11/28/2018

 

Lecturer: Nguyễn Thị Thanh Vân – FIT - HCMUTE

 Introduction to access control

o access control structures
o ACL and Capability lists
o Administration and aggregation of access control structures
 AC Policies:
o MAC, DAC, BRAC, ABAC
 ACL in Linux
 ACL in Windows

11/28/2018 2

1
 11/28/2018

 The process:
o a computer system controls the interaction between
users and system resources
 To implement a security policy, which may be
determined by
o organisational requirements
o statutory requirements (ex, medical records)
 Policy requirements may include
o confidentiality (restrictions on read access)
o integrity (restrictions on write access)
o availability

 involves the following entities and functions:

• Authentication: Verification that the credentials of a user or
other system entity are valid.
• Authorization: The granting of a right or permission to a
system entity to access a system resource. This function
determines who is trusted for a given purpose.
• Audit: An independent review and examination of system
records and activities in order to test for adequacy of system
controls, to ensure compliance with established policy and
operational procedures, to detect breaches in security, and to
recommend any indicated changes in control, policy and
procedures.

11/28/2018 4

2
 11/28/2018

11/28/2018 5

 A user requests access (read, write, print, etc.) to a

resource in the computer system
 The reference monitor
o establishes the validity of the request …
o … and returns a decision either granting or denying access
to the user

Access Reference System

Request Monitor Decision
 Ex: RM
o a paper-based office: the set of (locked) filing cabinets
o a night club: the security guard + the guest list

3
 11/28/2018

Logical security is security in software, as opposed to physical security

System 1 System 2

App1
Database

App2

1) Network access (e.g., Virtual Private Network)

2) Computer access (login/password), MAC
3) Database access (permissions), DAC, RBAC
4) Application access (permissions), RBAC

 Establish rules for access to information resources

 Create/maintain user profiles
 Allocate user IDs requiring authentication (per person,
not group)
 Notify users of valid use and access before and upon
login
 Ensure accountability and auditability by logging user
activities
 Log events
 Report access control configuration & logs

4
 11/28/2018

 Create/change file or database structure

 Authorize actions at the:
o Application level
o File level
o Transaction level
o Field level
 Log network & data access activities to monitor access
violations

 U- Subject (user): Active entity in a computer system

o User, process, thread
 O- Object: Passive entity or resource in a computer
system
o Files, directories, printers
 A principal: an attribute or property associated with a
subject
o User ID, Public key, Process, Thread
 Principal and subject: used to refer to the active entity in
an access operation
 A subject may be represented by more than one principal

5
 11/28/2018

 An access right describes the way in which a subject may

access an object:
o Read: User may view information in a system resource (e.g., a file,
selected records in a file, selected fields within a record, or some
combination). Read access includes the ability to copy or print.
o Write: User may add, modify, or delete data in system resource (e.g.,
files, records, programs). Write access includes read access.
o Execute: User may execute specified programs.
o Delete: User may delete certain system resources, such as files or
records.
o Create: User may create new files, records, or fields.
o Search: User may list the files in a directory or otherwise search the
directory

● Access Control: who is allowed to access what.

● Two parts
● Part I: Decide who should have access to certain
resources (access control policy)
● Part II: Enforcement – only accesses defined by the
access control policy are granted.
● Complete mediation is essential for successful
enforcement

6
 11/28/2018

● Introduced by Lampson (1972) and extended by

Harrison, Ruzzo and Ullman (1976-8)
● An access control matrix (ACM)
abstracts the state relevant to access control.
● Rows of ACM correspond to users/subjects/groups
● Columns correspond to resources that need to be
protected.
● ACM defines who can access what
● ACM [U,O] define what access rights user U has
for object O.

Objects trash a.out allfiles.txt

Subjects
jason {r,w} {r,w,x} {r,w}
mick {r,x} {r}
 The request (jason, allfiles.txt, w) is granted
 The request (mick, allfiles.txt, w) is denied

7
 11/28/2018

 Abstract formulation of access control

 Not suitable for direct implementation
o The matrix is likely to be extremely sparse and therefore
implementation is inefficient
o Management of the matrix is likely to be extremely difficult if
there are 0000s of files and 00s of users (resulting in 000000s of
matrix entries)

 Access control lists focus on the objects

o Typically implemented at operating system level
o Windows NT uses ACLs
o an ACL be stored In trusted part of the system
 An ACL corresponds to a column in the access control matrix
Ex: [a.out: (jason, {r,w,x}), (mick, {r,x})]
 How would a reference monitor that uses ACLs check the
validity of the request (jason, a.out, r)?

Objects trash a.out allfiles.txt

Subjects
jason {r,w} {r,w,x} {r,w}
mick {r,x} {r}

8
 11/28/2018

 A capability list corresponds to a row in the access control

matrix
Ex [jason: (trash, {r,w}), (a.out, {r,w,x}), (allfiles.txt, {r,w})]
 How would such a reference monitor check the validity of
the request (jason, a.out, r)?
Objects trash a.out allfiles.txt
Subjects
jason {r,w} {r,w,x} {r,w}
mick {r,x} {r}

 Where do C-lists go?

o User catalogue of capabilities defines what a certain user
can access
o Can be stored in objects/resources themselves (Hydra)
o Sharing requires propagation of capabilities
 Capability lists focus on the subjects
o in services and application software
o Database applications: use capability lists to implement fine-
grained access to tables and queries
o Renewed interest in capability-based access control for
distributed systems
 Disdavantage
o How can we check which subjects can access a given object
(“before-the-act per-object review”)?

9
 11/28/2018

 Tasks include
o Creation of new objects and subjects
o Deletion of objects and subjects
o Changing entries in access control matrix (changing entries in
ACLs and capability lists)
 The administration of access control structures is
extremely time-consuming, complicated and error-prone
 To simplify the administrative burden: AC structures that
aggregate subjects and objects are used
 Aggregation techniques
o User groups
o Roles
o Procedures
o Data types

 Access rights are often defined for groups of users

o In UNIX three groups are associated with each object
• Owner, Group (owner), Others
o In VMS there are four groups
• Owner, Group, World, System
 Ex:
Permission
Assignment Object
User

User
User Attribute Object
Group
User Group Has
Access To Objects
With the Attribute
User Object

10
 11/28/2018

 A data type is a set of objects with the same structure

(bank accounts, for example)
 We define access operations (procedures or
permissions) on a data type
 Ex:
Permission
Assignment Object
User

Type Subject Type Can Type

User Object
(Subject) Access Object Type (Object)
To Perform Operations
On Objects
User Object

 Role:
o Permissions are assigned to roles
o Users are assigned to roles
o Roles are (usually) arranged in a hierarchy
 Ex:
Perm-Role Assignment
User-Role Assignment
Role
Perm Object
User

User Users in Role Can Perm Object

Access Objects Using
Permissions
User Perm Object

11
 11/28/2018

 Many OS to determine whether users are authorized to

conduct different actions
o the mandatory access control (MAC): computer system
the computer system decides exactly who has access to which
resource in the system
o the discretionary access control (DAC): users
users are authorized to determine which other users can access files or
other resources that they create
o the role-based access control (RBAC): MAC in special
the system decides exactly which users are allowed to access which
resources—but the system does this in a special way
o Attribute-based access control (ABAC): Controls access based
on attributes of the user, the resource to be accessed, and current
environmental conditions.
o Physical Access Control: Locks, fences, biometrics, badges, keys
 The Bell-LaPadula Model: certain level of access.

11/28/2018 23

MAC

DAC

RBAC

11/28/2018 24

12
 11/28/2018

Mandatory Access Control

Login User Group Permi…
John John Mgmt rwx r x Discretionary Access Control
June June Billing r John
May May Factory r x r x A, B, C, D, E, F
Al Al Billing
Don Don Billing
June May
A, B, C D, E, F
Role-Based Access Control
Login Role Permission
John Mgr A, B,C,D,E,F Al Don Pat Tom
June Acct. A,B,C A, B B, C D, F E, F
Al Acct. A,B,C
May Factory D,E,F
Pat Factory D,E,F Tim
E

 

Lecturer: Nguyễn Thị Thanh Vân – FIT - HCMUTE

13
 11/28/2018

In discretionary access control (DAC),

owner of a resource decides how it
can be shared

●Owner can choose to give read or

write access to other users

Two problems with DAC:

● You cannot control if someone you share a file with will not further
share the data contained in it
● Cannot control “information flow”
● In many organizations, a user does not get to decide how
certain type of data can be shared
● Typically the employer may mandate how to share various
types of sensitive data
● Mandatory Access Control (MAC) helps address these problems

14
 11/28/2018

Check the best answer:

In a certain company, payroll data is sensitive. A file that stores
payroll data is created by a certain user who is an employee of
the company. Access to this file should be controlled with a...

DAC policy that allows the user to share it with

others carefully

It must use a MAC model as the company must

decide who can access it

User works in a company and the company decides how data

should be shared

 

Lecturer: Nguyễn Thị Thanh Vân – FIT - HCMUTE

15
 11/28/2018

Military and intelligence agencies:

Data has associated classification level and

users are cleared at various levels
● Top secret, secret, confidential etc.
● Limits on who can access data at a certain
level
● User cleared only at secret level should not
be able to access top secret data
● Also called multilevel security (MLS)

 The capability of a computer system to:

o carry information with different sensitivities (i.e. classified
information at different security levels),
o permit simultaneous access by users with different security
clearances and needs-to-know, and
o prevent users from obtaining access to information for which
they lack authorization.
 Discretionary access control fails to achieve MLS
 Typically use Mandatory Access Control
o  Primary Security Goal: Confidentiality

32

16
 11/28/2018

 Mandatory access controls (MAC) restrict the access of

subjects to objects based on a system-wide policy
o denying users full control over the access to resources that they
create.
o The system security policy (as set by the administrator) entirely
determines the access rights granted

CS526 Topic 17: BLP 33

Labels: A Key Requirement for Implementing MAC

●indicate sensitivity/category of data or clearance/need-to-know
requirements of users
●TCB associates labels with each user and object and checks them
when access requests are made
●Need to relate labels to be able to compare them
●Exact nature of labels depends on what kind of model/policy is
implemented
●DoD models include classification/clearance level and a
compartment in the label
●Commercial policies are different but use labels to deal with
conflict-of-interest, separation-of-duty etc.

17
 11/28/2018

• Label = (sensitivity level, Compartments)

• Let us consider highly sensitive

documents that have information about
various arms stockpiles.

• L1 = (TS, {nuclear, chemical})

• L2 = (S, {nuclear, conventional})

• Providing confidential access to

documents (Bell and La Padula or BLP
Model)

sensitivity levels are totally ordered

(TS > S > C > U)

● Compartments are sets which can only be partially

ordered

● How do we order labels?

18
 11/28/2018

Select the best answer:

If L1 = (secret, {Asia, Europe}) and
L2 = {top-secret, {Europe, South-America}),

L1 dominates L2

L2 dominates L1

Neither L1 nor L2 dominates the other one

19
 11/28/2018

Select the best answer:

Assume that label L1 or a document D1 dominates label L2 of
document D2 when these labels are defined by (sensitivity
level, compartment).

D1 contains more sensitive data than D2.

D2 is more sensitive than D1.

The data contained in D2 has a narrower scope

as defined by its compartment

 Introduce in 1973

 Air Force was concerned with security in time-sharing

systems
o Many OS bugs
o Accidental misuse

 Main Objective:
o Enable one to formally show that a computer system can
securely process classified information

40

20
 11/28/2018

Security levels, e.g.: {TS, S, C, U}

Lm: Max Lc: Current L: Class.

Sec. Level Sec. Level Level

Subjects Objects
Current
Accesses
Trusted
Subjects

Access Matrix
41

 A computer system is modeled as a state-transition

system
o There is a set of subjects; some are designated as trusted.
o Each state has objects, an access matrix, and the current access
information.
o There are state transition rules describing how a system can go
from one state to another
o Each subject s has a maximal sec level Lm(s), and a current sec
level Lc(s)
o Each object has a classification level

42

21
 11/28/2018

 A state is secure if it satisfies

o Simple Security Condition (no read up):
• S can read O iff Lm(S) ≥ L(O)
o The Star Property (no write down): for any S that is not trusted
• S can read O iff Lc(S) ≥ L(O) (no read up)
• S can write O iff Lc(S) ≤ L(O) (no write down)
o Discretionary-security property
• every access is allowed by the access matrix
 A system is secure if and only if every reachable state is
secure.

43

Objects
Highest
Can Write

Max Level
Subject

Can Read & Write

Can Read

Lowest

44

22
 11/28/2018

 Applies to subjects (principals) not to users

 Users are trusted (must be trusted) not to disclose
secret information outside of the computer system
 Subjects are not trusted because they may have Trojan
Horses embedded in the code they execute
 Star-property prevents overt leakage of information and
does not address the covert channel problem

11/28/2018 45

 Used as attributes of both subjects & objects

o clearance & classification

 MLS
o security levels
o security categories: Also known as compartments
o security labels = Levels  P (Categories)
 Define an ordering relationship among Labels
o (e1, C1)  (e2, C2) iff. e1 e2 and C1  C2

Apply security levels security categories

military top secret  secret  confidential  • army, navy, air force
unclassified • nato, nasa, noforn
commercial restricted  proprietary  sensitive  • Sales, R&D, HR
public • Dept A, Dept B, Dept46C

23
 11/28/2018

 levels={top secret, secret}

 categories={army,navy}

Top Secret, {army, navy}

Top Secret, Top Secret, Secret, {army,

{army} {navy} navy}

Top Secret, {} Secret, {army} Secret, {navy}

Secret, {}

CS526 Topic 17: BLP 47

TS

● no read-up
● no write-down

(user low level write to user high level read)

24
 11/28/2018

Select the best answer:

Since an unclassified document contains no sensitive information, it

can be read or written by anyone in a system that implements BLP

True

False

BLP allows an unclassified user to write a top secret document.

True

False

 Given the security levels TOP SECRET, SECRET, CONFIDENTIAL,

and UNCLASSIFIED (ordered from highest to lowest), and the
categories A, B, and C, specify what type of access (read, write, or
both) is allowed in each of the following situations. Assume that
discretionary access controls allow anyone access unless otherwise
specified.
o Paul, cleared for (TOP SECRET, {A, C}), wants to access a document
classified (SECRET, { B, C }).
o Anna, cleared for (CONFIDENTIAL, {C}), wants to access a document
classified (CONFIDENTIAL, {B}).
o Jesse, cleared for (SECRET, {C}), wants to access a document
classified (CONFIDENTIAL, {C}).
o Sammi, cleared for (TOP SECRET, {A, C}), wants to access a
document classified (CONFIDENTIAL, {A}).
o Robin, who has no clearances (and so works at the UNCLASSIFIED
level), wants to access a document classified (CONFIDENTIAL, {B}).
11/28/2018 50

25
 11/28/2018

●Biba is dual of BLP

● Focuses on integrity rather than confidentiality
● Read-up and write-down rules

Example:
●Integrity level could be high, medium or low
●Compartment could be similar to BLP and captures
topic(s) of document
●Low integrity information should never flow up into
high integrity documents

●User clearance is not common

●Other requirements exist
●Data only be accessed by certain
application (e.g., payroll)
●Separation-of-duty and conflict-
of-interest requirements

26
 11/28/2018

●Clark-Wilson Policy
Users ➔ Programs
(transactions) ➔ Objects
● Chinese Wall Policy
●Same user cannot
execute two programs ● Deals with conflict of
that require separation- interest
of-duty

Objects are put into conflict classes:

The user can access any object as long as he/she has not accessed an
object from another company in the same conflict class.

27
 11/28/2018

Revisiting Trusted Computing Base (TCB)

● How do we know TCB can be trusted?

● Secure vs. trusted. vs high assurance
● Set of all hardware and software
trusted to operate securely
● Required for all other trust in the
system security policy

Trusting Software:
● Functional correctness
● Does what it was designed to do
● Maintains data integrity
● Even for bad input
● Protects disclosure of sensitive data
● Does not pass to untrusted software
● Confidence
● Experts analyze program & assure trust
● Statement giving security we expect system to enforce
● Do this formally when and where possible

28
 11/28/2018

●Least privilege for ● Complete mediation

users & programs ○ Every access checked,
●Economy attempts to bypass must
●Keep trusted code small be prevented
as possible, easier to ● Fail-safe defaults
analyze & test ○ Default deny
●Open design ● Ease of use
●Security by obscurity ○ Users avoid security that
does not work gets in their way

●Must implement certain security

relevant functions
●Authentication
●Access control to files & general
objects
●Mandatory access control (SELinux)
●Discretionary access control
(standard file permissions)

29
 11/28/2018

●Protection of data used by OS (OS must protect itself)

●Security features of trusted OSes
●Object reuse protection
●Disk blocks, memory frames reused
●Process can allocate disk or memory, then look to see what's
left behind
●Trusted OS should zero out objects before reuse
●Secure file deletion: overwrite with varying patterns of zeros
& ones
●Secure disk destruction: degaussing, physical destruction

●Complete mediation of accesses

●Trusted path from user to secure system
●Prevents programs from spoofing interface of
secure components
●Prevents programs from tapping path (e.g.
keyloggers)
●Audit log showing object accesses – only useful if you
/look/ at the log
●Detect unusual use of the system

30
 11/28/2018

 

Lecturer: Nguyễn Thị Thanh Vân – FIT - HCMUTE

 RBAC Model:
the system decides
exactly which users are
allowed to access
which resources—but
the system does this in
a special way

11/28/2018 62

31
 11/28/2018

11/28/2018 63

• RBAC0 : the minimum functionality

• RBAC1 : the RBAC0 functionality +
role hierarchies, which enable one role
to inherit permissions from another
role.
• RBAC2 : RBAC0 + constraints, which
restricts the ways in which the
components of a RBAC system may
be configured.
• RBAC3 : RBAC0 + RBAC1 + RBAC2

• Constraints provide a means of adapting RBAC to the specifics of administrative and

security policies in an organization. A constraint is a defined relationship among
roles or a condition related to roles

32
 11/28/2018

 Role hierarchy
o Problem: does organizational hierarchy correspond to a permission
inheritance hierarchy?
o Problem: do organizational roles make sense for building hierarchies?
 Constraints
o Problem: constraints apply to all states, so they require a predicate
calculus in general
o Problem: Only certain types of constraints can effectively be
administered? Mutual exclusion, separation of duty, cardinality, etc.
 Conflicts
o May find other concepts useful for resolving conflicts between
constraints and hierarchies/assignments

- An RBAC system contains the four types of entities (the minimum functionality
for an RBAC system):
• User: An individuals - access to this computer system
• Role: job function - controls this computer system
• Permission: approval of access to one or more objects
• Session: : A mapping between a user and
an activated subset of the set of roles
to which the user is assigned

33
 11/28/2018

11/28/2018 67

11/28/2018 68

34
 11/28/2018

 Roles implemented in
o Window NT (as global and local groups)
o IBM’s OS/400
o Oracle 8 onwards
o .NET framework
 There is no generally accepted standard for
RBAC
o Role hierarchies
o Semantics of role hierarchies

 Practical ease of specification

o Abstraction for users, permissions, constraints, administration
 Natural access control aggregations – based on
organizational roles
o As new employees join, their permission assignments are
determined by their job
o Permission assignment is largely static
 Central control and maintenance of access rights
 Flexible enough to enforce
o least privilege, separation of duties, etc.

35
 11/28/2018

 Practical ease of specification

o Clear base model – need more help for constraints, admin
 Natural access control aggregations – based on
organizational roles
o In some cases, but not clear that organizational roles help with
permission assignment – particularly with inheritance
 Central control and maintenance of access rights
o Central view is a selling feature of products, but a single view of
all can be complex (layering?)
 Flexible enough to enforce
o Flexible access control expression, but difficult to determine if we
enforce our security goals (constraints)

 We only need to assign users and permissions to roles

 We can use inheritance in the role hierarchy to reduce
the number of assignments that are required
 Simplifies administration

36
 11/28/2018

 NIST (Ferraiolo et al., 1992-2000)

 RBAC96 (Sandhu et al., 1996)
 ARBAC97 (Sandhu et al., 1997-99)
 OASIS (Hayton et al., 1996-2001)
 Role Graph model (Nyanchama and Osborn, 1995-2001)
 Unified RBAC96 NIST model (Ferraiolo, Sandhu et al.,
2001)

 

Lecturer: Nguyễn Thị Thanh Vân – FIT - HCMUTE

37
 11/28/2018

 There are three key elements to an ABAC model:

o attributes, which are defined for entities in a configuration;
o a policy model, which defines the ABAC policies;
o the architecture model, which applies to policies that enforce
access control.

11/28/2018 75

 An access by a subject to an
object proceeds according to
the following steps:
o 1. A subject requests access to an
object. This request is routed to
an access control mechanism.

o 2. The AC mechanism is
governed by a set of rules:
• (2a) that are defined by a
preconfigured access control policy.
Based on these rules, the AC
mechanism assesses the attributes
of the subject (2b), object (2c), and
current environmental conditions
(2d) to determine authorization.

11/28/2018 76

38
 11/28/2018

 ACL Trust Chain

11/28/2018 77

 ABAC Trust Chain

11/28/2018 78

39
 11/28/2018

 A policy is a set of rules and relationships that govern

allowable behavior within an organization, based on the
privileges of subjects and how resources or objects are
to be protected under which environment conditions.
 In turn, privileges represent the authorized behavior of a
subject; they are defined by an authority and embodied
in a policy.
 Other terms that are commonly used instead of
privileges are rights, authorizations, and entitlements.

11/28/2018 79

 ICAM is a comprehensive approach to managing and implementing

digital identities (and associated attributes), credentials, and access
control.
 ICAM has been developed by the U.S. government, but is applicable
not only to government agencies, but also may be deployed by
enterprises looking for a unified approach to access control.
 ICAM is designed to:
o Create trusted digital identity representations of individuals and what the
ICAM documents refer to as nonperson entities (NPEs). The latter include
processes, applications, and automated devices seeking access to a
resource.
o Bind those identities to credentials that may serve as a proxy for the
individual or NPE in access transactions. A credential is an object or data
structure that authoritatively binds an identity (and optionally, additional
attributes) to a token possessed and controlled by a subscriber.
o Use the credentials to provide authorized access to an agency’s resources

11/28/2018 80

40
 11/28/2018

11/28/2018 81

 CM is the management of the life cycle of the credential - an object

or data structure that authoritatively binds identity (and optionally,
additional attributes) to a token possessed and controlled by a
subscriber.
 IM: is concerned with assigning attributes to a digital identity and
connecting that digital identity to an individual or NPE. The goal is to
establish a trustworthy digital identity that is independent of a
specific application or context
 AM: the management and control of the ways entities are granted
access to resources. It covers both logical and physical access, and
may be internal to a system or an external element. It is used to
ensure that the proper identity verification is made when an
individual attempts to access security sensitive buildings, computer
systems, or data.
 IF is a term used to describe the technology, standards, policies,
and processes that allow an organization to trust digital identities,
identity attributes, and credentials created and issued by another
organization.
11/28/2018 82

41
 11/28/2018

 Each file has an owner, who has a unique user ID (UID).

 Access is possible for an owner, group, and world.
 Permissions are read, write, execute.
 Special permission: permissions allow users and groups who
are not the owner or group of a file to execute that file as
though they were
o SETUID - set user ID on execute
o SETGID - set group ID on execute
o StickyBit - puts the directory in sticky mode

 Example: chmod 4762 myfile translates to:

setuid = on
setgid = off
sticky bit = off
user = read + write + execute
group = read + write
other = write
 Set UID, GID, Sticky bit
chmod u+s = add setuid
chmod g-s = remove setgid
chmod o+t = add sticky bit
 Others:
chmod a+w = add write to *all*
chmod a-wx = remove write and execute from *all
chmod -R 755 myfolder

42
 11/28/2018

 provide a finer-grained control over which users can access

specific directories and files.
 Using ACLs, you can specify the ways in which each of
several users and groups can access a directory or file.
 Commands:
o displays the file name, owner, group and the existing ACL for a file:
getfacl
o sets ACLs of files and directories: setfacl -m
setfacl -m ugo:u/g_name:permissions fil/fol_name
o removes rules in a file or folder's: setfacl –x
Use numeric or character to set permission

 Commands:
o List: net user, net localgroup
o Change the permisions

o Testing - quickly start a program as another user: runas

Ex, runas /User:jack cmd.exe

43
 11/28/2018

 LABChapter 6

11/28/2018 87

44