U3.1 Access Control

U3.1 Access Control

1. Permit or deny user access to computer resources according to redefined security policy

   • Who/What (system/user) is allowed to read and write to system resources

2. Reference Monitor

   • Establishes validity of access requests
     • REFERENCE MONITOR > either grants or denies request
       • Subject tries an Access request >
       • System decision
       • Part of the OS. Its integrity is extremely Important

3. Subjects

   • Can be user or process
   • Will try gain access
   • May be represented by more than 1 principal

4. Objects

   • passive entity / resource in a computer system. IE:file / directory.

5. Principal

   • attribute or property associated with a subject
     • User ID, process running on behalf of the user
       • Subject may be represented by more than 1 principal

6. Unix has 3 Access Operations

   • read (r)
   • write (w)
     • does not include read
   • execute (e)
   • For file access meanings are clear
     • For directory access
       • read
         • list the contents of the directory
       • write
         • create or rename the files in the directory
       • execute
         • enter the directory.
     • For directory permissions are listed consecutivly in a row
       • IE drwxr-xr--
         • d indicates driectory, the next 3 are owners positions, following 3 groups permissions, remaining = everyone elses permissions

7. Bell-LaPladula

   • Assigns security labels
     • Policy that information may not flow downwards from a high level to a lower level entity
   • Observe mode
     • read / write
   • Alter mode
     • append / write

8. Access Operations - Interaction between a subject and an object that causes a flow of information

   • 4 Primitive Access Operations
     • Read
       • Can observe and object. Read only
     • Write
       • Able to read and write or alter/delete objects
         • Write includes read
     • Execute
       • Allows the subject to use the object without reading or writing
         • Subject runs a program, or access a crypto key
     • Append
       • Sometimes = blind write or write only. subject allowed to alter the object without observing contents