Lecture4 AccessControl

Information
Systems Security
Access Control
Access Control Definitions
1/2
The process of granting or denying specific requests to:

(1) obtain and use information and related information
processing services; and
(2) (2) enter specific physical facilities”
Access Control Definitions
2/2
A process by which use of system resources is

regulated according to a security policy and is
permitted only by authorized entities (users,
programs, processes, or other systems) according to
that policy
Access Control Principles
• In a broad sense, all of computer security is
concerned with access control
“measures that implement and assure security

services in a computer system, particularly those that
assure access control service”
Access Control Policies
• Discretionary access control • Role-based access control
(DAC) (RBAC)
o Controls access based on the identity o Controls access based on the roles
of the requestor and on access rules that users have within the system and
(authorizations) stating what on rules stating what accesses are
requestors are (or are not) allowed to allowed to users in given roles
do
• Attribute-based access
• Mandatory access control control (ABAC)
(MAC) o Controls access based on attributes of
o Controls access based on comparing the user, the resource to be accessed,
security labels with security and current environmental conditions
clearances
Subjects, Objects, and
Access Rights
Access
Subject Object
right
An entity capable of A resource to which access is Describes the way in which a

accessing objects controlled subject may access an object
Three classes Could include:

• Owner • Read
• Write
• Group Entity used to contain and/or • Execute
• World receive information • Delete
• Create
• Search
Discretionary Access Control
(DAC)
• Scheme in which an entity may be granted access rights that
permit the entity, by its own violation, to enable another entity
to access some resource
• Often provided using an access matrix
o One dimension consists of identified subjects that may attempt data
access to the resources
o The other dimension lists the objects that may be accessed
• Each entry in the matrix indicates the access rights of a
particular subject for a particular object
Figure 4.2 Example of Access Control Structures
Table 4.2
Authorization
Table
for Files in
Figure 4.2
(Table is on page 113 in the textbook)

Protection Domains
• Set of objects together with access rights to those objects
• More flexibility when associating capabilities with protection
domains
• In terms of the access matrix, a row defines a protection domain
• User can spawn processes with a subset of the access rights of the
user
• Association between a process and a domain can be static or dynamic
• In user mode certain areas of memory are protected from use and
certain instructions may not be executed
• In kernel mode privileged instructions may be executed and
protected areas of memory may be accessed
UNIX File Access Control
UNIX files are administered using inodes (index
nodes)
• Control structures with key information needed for a particular file
• Several file names may be associated with a single inode
• An active inode is associated with exactly one file
• File attributes, permissions and control information are sorted in the
inode
• On the disk there is an inode table, or inode list, that contains the
inodes of all the files in the file system
• When a file is opened its inode is brought into main memory and
stored in a memory resident inode table
Directories are structured in a hierarchical tree
• May contain files and/or other directories

• Contains file names plus pointers to associated inodes
UNIX
File Access Control
 Unique user identification

number (user ID)
 Member of a primary group
identified by a group ID
 Belongs to a specific group
 12 protection bits
 Specify read, write, and
execute permission for the Figure 4.5 UNIX File Access Control
owner of the file, members
of the group and all other
users
 The owner ID, group ID, and
protection bits are part of the

Lecture4 AccessControl

Uploaded by

Copyright:

Available Formats

Lecture4 AccessControl

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lecture4 AccessControl

Uploaded by

Copyright:

Available Formats

Information

The process of granting or denying specific requests to:

A process by which use of system resources is

“measures that implement and assure security

An entity capable of A resource to which access is Describes the way in which a

Three classes Could include:

(Table is on page 113 in the textbook)

Directories are structured in a hierarchical tree

• May contain files and/or other directories

 Unique user identification

You might also like