Access Control Mechanisms Week 6 1 CEN-5079: 7.March.2019 Why - PowerPoint PPT Presentation

Access Control Mechanisms Week 6 1 CEN-5079: 7.March.2019

Why Access Control  Following authentication, we need to decide what the subject can access 1 Read F 1’ OK 2 Bob Write to F Alice 2’ F NO ! 3 Execute G G 3’ OK  How do we store this information? 2 CEN-5079: 7.March.2019

In this lecture …  Access matrix model  Access control lists versus Capabilities  Role Based Access Control  File Protection Mechanisms  Security Policies  Models of Security  Some exercises 3 CEN-5079: 7.March.2019

Access Matrix Model (Lampson 1971) Objects (and Subjects) G F r w x S S S r A u u u b b b j j j e e e r w x c c c rights B t t t s s s 4 CEN-5079: 7.March.2019

Basic Abstractions  Subjects  Objects  Rights  The rights in a cell specify the access of the subject (row) to the object (column) 5 CEN-5079: 7.March.2019

Users and Subjects  A subject is a program (application) executing on behalf of a user  A user may at any time be idle, or have one or more subjects executing on her behalf 6 CEN-5079: 7.March.2019

Users and Subjects: Example Mail Application Word Processors Spreadsheet Bob.SECRET Database App USERS SUBJECTS 7 CEN-5079: 7.March.2019

Objects  Anything on which a subject can perform operations (mediated by rights)  Usually objects are passive, for example:  File  Directory (or Folder)  Memory segment  But, objects can also be subjects with operations  kill  suspend  resume 8 CEN-5079: 7.March.2019

Access Matrix Model Objects (and Subjects) G F r w x S S S r A u u u b b b j j j e e e r w x c c c rights B t t t s s s 9 CEN-5079: 7.March.2019

Access Matrix Implementation  Access Matrix can be sparse  Space inefficient  Access Control Lists  Capabilities  Relations 10 CEN-5079: 7.March.2019

Access Control List - ACL  Maintained for each object (or subject)  No entries when no permissions G: ACL A B B B r r w x Each column of the access matrix is stored with the object corresponding to that column 11 CEN-5079: 7.March.2019

Capability  Unforgeable token that gives possesor certain rights  Object to which access is permitted  Right for the object Capability giving the right to r F read object F  How to make it unforgeable 1. Only OS can access capability – user gets a pointer 2. Signed capabilities – access control mechanism has key 12 CEN-5079: 7.March.2019

Transfer Capability  One access right – transfer/propagate  Subject can pass copy of capability to others Capability giving the right to t F transfer capabilities for object F Carol can no longer transfer ! transfer transfer Carol Alice Bob r t t r r F F F F F 13 CEN-5079: 7.March.2019

Capability List: C-List r F F w x G r F Alice Each row of the access matrix is stored with the subject corresponding to that row 14 CEN-5079: 7.March.2019

Access Control Relations Subject Access Object A r F A w F A x F A r G B r G B w G B x G Commonly used in relational database management systems 15 CEN-5079: 7.March.2019

In this lecture …  Access matrix model  Access control lists versus Capabilities  Role Based Access Control  File Protection Mechanisms  Security Policies  Models of Security  Some exercises 16 CEN-5079: 7.March.2019

ACLs vs. Capabilities  ACL's require authentication of subjects  Capabilities do not require authentication of subjects, but do require  Unforgeability  Control of propagation of capabilities 17 CEN-5079: 7.March.2019

ACLs vs. Capabilities: Access Review  ACL's provide for superior access review on a per-object basis  Who has access to this object  But hard to see to what a subject has access  How would you do that ?  Capabilities provide for superior access review on a per-subject basis  What capabilities does this subject have  But hard to see who has access to an object 18 CEN-5079: 7.March.2019

ACLs vs. Capabilities: Revocation  How do you revoke access of a subject to an object  ACL's provide for superior revocation facilities on a per-object basis 1. Scan object’s ACL 2. Remove subject from list (if present)  But hard to revoke all rights of a subject  Capabilities provide for superior revocation facilities on a per-subject basis  But hard to revoke all rights on an object (for all subjects) 19 CEN-5079: 7.March.2019

ACLs vs. Capabilities: In the Real World  The per-object basis usually wins  Most OSs protect files by means of ACL's  Operations centered on objects  Unix: use an abbreviated form of ACL's with just three entries • owner • group • other 20 CEN-5079: 7.March.2019

In this lecture …  Access matrix model  Access control lists versus Capabilities  Role Based Access Control  File Protection Mechanisms  Security Policies  Models of Security  Some exercises 21 CEN-5079: 7.March.2019

Role Based Access Control (RBAC) Permission-Role User-Role Assignment Assignment USERS PERMISSIONS ROLES  A user’s permissions are determined by the user’s roles  Rather than identity or clearance  Roles can encode arbitrary attributes 22 CEN-5079: 7.March.2019

Basic RBAC User-Role Permission-Role Assignment Assignment USERS ROLES PERMISSIONS ... SESSIONS 23 CEN-5079: 7.March.2019

Permissions  Similar to capabilities  Object on which permission is granted  Right granted  Primitive rights  read, write, append, execute  Permissions are positive  No negative permissions or denials 24 CEN-5079: 7.March.2019

Roles as Policy  A role brings together  A collection of users and  A collection of permissions  Different from groups  Groups are often defined as …  A collection of users 25 CEN-5079: 7.March.2019

Users  Human beings or  Other active agents  Each individual should be known as exactly one user  User-Role Assignment  A user can have many roles  Each role can be assigned to many users  Sessions  A user can invoke multiple sessions  In each session a user can invoke any subset of roles that the user is a member of 26 CEN-5079: 7.March.2019

Permission-Role Assignment User-Role Permission-Role Assignment Assignment USERS ROLES PERMISSIONS  A permission can be assigned to many roles  Each role can have many permissions 27 CEN-5079: 7.March.2019

More Complex RBAC: Role Hierarchies Role Hierarchies Permission-Role User-Role Assignment Assignment USERS ROLES PERMISSIONS ... SESSIONS 28 CEN-5079: 7.March.2019

Role Hierarchy: Example 1 Specialist Primary-Care Physician Physician Physician Health-Care Provider 29 CEN-5079: 7.March.2019

Role Hierarchy: Example 2 Supervising Engineer Hardware Software Engineer Engineer Engineer 30 CEN-5079: 7.March.2019

Role Hierarchy: Example 3 Director (DIR) Project Lead 1 Project Lead 2 (PL1) (PL2) Production 1 Quality 1 Production 2 Quality 2 (P1) (Q1) (P2) (Q2) Engineer 1 Engineer 2 (E1) (E2) Engineering Department (ED) PROJECT 1 PROJECT 2 Employee (E) 31 CEN-5079: 7.March.2019

In this lecture …  Access matrix model  Access control lists versus Capabilities  Role Based Access Control  File Protection Mechanisms  Security Policies  Models of Security  Some exercises 32 CEN-5079: 7.March.2019

File Protection Mechanisms  Multi-user system  Protect files from other users 1. All-None Protection 2. Group Protection 3. Temporary Acquired Permission 33 CEN-5079: 7.March.2019

All-None Protection  Original IBM  By default, files were public  Anyone could r, w, del any file  Users assumed  Trustworthy  Know only their files’ names  Sysadmin could password protect certain files  So could users  Main Problem: Lack of trust 34 CEN-5079: 7.March.2019

Group Protection  Unix systems: three classes  The user  Group of users associated with user - group  The rest of users – world  Groups  Members that share a common interest  Need to share  User can only belong to one group  User belonging to groups A and B  Can pass files from group A to group B 35 CEN-5079: 7.March.2019

Group Protection (cont’d)  For each created file, the user  Assigns permissions for user, group, world  From the set r, w, x  Example: rwx rw- r--  Chmod 764 filename  Suitable for paper shared by group  Main Problem: User can belong to one group 36 CEN-5079: 7.March.2019

Temporary Acquired Permissions  Unix systems  set userid (suid)  Only for executable files  If set, the file executes with the permissions of the owner, not the executor  Example:  passwd – operation that changes user passwd  Only the system can change passwords – access the password file  But users should be able to invoke passwd  passwd is suid: it executes with system privileges 37 CEN-5079: 7.March.2019