CS18000 Programming I 9 13 2010 CS52600 Information Security Access Control Matrices Prof Chris Clifton August 25 2010 See Harrison Ruzzo Ullman CACM 76 Models Access Control What is access control Limiting who is allowed to do what What is an access control model Specifying who is allowed to do what What makes this hard Interactions between types of access 2 2010 Chris Clifton 1 CS18000 Programming I 9 13 2010 Basics State Status of the system Protection state subset that deals with protection Access Control Matrix Describes protection state Formally Objects O Subjects S Matrix A S O Tuple S O A defines protection states of system 3 Access Restriction Facility Subject attributes name role groups Verbs possible actions Default rule for each verb Objects associated with set of verbs Rule for each object verb pair Rule may be function of subject attributes Can be converted to Access Control Matrix 4 2010 Chris Clifton 2 CS18000 Programming I 9 13 2010 Access Control Matrix Boolean Evaluation Example Internal Public Local CR State University Long Distance International R R R CR R R R T Student Staff Account CR CR T T CR CR Transfer T T CR CR CR CR CR T T T T T 5 Description objects entities subjects o1 om s1 sn s1 s2 sn Subjects S s1 sn Objects O o1 om Rights R r1 rk Entries A si oj R A si oj rx ry means subject si has rights rx ry over object oj 6 2010 Chris Clifton 3 CS18000 Programming I 9 13 2010 Example 2 Procedures inc ctr dec ctr manage Variable counter Rights call inc ctr dec ctr manage counter inc ctr call dec ctr manage call call 7 Boolean Expression Evaluation ACM controls access to database fields Subjects have attributes Verbs define type of access Rules associated with objects verb pair Subject attempts to access object Rule for object verb evaluated grants or denies access 8 2010 Chris Clifton 4 CS18000 Programming I 9 13 2010 Example Subject annie Attributes role artist groups creative Verb paint Default 0 deny unless explicitly granted Object picture Rule paint artist in subject role and creative in subject groups and time hour 0 and time hour 5 9 Protection State Transitions State Xi Si Oi Ai Transitions i Single transition Xi i 1 Xi 1 Series of transitions X Y Access control matrix may change Change command c associated with transition Xi ci 1 pi 1 pi 1 Xi 1 Commands often called transformation procedures 11 2010 Chris Clifton 5 CS18000 Programming I 9 13 2010 Special Privileges Copy Ownership Copy or grant Possessor can extend privileges to another Own right Possessor can change their own privileges Principle of Attenuation of Privilege A subject may not give rights it does not possess 12 Primitive Commands Harrison Ruzzo Ullman CACM 76 Create Object o Adds o to objects with no access S S O O o x S a x o x S y O a x y a x y Create Subject s Adds s to objects subjects sets relevant access control to Enter r into a s o Delete r from a s o Destroy subject s destroy object o 13 2010 Chris Clifton 6 CS18000 Programming I 9 13 2010 Create Subject Precondition s S Primitive command create subject s Postconditions S S s O O s y O a s y x S a x s x S y O a x y a x y 15 Create Object Precondition o O Primitive command create object o Postconditions S S O O o x S a x o x S y O a x y a x y 16 2010 Chris Clifton 7 CS18000 Programming I 9 13 2010 Add Right Precondition s S o O Primitive command enter r into a s o Postconditions S S O O a s o a s o r x y SxO s o a x y a x y 17 Delete Right Precondition s S o O Primitive command delete r from a s o Postconditions S S O O a s o a s o r x y SxO s o a x y a x y 18 2010 Chris Clifton 8 CS18000 Programming I 9 13 2010 Destroy Subject Precondition s S Primitive command destroy subject s Postconditions S S s O O s y O a s y x S a x s x S y O a x y a x y 19 Destroy Object Precondition o o Primitive command destroy object o Postconditions S S O O o x S a x o x S y O a x y a x y 20 2010 Chris Clifton 9 CS18000 Programming I 9 13 2010 Creating File Process p creates file f with r and w permission command create file p f create object f enter own into A p f enter r into A p f enter w into A p f end 21 Mono Operational Commands Make process p the owner of file g command make owner p g enter own into A p g end Mono operational command Single primitive operation in this command 22 2010 Chris Clifton 10 CS18000 Programming I 9 13 2010 Conditional Commands Let p give q r rights over f if p owns f command grant read file 1 p f q if own in A p f then enter r into A q f end Mono conditional command Single condition in this command 23 Multiple Conditions Let p give q r and w rights over f if p owns f and p has c rights over q command grant readwrite file 2 p f q if own in A p f and c in A p q then enter r into A q f enter w into A q f end 24 2010 Chris Clifton 11 CS18000 Programming I 9 13 2010 CS52600 Information Security Access Control Matrices Decidability Prof Chris Clifton August 25 2010 See Harrison Ruzzo Ullman CACM 76 Copy Right Allows possessor to give rights to another Often attached to a right so only applies to that right r is read right that cannot be copied rc is read right that can be copied Is copy flag copied when giving r rights Depends on model instantiation of model 26 2010 Chris Clifton 12 CS18000 Programming I 9 13 2010 Own Right Usually allows possessor to change entries in ACM column So owner of object can add delete rights for others May depend on what system allows Can t give rights to specific set of users Can t pass copy flag to specific set of users 27 Attenuation of Privilege Principle says you can t give rights you do not possess Restricts addition of rights within a system Usually ignored for owner Why Owner gives herself rights gives them to others deletes her rights 28 2010 Chris Clifton 13 CS18000 Programming I 9 13 2010 Key Points Access control matrix simplest abstraction mechanism for representing protection state Transitions alter protection state 6 primitive operations alter matrix Transitions can be expressed as commands composed of these operations and …