, which in turn provide the higher level OS functionality. 5/8/2019

Protection rings Unix employs a similar protection but uses only two levels 5/8/2019

The lattice OS Security levels The Mandatory Access Control (MAC) policies and the multi-level security policies of the Orange Book refer to security levels. top secret secret confidential unclassified This a linearly ordered set, a special case of a lattice. 5/8/2019

A lattice {a,b,c} {a,b} {a,c} {b,c} {a} {b} {c}  5/8/2019

A lattice A lattice (L, ) is a set with a partial ordering such that: For each pair of elements a,b of L there is a lub u in L and a glb v in L. 5/8/2019

An example Let H be a set of classifications with hierarchical ordering . Take a set of categories C, e.g. project names, company divisions, etc A compartment H is a set of categories, i.e. a subset of C. A security label (level) is a pair (h,c), where h in H is the security level and c in C is a compartment. 5/8/2019

An example The partial ordering is defined by: (h1,c1) (h2,c2) if and only if h1 h2 and c1 c2 5/8/2019

The VSTa operating system VSTa (Valencia's Simple Tasker) is an operating system with microkernel architecture. Abilities are defined as finite strings of positive integers separated by a dot, e.g.: .10.0.0.5 Abilities are ordered using a partial ordering: .3  .3.31  .3.1.100 but (⌐ .3.1 ≤ 3.2) Access is granted if the ability of a subject is a prefix of the object’s ability. The ability “.” defines a superuser. 5/8/2019