ACCESS CONTROL

Module 9 – Access control and policy configuration

COMP 3564 – Usable Privacy and Security / Created & Designed by: Khosro Salmani
 TODAY’S CLASS

• Access control overview

• Home access control

• Files system access control

• Mobile device permissions

• Access control for social networks

ACCESS CONTROL
 Access control

• Selectively allowing and restricting access to resources

§ Examples of access control in the real world?
• File access

• Computer system access

• Social networks

• Smartphone app permissions

• Door locks
 Access control mechanisms

• Obfuscation, hiding - Hiding a key under a rock, putting secret documents in a plain
folder

• Physical keys and tokens

• Discretionary access control - Resource owners assign access permissions to

individuals and groups, used in most file systems

• Role-based access control - Individuals assigned roles, permissions assigned to roles

• Distributed access control - Certificates used to grant access and delegate the ability
to grant access, certificates must be presented to construct proof that access is
permitted
• But, who handles security and access control in a system?
Lets’ look at a study!
(Smart home)
 Home access control

• In-situ, semi-structured interviews

§ Recruitment via Craigslist, fliers
§ Limited to non-programmer households

• Interviewed 33 users in 15 households

• Families, couples, roommates Ages 8 to 59

• Recorded and transcribed over 30 hours of

interviews
 Findings!

• Current methods aren’t working

§ People do worry about sensitive data
• Many potential breaches rated as
“devastating”
• Almost all worry about file security
sometimes
• Several have suffered actual
breaches
This Photo by Unknown Author is licensed under CC BY-NC-ND
 Findings
• Policy needs are complex
§ Fine-grained divisions of people and files § Location sometimes matters

• Public/private not enough • People in my home are trusted

• More than friends, family, colleagues, § Some people tend to share, some
strangers tend to restrict
§ Presence of file owner matters

• “If you have your mother in the room, you

are not going to do anything bad. But if your

mom is outside the room you can sneak.”

• Also gives a chance to explain

 Complex Needs
i ed
n • Twenty-something middle school
s De
es Spanish teacher:
cc
A § “Wouldn’t want my boss to see me
in my swimsuit….
§ I just wouldn’t like him to see it.”
 Complex Needs

ed
lo w
A l
ss
ce
Ac

• Twenty-something paralegal and law student would let her boss see
photo of her drunk, dancing on a table: “he’s seen me do it in person
before.”
 This means: A-priori policy not good enough

• People don’t feel as much in control when they set policy up front

• People like to be asked permission

§ “I’m very willing to be open with people, I think I’d just like the
courtesy of someone asking me.”

• People want to know both who is accessing files and why

• People want to review accesses, revise policy

• A follow-up study was conducted on reactive access control

Now let’s see a file system
access control problem
 File system access control

• Access control on Windows file

systems often incorrect
• Mistakenly misconfigured server used
by both Republican and Democrat
staffers led to 2003 “Memogate”
scandal
• Windows access control is difficult
because it has no holistic view of
effective file permissions, and conflict
resolution is complicated
Problem: Rule-centered interfaces
 Why is policy authoring difficult?

• Default rules

§ What happens when no rule applies?

• Composite values (groups, folders, etc.)

§ What are the component values?

• Rule conflicts & precedence rules

§ What if more than one rules applies?

• Scale
§ Large policies can get tricky
This Photo by Unknown Author is licensed under CC BY-NC-ND
Example
 Example task: Jana

• Jana is a TA this year

§ Is in the group Theory 101 TAs 2007

• Jana was a TA last year

§ Is in the group Theory 101 TAs 2006

• 2007 TAs are allowed READ & WRITE

This Photo by Unknown Author is licensed under CC BY-SA

• 2006 TAs are denied READ & WRITE

• Since Jana is in both groups, she is

denied access
The problem
 Key insight

• Key insight: Center policy-authoring user interfaces around

a display of the whole effective policy, not a list of rules
What about Mobile app
permissions?
 Mobile app permissions problematic

• Users don’t understand what

permissions mean

• Users don’t understand why

permissions are being requested

• Users often click through without

reading
 Permissions in Android 6.0+

• Activity:
§ What is runtime permissions
model
§ How does android manage
permissions
§ How does iOS manage
permissions?
This Photo by Unknown Author is licensed under CC BY-SA
 Explanation before asking for permission
• Apps encouraged to offer explanation before asking for permission, resulting in
double prompt
§ Twitter
 Explanation before asking for permission
• Facebook
 Explanation before asking for permission
• Hangouts
Social networks
 Access control for social networks
• It’s complicated!
§ How do you specify your audience?
• Public, friends, friends-of-friends, friend lists (circles), friends except
restricted
§ How do you specify groups of friends?
• Groups as attributes of each friend (Jane is in group “college
friends”)
• Define friend groups based on attributes (all my friends who are
alumni of my college are in group “college friends”)
• Setup a FB (or other social network) group and invite people to join
• Activity 1: what data privacy options social media apps offer to
their users?
• Activity 2: Making privacy and audience settings easier to
understand
§ What are some ideas for making the privacy and/or audience
settings easier for users to control and understand on a social
network or mobile platform?
DEVELOPMENT
Android
(Google)
 Permissions on Android

• App permissions help support user

privacy by protecting access to the
following:

§ Restricted data, such as system

state and users' contact information

§ Restricted actions, such as

connecting to a paired device and
recording audio
[Link]

This Photo by Unknown Author is licensed under CC BY-SA

Workflow for using app permissions:
 Types of permissions

• Install-time permissions

§ Install-time permissions give your app limited access to restricted data or let your
app perform restricted actions that minimally affect the system or other apps.

§ An app store presents an install-time permission notice to the user when they view
an app's details page

• Normal permissions
§ These permissions allow access to data and actions that extend beyond your app's
sandbox but present very little risk to the user's privacy and the operation of other
apps.

§ The system assigns the normal protection level to normal permissions.

 Types of permissions (Continue…)
• Signature permissions
§ The system grants a signature permission to an app only when the app is signed by
the same certificate as the app or the OS that defines the permission.
§ The system assigns the signature protection level to signature permissions.

• Runtime permissions
§ Runtime permissions, also known as dangerous
permissions, give your app additional access to restricted
data or let your app perform restricted actions that more
substantially affect the system and other apps.
§ When your app requests a runtime permission, the system
presents a runtime permission prompt
 Types of permissions (Continue…)
• Special permissions
§ Special permissions correspond to particular app operations.
§ Only the platform and OEMs\Manufacturers can define special permissions
§ the platform and OEMs usually define special permissions when they want to protect
access to particularly powerful actions, such as drawing over other apps.
• Permission groups
§ Permissions can belong to permission groups.
§ Permission groups consist of a set of logically related permissions.
§ For example, permissions to send and receive SMS messages might belong to the
same group, as they both relate to the application's interaction with SMS.
Best practices
(Suggested by Google)
 Best practices

• App permissions build on system security features and help Android support the
following goals related to user privacy:
§ Control: The user has control over the data that they share with apps.
§ Transparency: The user understands what data an app uses and why the
app accesses this data.
§ Data minimization: An app accesses and uses only the data that's required
for a specific task or action that the user invokes.
 App permission best practices
• Request a minimal number of permissions
§ your app should request only the permissions
that it needs to complete that action
• Associate runtime permissions with specific
actions
§ request permissions as late into the flow of
your app's use cases as possible.
• Consider your app's dependencies
§ When you include a library, you also inherit its
permission requirements.
§ Be aware of the permissions that each
dependency requires and what those This Photo by Unknown Author is licensed under CC BY-SA-NC

permissions are used for.

 App permission best practices
• Be transparent
§ be clear about what you're accessing, why,
and what functionalities are affected if
permissions are denied, so users can make
informed decisions.
• Make system accesses explicit
§ When you access sensitive data or hardware,
such as the camera or microphone, provide a
continuous indication in your app
§ This reminder helps users understand exactly
when your app accesses restricted data or
performs restricted actions.
iOS
(Apple)
 There are some similarities with Android

• Request Access Only When Your

App Needs the Data

• Be Transparent About How Data Will

Be Used

• Give the User Control Over Data and

Protect Data You Collect

• Use the Minimum Amount of Data

Required
This Photo by Unknown Author is licensed under CC BY-NC
 Provide a purpose

• The first time your app attempts to

access a protected resource, the system
prompts the person using the app for
permission.
§ If the person grants permission, the system
remembers the person’s choice and doesn’t
prompt again.
QUESTIONS?