Access Control

Access Control

1. Authentication and Authorisation

   • Subject/Principal
     • Principal
       • A name associated with a subject
       • An entity that can be granted access to objects or can make statements affecting access control decisions
       • eg user identity in an OS
     • Subject
       • Operates on behalf of principal
       • process running under a user identity
       • when discussing operational systems for enforcing policies
   • Object
     • Being accessed
     • files/resources
     • Not a clear disitnction between subject/ object
   • Reference Monitor
     • the mechanism that grants or denies access
   • Principal -> Operation -> Reference Monitor -> Object
   • Subjects and objects merely distinguish between the active/passive party in an access request

2. Access Control

   • Authentication
     • Who requested access
   • Authorisation
     • Who is allowed access

3. Focus of control

   • What a subject is allowed to do
   • What may be done with an object

4. Access Operations

   • Reading/writing data
   • Access nodes
     • Observe - subject may look at contents of object
     • Modify - subject may change contents of an object

5. Bell - LaPadula

   • Map every state of an object and transition between states
   • Control transitions
   • Simple security property - no read up
     • subject can not read an object at a higher sensitivity level
   • Star (*) security property -no write down
     • Prevents the copying of classified data into an unclassified document
   • Discretionary access control
     • who can access what data at what time
     • May have top secret clearance for somethings and only classified clearance for others

6. Rights vs attributes

   • access rights
     • Bell-lapadula model
       • execute, read, append, write
       • Operate on files only
   • Access attributes
     • Multics os - time sharing operating system
     • distinguishes between data and directory access attributes
     • write = append in bell-lapadula

7. Ownership

   • Owner can be defined for each resource
   • owner decides who gets access (discretionary policy)
   • or a system wide policy ( mandatory policy)
   • Most OS's support ownership

8. Access control stuctures

   • way to check that access control policies are captured correctly
   • Access Control Matrix
     • access rights defined individually for each combination of subject and object
       • in unix what you can r + w etc
   • Capabilities
     • unforgeable token specify subjects access rights
       • Corresponds to a row in an access control matrix
     • associated with discretionary
     • not widely used - difficult to get overview of permissions of an object
   • Access Control Lists
     • access rights to an object stored with the object itself
     • complex in large systems
     • tedious/error prone
     • List of conditions of type of traffic allowed in your network travelling across your router

9. Windows security mechanism case

   • users can be whitelisted or blacklisted
   • security policy is set for groups as opposed to the whole system
   • group policy overrides individual profiles
   • group policy can be associated with sites/ domains /organisational units
     • groups defined in an 'Active Dictionary'
       • An object oriented database organising users, groups, machines and organisational units within a domain in a hierarchal database
         • Indexed - so can be searched
   • http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c04.pdf
   • People use the TLS for capabilities here
     • Transport Layer Security
   • Policies created using standard tools or custom code
   • Only admins can download stuff - so users dont download malware
   • Makes it so that code downloaded off the internet should not be able to modify high integrity data - such as system files
   • Problem - many applications expect to run as root so they can mess with registry settings
     • Solved with virtualisation - short term fix, dont modify real registry, just a version of it that they can see
   • basically - everything no longer runs as root
   • Provides richer and more flexible set of access controls than any other system
   • Many people may just click away the UAC - user access control asking for admin box - so just wont work