Computer Security: Principles and

Practice
Fourth Edition

Chapter 4
Access Control

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Access Control Definitions (1 of 2)
NISTIR 7298 defines access control as:
“the process of granting or denying specific requests to:
(1) obtain and use information and related information
processing services; and (2) enter specific physical
facilities”

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Access Control Definitions (2 of 2)
RFC 4949 defines access control as:
“a process by which use of system resources is regulated
according to a security policy and is permitted only by
authorized entities (users, programs, processes, or other
systems) according to that policy”

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Table 4.1 Access Control Security
Requirements (SP 800-171) (1 of 4)
Basic Security Requirements
1. Limit information system access to authorized users, processes
acting on behalf of authorized users, or devices (including other
information systems).
2. Limit information system access to the types of transactions and
functions that authorized users are permitted to execute.

Derived Security Requirements

3. Control the flow of CUI in accordance with approved authorizations.
4. Separate the duties of individuals to reduce the risk of malevolent
activity without collusion.

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Table 4.1 Access Control Security
Requirements (SP 800-171) (2 of 4)
5. Employ the principle of least privilege, including for specific
security functions and privileged accounts.
6. Use non-privileged accounts or roles when accessing nonsecurity
functions.
7. Prevent non-privileged users from executing privileged functions
and audit the execution of such functions.
8. Limit unsuccessful logon attempts.
9. Provide privacy and security notices consistent with applicable C
UI rules.

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Table 4.1 Access Control Security
Requirements (SP 800-171) (3 of 4)
10. Use session lock with pattern-hiding displays to prevent access and
viewing of data after period of inactivity.
11. Terminate (automatically) a user session after a defined condition.
12. Monitor and control remote access sessions.
13. Employ cryptographic mechanisms to protect the confidentiality of
remote access sessions.
14. Route remote access via managed access control points.
15. Authorize remote execution of privileged commands and remote
access to security-relevant information.
16. Authorize wireless access prior to allowing such connections.

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Table 4.1 Access Control Security
Requirements (SP 800-171) (4 of 4)
17. Protect wireless access using authentication and encryption.
18. Control connection of mobile devices.
19. Encrypt CUI on mobile devices.
20. Verify and control/limit connections to and use of external
information systems.
21. Limit use of organizational portable storage devices on external
information systems.
22. Control CUI posted or processed on publicly accessible information
systems.

CUI = controlled unclassified information

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Access Control Principles
• In a broad sense, all of computer security is concerned
with access control
• RFC 4949 defines computer security as:

“measures that implement and assure security services in a

computer system, particularly those that assure access
control service”

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.1 Relationship Among Access
Control and Other Security Functions

Source: Based on [SAND94].

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
 Access Control Policies
• Discretionary access control (DAC) • Role-based access control (RBAC)
– Controls access based on the – Controls access based on the
identity of the requestor and roles that users have within the
on access rules system and on rules stating what
(authorizations) stating what accesses are allowed to users in
requestors are (or are not) given roles
allowed to do
• Attribute-based access control (ABAC)
• Mandatory access control (MAC) – Controls access based on
– Controls access based on attributes of the user, the
comparing security labels with resource to be accessed, and
security clearances current environmental conditions

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Subjects, Objects, and Access Rights
• Subject • Object • Access right
– An entity – A resource – Describes the
capable of to which way in which a
accessing access is subject may
objects controlled access an object
– Three classes – Entity used – Could include:
▪ Owner to contain ▪ Read
and/or
▪ Group ▪ Write
receive
▪ World information ▪ Execute
▪ Delete
▪ Create
▪ Search

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Discretionary Access Control (DAC)
• Scheme in which an entity may be granted access rights
that permit the entity, by its own violation, to enable
another entity to access some resource
• Often provided using an access matrix
– One dimension consists of identified subjects that
may attempt data access to the resources
– The other dimension lists the objects that may be
accessed
• Each entry in the matrix indicates the access rights of a
particular subject for a particular object

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.2 Example of Access Control
Structures (1 of 2)

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.2 Example of Access Control
Structures (2 of 2)

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Table 4.2 Authorization Table for Files in
Figure 4.2
Subject Access Mode Object Subject Access Mode Object

A Own File 1 C Read File 1

A Read File 1 C Write File 1

A Write File 1 C Read File 2

A Own File 3 C Own File 4

A Read File 3 C Read File 4

A Write File 3 C Write File 4
B Read File 1
B Own File 2
B Read File 2
B Write File 2
B Write File 3
B Read File 4

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.3 Extended Access Control
Matrix

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.4 An Organization of the Access
Control Function

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Table 4.3 Access Control System
Commands (1 of 2)
Rule Command (by S0 ) left par enthesis by S sub 0 r ight par enthesis Authorization Operation

 *  “ *” in A[S0 , X ]  *
Transfer, a 2 by 1 matrix with column entries as follows. Column 1. alpha asterisk, alpha. to S, X Alpha asterisk, in A left bracket S sub 0, X right bracket store, a 2 by 1 matrix with following row entries, Row 1. alpha asterisk, row 2 alpha. in A left bracket S, X right bracket

R1
transfer   to S, X store   in A[S, X ]
   
 *  ‘owner ’ in A[S0 , X ]å  * 
grant, a 2 by 1 matrix with following column entries, alpha asterisk, alpha. to S, X store the 2 by 1 column matrix, Row 1 alpha asterisk, Row 2 alpha in A of left bracket S, X right bracket
Owner, in A left bracket S sub 0, X right bracket a

R2
grant   to S, X store   in A[S, X ]
   
‘control’ in A[S0 , S ]
Control, in A left bracket S sub 0, S right bracket or owner in A left bracket S sub 0, X right bracket

R3
delete  from S, X delete alpha from S, X
or delete  from A[S, X ] delete alpha from A of left bracket S, X right bracket

‘owner ’ in A[S0 , X ]

R4 ‘control’ in A[S0 , S ]
w  read S, X w left arrow read S , X
or
Control, in A left bracket S sub 0, S right bracket or owner in A left bracket S sub 0, X right bracket

copy A[S, X ] into w

copy A left bracket S, X right bracket into w

‘owner ’ in A[S0 , X ]

R5 create object X None add column for X to A; store

‘owner ’ in A[S0 , X ]
owner in A left bracket S sub 0, X right bracket

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Table 4.3 Access Control System
Commands (2 of 2)
Rule Command (by S0 )
left parenthesis by S sub 0 right parenthesis Authorization Operation
‘owner ’ in A[S0 , X ]
owner in A of left bracket S sub 0, X right bracket

R6 destroy object X delete column for X from A

R7 create subject S none add row for S to A; execute

create object S; store
control in A left bracket S, S right bracket

'control' in A[S, S ]

‘owner ’ in A[S0 , S ]
owner in A left bracket S sub 0, S right bracket

R8 destroy subject S delete row for S from A;

execute destroy object S

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Protection Domains
• Set of objects together with access rights to those objects
• More flexibility when associating capabilities with protection domains
• In terms of the access matrix, a row defines a protection domain
• User can spawn processes with a subset of the access rights of the
user
• Association between a process and a domain can be static or
dynamic
• In user mode certain areas of memory are protected from use and
certain instructions may not be executed
• In kernel mode privileged instructions may be executed and protected
areas of memory may be accessed
Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
UNIX File Access Control (1 of 3)
• UNIX files are administered using inodes (index nodes)
– Control structures with key information needed for a
particular file
– Several file names may be associated with a single inode
– An active inode is associated with exactly one file
– File attributes, permissions and control information are
sorted in the inode
– On the disk there is an inode table, or inode list, that
contains the inodes of all the files in the file system
– When a file is opened its inode is brought into main
memory and stored in a memory resident inode table

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
UNIX File Access Control (2 of 3)
• Directories are structured in a hierarchical tree
– May contain files and/or other directories
– Contains file names plus pointers to associated inodes

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
UNIX File Access Control (3 of 3)
• Unique user identification
number (user ID)

• Member of a primary group

identified by a group ID

• Belongs to a specific group

• 12 protection bits
– Specify read, write, and
execute permission for the
owner of the file, members
of the group and all other
users
Figure 4.5 UNIX File Access Control
• The owner ID, group ID, and
protection bits are part of the
file’s inode
Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Traditional UNIX File Access Control
• “Set user ID”(SetUID)
• “Set group ID”(SetGID)
– System temporarily uses rights of the file owner/group in addition
to the real user’s rights when making access control decisions
– Enables privileged programs to access files/resources not
generally accessible
• Sticky bit
– When applied to a directory it specifies that only the owner of
any file in the directory can rename, move, or delete that file
• Superuser
– Is exempt from usual access control restrictions
– Has system-wide access
Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Access Control Lists (ACLs) in UNIX
• Modern UNIX systems support ACLs
– FreeBSD, OpenBSD, Linux, Solaris

• FreeBSD
– Setfacl command assigns a list of UNIX user IDs and groups
– Any number of users and groups can be associated with a file
– Read, write, execute protection bits
– A file does not need to have an ACL
– Includes an additional protection bit that indicates whether the file has
an extended ACL

• When a process requests access to a file system object two steps are
performed:
– Step 1 selects the most appropriate ACL
– Step 2 checks if the matching entry contains sufficient permissions
Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.5 UNIX File Access Control

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.6 Users, Roles, and Resources

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.7 Access Control Matrix
Representation of RBAC

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.8 A Family of Role-Based
Access Control Models

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Table 4.4 Scope RBAC Models
Models Hierarchies Constraints
R B A C sub 0

RBAC0 No No
R B A C sub 1

RBAC1 Yes No
R B A C sub 2

RBAC2 No Yes
R B A C sub 3

RBAC3 Yes Yes

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.9 Example of Role Hierarchy

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Constraints - RBAC
• Provide a means of adapting RBAC to the specifics of administrative and
security policies of an organization

• A defined relationship among roles or a condition related to roles

• Types:
– Mutually exclusive roles
▪ A user can only be assigned to one role in the set (either during a
session or statically)
▪ Any permission (access right) can be granted to only one role in the set
– Cardinality
▪ Setting a maximum number with respect to roles
– Prerequisite roles
▪ Dictates that a user can only be assigned to a particular role if it is
already assigned to some other specified role

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Attribute-Based Access Control (ABAC)
• Can define authorizations that express conditions on properties
of both the resource and the subject
• Strength is its flexibility and expressive power
• Main obstacle to its adoption in real systems has been concern
about the performance impact of evaluating predicates on both
resource and user properties for each access
• Web services have been pioneering technologies through the
introduction of the eXtensible Access Control Markup Language
(XAMCL)
• There is considerable interest in applying the model to cloud
services
Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
ABAC Model: Attributes
• Subject attributes
– A subject is an active entity that causes information to flow among objects
or changes the system state
– Attributes define the identity and characteristics of the subject

• Object attributes
– An object (or resource) is a passive information system-related entity
containing or receiving information
– Objects have attributes that can be leverages to make access control
decisions

• Environment attributes
– Describe the operational, technical, and even situational environment or
context in which the information access occurs
– These attributes have so far been largely ignored in most access control
policies
Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
ABAC
• Distinguishable because it controls access to objects by
evaluating rules against the attributes of entities, operations,
and the environment relevant to a request
• Relies upon the evaluation of attributes of the subject,
attributes of the object, and a formal relationship or access
control rule defining the allowable operations for subject-object
attribute combinations in a given environment
• Systems are capable of enforcing DAC, RBAC, and MAC
concepts
• Allows an unlimited number of attributes to be combined to
satisfy any access control rule

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.10 ABAC Scenario

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.11 ACL and ABAC Trust
Relationships

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
ABAC Policies
• A policy is a set of rules and relationships that govern
allowable behavior within an organization, based on the
privileges of subjects and how resources or objects are to
be protected under which environment conditions
– Typically written from the perspective of the object
that needs protecting and the privileges available to
subjects
• Privileges represent the authorized behavior of a subject
and are defined by an authority and embodied in a policy
– Other terms commonly used instead of privileges are:
rights, authorizations, and entitlements

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Identity, Credential, and Access
Management (ICAM)
• A comprehensive approach to managing and implementing digital
identities, credentials, and access control
• Developed by the U.S. government
• Designed to:
– Create trusted digital identity representations of individuals and
nonperson entities (NPEs)
– Bind those identities to credentials that may serve as a proxy for
the individual of NPE in access transactions
▪ A credential is an object or data structure that authoritatively
binds an identity to a token possessed and controlled by a
subscriber
– Use the credentials to provide authorized access to an agency’s
resources
Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.12 Identity, Credential, and
Access Management (ICAM)

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Identity Management (1 of 2)
• Concerned with assigning attributes to a digital identity and
connecting that digital identity to an individual or NPE
• Goal is to establish a trustworthy digital identity that is
independent of a specific application or context
• Most common approach to access control for applications and
programs is to create a digital representation of an identity for
the specific use of the application or program
• Maintenance and protection of the identity itself is treated as
secondary to the mission associated with the application

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Identity Management (2 of 2)
• Final element is lifecycle management which includes:
– Mechanisms, policies, and procedures for protecting
personal identity information
– Controlling access to identity data
– Techniques for sharing authoritative identity data with
applications that need it
– Revocation of an enterprise identity

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Credential Management (1 of 2)
• The management of the life cycle of the credential
– Examples of credentials are smart cards, private/public
cryptographic keys, and digital certificates
• Encompasses five logical components:
– An authorized individual sponsors an individual or entity for a
credential to establish the need for the credential
– The sponsored individual enrolls for the credential
▪ Process typically consists of identity proofing and the capture
of biographic and biometric data
▪ This step may also involve incorporating authoritative
attribute data, maintained by the identity management
component

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Credential Management (2 of 2)
– A credential is produced
▪ Depending on the credential type, production may involve
encryption, the use of a digital signature, the production of a
smart card or other functions
– The credential is issued to the individual or NPE
– A credential must be maintained over its life cycle
▪ Might include revocation, reissuance/replacement,
reenrollment, expiration, personal identification number (PIN)
reset, suspension, or reinstatement

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Access Management
• Deals with the management and control of the ways entities are
granted access to resources
• Covers both logical and physical access
• May be internal to a system or an external element
• Purpose is to ensure that the proper identity verification is made
when an individual attempts to access a security sensitive building,
computer systems, or data
• Three support elements are needed for an enterprise-wide access
control facility:
– Resource management
– Privilege management
– Policy management
Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Three Support Elements Are Needed for an
Enterprise-Wide Access Control Facility:
• Resource management
– Concerned with defining rules for a resource that requires access control
– Rules would include credential requirements and what user attributes,
resource attributes, and environmental conditions are required for access
of a given resource for a given function

• Privilege management
– Concerned with establishing and maintaining the entitlement or privilege
attributes that comprise an individual’s access profile
– These attributes represent features of an individual that can be used as
the basis for determining access decisions to both physical and logical
resources
– Privileges are considered attributes that can be linked to a digital identity

• Policy management
– Governs what is allowable and unallowable in an access transaction
Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Identity Federation
• Term used to describe the technology, standards, policies,
and processes that allow an organization to trust digital
identities, identity attributes, and credentials created and
issued by another organization
• Addresses two questions:
– How do you trust identities of individuals from external
organizations who need access to your systems
– How do you vouch for identities of individuals in your
organization when they need to collaborate with
external organizations

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.13 Identity Information
Exchange Approaches (1 of 2)

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Open Identity Trust Framework (1 of 2)
• OpenID
– An open standard that allows users to be authenticated by
certain cooperating sites using a third party service
• OIDF
– OpenID Foundation is an international nonprofit organization of
individuals and companies committed to enabling, promoting,
and protecting OpenID technologies
• ICF
– Information Card Foundation is a nonprofit community of
companies and individuals working together to evolve the
Information Card ecosystem

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Open Identity Trust Framework (2 of 2)
• OITF
– Open Identity Trust Framework is a standardized, open
specification of a trust framework for identity and attribute
exchange, developed jointly by OIDF and ICF
• OIX
– Open Identity Exchange Corporation is an independent, neutral,
international provider of certification trust frameworks conforming
to the OITF model
• AXN
– Attribute Exchange Network is an online Internet-scale gateway
for identity service providers and relying parties to efficiently
access user asserted, permissioned, and verified online identity
attributes in high volumes at affordable costs
Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.13 Identity Information
Exchange Approaches (2 of 2)

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Table 4.5 Functions and Roles for
Banking Example (1 of 3)
(a) Functions and Official Positions
Role Function Official Position
A financial analyst Clerk
B financial analyst Group Manager
C financial analyst Head of Division
D financial analyst Junior
E financial analyst Senior
F financial analyst Specialist
G financial analyst Assistant
… … …
X share technician Clerk
Y support e-commerce Junior
Z office banking Head of Division

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Table 4.5 Functions and Roles for
Banking Example (2 of 3)
(b) Permission Assignments
Role Application Access Right
A money market Instruments 1, 2, 3, 4
A derivatives trading 1, 2, 3, 7, 10, 12
A interest instruments 1, 4, 8, 12, 14, 16
B money market instruments 1, 2, 3, 4, 7
B derivatives trading 1, 2, 3, 7, 10, 12, 14
B interest instruments 1, 4, 8, 12, 14, 16
B private consumer instruments 1, 2, 4, 7
… … …

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Table 4.5 Functions and Roles for
Banking Example (3 of 3)
(c) Permission Assignment with Inheritance
Role Application Access Right
A money market Instruments 1, 2, 3, 4
A derivatives trading 1, 2, 3, 7, 10, 12
A interest instruments 1, 4, 8, 12, 14, 16
B money market instruments 7
B derivatives trading 14
B private consumer instruments 1, 2, 4, 7
… … …

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Figure 4.14 Example of Access Control
Administration

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Summary (1 of 2)
• Access control principles • Role-based access control
– Access control context – RBAC reference models
– Access control policies • Attribute-based access control
• Subjects, objects, and access rights – Attributes
– ABAC logical architecture
• Discretionary access control
– ABAC policies
– Access control model
• Identity, credential, and
– Protection domains
access management
• UNIX file access control – Identity management
– Traditional UNIX file access – Credential management
control
– Access management
– Access control lists in UNIX
– Identity federation
Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Summary (2 of 2)
• Trust frameworks
– Traditional identity exchange approach
– Open identity trust framework
• Bank RBAC system

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved
Copyright

This work is protected by United States copyright laws and is

provided solely for the use of instructors in teaching their
courses and assessing student learning. Dissemination or sale of
any part of this work (including on the World Wide Web) will
destroy the integrity of the work and is not permitted. The work
and materials from it should never be made available to students
except by instructors using the accompanying text in their
classes. All recipients of this work are expected to abide by these
restrictions and to honor the intended pedagogical purposes and
the needs of other instructors who rely on these materials.

Copyright © 2018, 2015, 2012 Pearson Education, Inc. All Rights Reserved