Upload
clemence-copeland
View
245
Download
1
Tags:
Embed Size (px)
Citation preview
Chapter 2: Access Control Matrix Overview Access Control Matrix Model
Boolean Expression Evaluation History
Protection State Transitions Commands Conditional Commands
Special Rights Principle of Attenuation of Privilege
Computer Security: Art and Science© 2002-2004 Matt Bishop
History
Statistical databases allow queries about groups of records, yet should not reveal information about any specific record.
C – query set (queries about sets of records) N - # of records Attacker: Determine statistic for individual
record query-set-overlap – prevention mechanism
Answer query only when the size of the intersection of the query set and each previous query set is smaller than parameter r
Computer Security: Art and Science© 2002-2004 Matt Bishop 2
History - Example
Banner database contains your grades and GPAs.
C1: CPEs taking CSSE442 in winter 08-09 Query 1: average_gpa(C1) Query2: count(C1) (answer = 3)
C2: Senior CPEs taking CSSE 442 in winter 08-09 Query3: average_gpa(C2) Query4: count(C2) (answer = 2)
Now, I can determine the GPA of the non-senior CPE in the class.
Computer Security: Art and Science© 2002-2004 Matt Bishop
Query-set-overlap control using ACM Subjects: entities querying the
database Objects: elements of the power set of
the records Verb: read (i.e. database being able
to answer the query for that particular query set)
In practice, difficult to use because of the need to remember all prior queries.
Computer Security: Art and Science© 2002-2004 Matt Bishop
History - example
Database:name position age salaryAlice teacher 45 $40,000Bob aide 20 $20,000Cathy principal 37 $60,000Dilbert teacher 50 $50,000Eve teacher 33 $50,000
Computer Security: Art and Science© 2002-2004 Matt Bishop
State Transitions
Change the protection state of system
|– represents transition Xi |– Xi+1: command moves system
from state Xi to Xi+1
Xi |– * Xi+1: a sequence of commands moves system from state Xi to Xi+1
Commands often called transformation procedures
Computer Security: Art and Science© 2002-2004 Matt Bishop
Primitive Operations
create subject s; create object o Creates new row, column in ACM; creates new
column in ACM destroy subject s; destroy object o
Deletes row, column from ACM; deletes column from ACM
enter r into A[s, o] Adds r rights for subject s over object o
delete r from A[s, o] Removes r rights from subject s over object o
Computer Security: Art and Science© 2002-2004 Matt Bishop
Create Subject
Precondition: s S Primitive command: create subject
s Postconditions:
S = S { s }, O = O { s } (y O)[a[s, y] = ], (x S)[a[x, s] = ] (x S)(y O)[a[x, y] = a[x, y]]
Computer Security: Art and Science© 2002-2004 Matt Bishop
Create Object
Precondition: o O Primitive command: create object o Postconditions:
S = S, O = O { o } (x S)[a[x, o] = ] (x S)(y O)[a[x, y] = a[x, y]]
Computer Security: Art and Science© 2002-2004 Matt Bishop
Add Right
Precondition: s S, o O Primitive command: enter r into a[s,
o] Postconditions:
S = S, O = O a[s, o] = a[s, o] { r } (x S)(y O – { o }) [a[x, y] = a[x, y]] (x S – { s })(y O) [a[x, y] = a[x, y]]
Computer Security: Art and Science© 2002-2004 Matt Bishop
Delete Right
Precondition: s S, o O Primitive command: delete r from
a[s, o] Postconditions:
S = S, O = O a[s, o] = a[s, o] – { r } (x S)(y O – { o }) [a[x, y] = a[x, y]] (x S – { s })(y O) [a[x, y] = a[x, y]]
Computer Security: Art and Science© 2002-2004 Matt Bishop
Destroy Subject
Precondition: s S Primitive command: destroy
subject s Postconditions:
S = S – { s }, O = O – { s } (y O)[a[s, y] = ], (x S)[a´[x, s] = ] (x S)(y O) [a[x, y] = a[x, y]]
Computer Security: Art and Science© 2002-2004 Matt Bishop
Destroy Object
Precondition: o O Primitive command: destroy object
o Postconditions:
S = S, O = O – { o } (x S)[a[x, o] = ] (x S)(y O) [a[x, y] = a[x, y]]
Computer Security: Art and Science© 2002-2004 Matt Bishop
Creating File
Process p creates file f with r and w permissioncommand create_file(p, f)
create object f;enter own into A[p, f];enter r into A[p, f];enter w into A[p, f];
end
Computer Security: Art and Science© 2002-2004 Matt Bishop
Mono-Operational Commands
Make process p the owner of file gcommand make_owner(p, g)
enter own into A[p, g];end
Mono-operational command Single primitive operation in this
command
Computer Security: Art and Science© 2002-2004 Matt Bishop
Conditional Commands
Let p give q r rights over f, if p owns fcommand grant_read_file_1(p, f, q)
if own in A[p, f]then
enter r into A[q, f];end
Mono-conditional command Single condition in this command
Computer Security: Art and Science© 2002-2004 Matt Bishop
Multiple Conditions
Let p give q r and w rights over f, if p owns f and p has c rights over qcommand grant_readwrite_file_2(p, f, q)
if own in A[p, f] and c in A[p, q]then
enter r into A[q, f];enter w into A[q, f];
end
Computer Security: Art and Science© 2002-2004 Matt Bishop
Copy Right (i.e. grant right) Allows possessor to give rights to
another Often attached to a right, so only
applies to that right r is read right that cannot be copied rc is read right that can be copied
Is copy flag copied when giving r rights? Depends on model, instantiation of
modelComputer Security: Art and Science
© 2002-2004 Matt Bishop
Own Right
Usually allows possessor to change entries in ACM column So owner of object can add, delete rights
for others May depend on what system allows
Can’t give rights to specific (set of) users Can’t pass copy flag to specific (set of)
users
Computer Security: Art and Science© 2002-2004 Matt Bishop
Attenuation of Privilege
Principle says you can’t give rights you do not possess Restricts addition of rights within a
system Usually ignored for owner
Why? Owner gives herself rights, gives them to others, deletes her rights.
Computer Security: Art and Science© 2002-2004 Matt Bishop
Key Points
Access control matrix simplest abstraction mechanism for representing protection state
Transitions alter protection state 6 primitive operations alter matrix
Transitions can be expressed as commands composed of these operations and, possibly, conditions
Computer Security: Art and Science© 2002-2004 Matt Bishop