Information Security

Module: Access Control and Security Policies

Lesson: Access Control Prof. Rajesh Kumar
Topic: Introduction to Access Control
Access Control

Assumptions:
• System knows who the user is.
o Authentication via name and
password, another credential.
Access Reference
• Access requests pass through Subject
Request Monitor
Object
gatekeeper (reference monitor).
o System must not allow monitor to be Source Request Guard Resource
bypassed. (e.g. Users, (e.g. Files,
Processes) Printers)
Types of Access Control (Contd.)

Discretionary Access Control (DAC):

o Individual user sets access control mechanism to allow or deny access to

an object.

Mandatory Access Control (MAC):

o System mechanism controls access to object, and individual cannot alter

that access.

Role-Based Access Control (RBAC):

o Grants access based on a user role in an organisation.

Discretionary Access Control

Every object has an owner, who has total

control over that object.

Owners can create and access their objects

freely.

Owner can give permissions to other subjects

over these objects.

DAC has two significant weaknesses:

DAC relies on decisions by end-user to

set proper level of security.
Subject’s permissions will be ‘inherited’ by
any programs that the subject executes.
Mandatory Access Control

Mandatory Access Control (MAC) is a

restrictive access control model.

Faculty
MAC assigns users access controls strictly
according to custodian’s desires and user
has no freedom to set any controls.
Mandatory Access Control

Two key elements to MAC:

Labels - Every entity is an object (laptops,

files, projects, and so on) and assigned
classification label (confidential, secret, and
top secret) while subjects assigned
privilege label (A clearance).

Levels - Hierarchy based on labels is also Faculty

used, both for objects and subjects (top
secret is a higher level than secret).

MAC grants permissions by matching object

labels with subject labels based on their
respective levels.
Role-Based Access Control

Individuals Roles Resources

Engineering
Server 1

Server 2
Marketing

Server 3
Human res.

Advantage: Users change more frequently than roles.

Roles (Also Called Groups)

• Role = set of users:

o Administrator, power user, user, guest.
o Assign permissions to roles; each user gets Administrator
permission.

• Role hierarchy: Power User

o Partial order of roles.
o Each role gets permissions of roles below. User
o List only new permissions given to each role.
Guest
Example

Objects are bank accounts.

Subjects are bank employees.

The set of bank accounts forms a data type.

Faculty
We define roles:

Teller

Clerk

Administrator
Example

We define procedures for:

Crediting accounts (CA)

Debiting accounts (DA)

Faculty

Transferring funds between accounts (TF)

Creating new accounts (NA)

Example

We assign procedure:

CA and DA to the teller role

TF to the clerk role

Faculty

NA to the administrator role

The administrator role can run all the

procedures.
Access Control Matrix

Access control matrix is the simplest

framework for describing a protection system
describing the rights of subjects (users) over
objects (files) in a matrix form.

Can express any expressible security policy.

Faculty

In practice, though very simple in formulation, it

is not used directly because of space
requirements.
Access Control Matrix

• Let:
o S be the set of subjects
o O be the set of objects
o The access control matrix model shows the
relationship between subjects and objects,
captured by a matrix A, with rights drawn
from a set of rights R in each entry
A[s, o], where s ∈ S, o ∈ O, and A[s, o] ⊆ R. Faculty

[Link] [Link] [Link]

Alice {} {exec} {exec,read}
Bob {read,write} {exec} {exec,read,write}
Two Implementation Concepts

1 Access Control List (ACL)

Faculty
2 Capability
Access Control Lists (ACLs)

Focus on the object:

o Access rights are stored with the object.

o ACLs  columns of the access control matrix. Faculty

[Link] Alice: {exec} Bill: {exec,read,write}

Capabilities

Focus on the subject:

1 Access rights are stored with the

subject.
2 Capabilities  rows of the access
control matrix.

Alice [Link]: {exec} [Link]: {exec,read} Faculty

Capabilities

Good match between capabilities and

distributed system security.

Some aspects of capability concept are used in Faculty

Kerberos.
ACL vs Capabilities

• Validating access requests:

o ACLs: Linear with number of subjects.
o Capability: Just one
• Implementing when no groups are
supported:
o Capabilities: Easier
o ACLs: Need to enumerate all the subjects. Faculty
• Finding out who has access to an object:
o Capabilities: Difficult
Multi-Level Security (MLS) Concepts

Based on system of hierarchical security

levels and a system of non-hierarchical
security categories.

Idea is twofold: Prevent unauthorised

access and do not let classified information Faculty
leak to unclassified files.

Based on MAC: Multilevel security

enforcement is mandatory and automatic.
Confidentiality Policies

• Goal: To prevent the unauthorised

disclosure of information.
o Deals with information flow.
o Integrity protection is secondary.
• Multi-level security models are best-known
examples.
o Bell-LaPadula Model has been the basis for Faculty
many, or most, of these.
o Bell-LaPadula Model combines mandatory
and discretionary access controls.
Bell-LaPadula Model

Security levels arranged in linear ordering:

Top Secret: Highest

Secret

Confidential

Unclassified: Lowest Faculty

Levels consist of:

Subjects having security clearance L(s)

Objects have security classification L(o)

Example

Security level Subject Object

Top Secret Tamara Personnel Files

Secret Samuel E-Mail Files

Faculty
Confidential Claire Activity Logs

Unclassified James Telephone Lists

Reading Information

Simple Security Condition:

Security level Subject Object
Subject s can read object o if security
classification L(o) ≤ security clearance L(s) Top Secret Tamara Personnel Files
and s has permission to read o.
Secret Samuel E-Mail Files

Information Flows Up, Not Down: Confidential Claire Activity Logs

Unclassified James Telephone Lists

‘Reads up’ disallowed, ‘reads down’ allowed.
Writing Information

Property (Star Property): Subject s can write

object o if security clearance L(s) ≤ security Security level Subject Object
classification L(o) and s has permission to write o.
Top Secret Tamara Personnel Files

Secret Samuel E-Mail Files

Information Flows Up, Not Down:
Confidential Claire Activity Logs

Unclassified James Telephone Lists

‘Writes up’ allowed, ‘writes down’ disallowed.
Basic Security Theorem

If a system is initially in a secure state, and

every transition of the system satisfies the
simple security condition, and the *property
then every state of the system is secure. Faculty
Bell-LaPadula Model Refinements: The
Need-to-Know Principle
• Even if someone has all the necessary
official approvals (such as a security
clearance) to access certain information,
they should not be given access to such
information unless they have a need to
know, that is, unless access to the specific
information is necessary for the conduct of
one's official duties. Faculty
• Can be implemented using categories and/
or DAC.
Bell-LaPadula Model Refinements

Expand notion of security level to include

categories.

Security level is (clearance, category set).

Examples:
Faculty
o (Top Secret, {NUC, EUR, ASI})
o (Confidential, {EUR, ASI)
o (Secret, {NUC, ASI })
Levels and Lattices

• (A, C) dom (A, C) iff A ≤ A and C  C.

• Examples:
o (Top Secret, {NUC, ASI}) dom (Secret,
{NUC}).
o (Secret, {NUC, EUR}) dom
(Confidential,{NUC, EUR}).

o (Top Secret, {NUC}) - dom (Confidential, Faculty
{EUR}).
The Lattice Hierarchy

{NUC, EUR, US}

{NUC, EUR} {NUC, US} {EUR, US}

{NUC} {EUR} {US}

ϕ
An Example of Dom Relationship

George is cleared into security level (S, {NUC,

EUR})

DocA is classified as (C, {NUC})

DocB is classified as (S, {EUR, US})

DocC is classified as (S, {EUR}) Faculty

George dom DocA

George  dom DocB

George dom DocC

Integrity Policies Overview

They are very different from confidentiality

policies.

They are concerned more with accuracy of

data than their disclosure - e.g. banks. Faculty

They are mostly used in commercial and

industrial environments.
Principles of Operation

• Separation of Duty (Distribute critical

function steps among different people)
o Errors can be caught.
o Data can be verified correctly.
• Separation of Function (Real system
cannot be used by the developers)
o It should be similar to the actual Faculty
environment but not while running.
Principles of Operation

• Auditing:
o Analyse to determine what actions and who
performed them.
o Allow widespread assessment.
• Need extensive logging:
o Emphasis on recovery and accountability.
Faculty
Biba Integrity Model - 1

Introduced by Ken Biba in 1977~ > 45 years.

Use integrity levels (similar to security levels in

BLP model).

The higher the level, the more is the Faculty

confidence and trust:

o That a program will execute correctly.

o That data is accurate and/or reliable.

Note: Relationship between integrity and

trustworthiness.
Biba Integrity Model - 2

Subject may be higher level than an object =

Subject is considered more trustworthy than that
object.

Important point: Integrity levels are not security

levels. Faculty

Integrity labels are assigned and maintained

separately due to differences in reasoning.
Biba Integrity Model - 2

Security Labels: Information flow

Faculty
Integrity Labels: Information modification
Biba Integrity Model: Operations

B-LP Upside-Down:

o “no read down” rule (NRD)

o “no write up” rule (NWU)
Read

Integrity Levels:
Write
o Not disclosure levels
Clark-Wilson Integrity Model

• Introduced by David Clark and David

Wilson in 1987 ~ > 35 years.
• Integrity model specifically targeting
commercial applications.
• Built on several well-known accounting
practices in traditional businesses.
o No security levels: Unlike B-LP and Biba. Faculty
o Targets:
✓ Data: Integrity of data.
✓ Procedure: Permission of actions allowed
on that data.
o More realistic than B-LP and Biba.
Clark-Wilson Integrity Model

Integrity is defined by a set of constraints:

Data and Transaction
1. Data in consistent or valid state when it
satisfies these constraints.
o Example: Deposits and withdrawals in a
bank.
✓ D today’s deposits, W withdrawals, YB
yesterday’s balance, TB today’s
Faculty
balance.
✓ Integrity constraint: 𝐷 + 𝑌𝐵 – 𝑊 = 𝑇𝐵.
Clark-Wilson Integrity Model

Integrity is defined by a set of constraints:

Data and Transaction
2. Well-formed transaction only moves the
system within consistent states.
o State Consistency hold (verified) Before
and After Transaction.
o Correct Transactions: Who examines,
certifies transactions done correctly? Faculty
✓ E.g. invoice paying in a purchasing
department (5 steps).
✓ » 1-request received; 2-determine
account for payment; 3-validate
invoice according to service needed;
4-account should assume debited;
5-check written and signed.
Data

CDI (Constrained Data Items)

D is all the data in a computing system
1
(e.g. files in OS).

Two types of data: CDI and UDI

2 o 𝐷 = 𝑪𝑫𝑰 𝑈 𝑼𝑫𝑰
UDI (Unconstrained Data Items)
o 𝑪𝑫 ∩ 𝑼𝑫𝑰 = 𝜑
Entities

TPs: Transaction Procedures

Procedures that take the system from
one valid state to another.

Example: (Bank) Faculty

Balances in the accounts are (CDI),
Checking the accounts are balanced
(IVP), depositing, withdrawing money
(TPs), (UDI)????.
Clark-Wilson Model Rules

The model consists of 9 rules:

o 5 certification rules (CRs)

o 4 enforcement rules (ERs)

Faculty
The rules are expressed with respect to a given
computing system.

The rules are adopted collectively.

Comparison to Biba

Biba:
o No notion of certification rules; trusted
subjects ensure actions obey rules.
o Untrusted data examined before being made
trusted.

Faculty
Clark-Wilson:
o Explicit requirements that actions must
meet.
o Trusted entity must certify method to
upgrade untrusted data (and not certify the
data itself).
Hybrid Policies

Organisations rarely limit security objectives to

just confidentiality or integrity. Most aim for a
combination.

This lesson introduces one of the models that Faculty

address these objectives:

o Chinese Wall Model

✓ It prevents conflicts of interest.
Chinese Wall Model

Problem:

Anas advises Bank A about investments.

He is asked to advise Bank B about

investments. Faculty
Conflict of interest to accept, because his advice
to either bank would affect his advice to the other
bank.
Definitions

• Objects (O): Items of information related to

a company.
• Company dataset (CD): Contains objects
related to a single company.
o Written CD(O): Company dataset containing
object O.
• Conflict of interest class (COI): Contains Faculty
datasets of companies in competition.
o Written COI(O): COI class containing
object O.
o Assume: Each object belongs to exactly one
COI class.
Example: Chinese Wall (CW) Model Database
• It has two COI classes: For banks contains 3 CDs, for gasoline companies, contains four
CDs.
o Any employee may have access to no more than one CD in each COI.
o He could access Citibank's CD and ARCO's CD, but not Citibank's CD and Bank of America's CD.

Bank COI Class Gasoline Company COI Class

Bank of America Shell Oil Standard Oil

Citibank Bank of the West Union ’76 ARCO

Temporal Element

Chinese Wall model considers a user’s

history.

If Anas reads any CD in a COI, he can

never read another CD in that COI.
Faculty

In Android Studio, go to the

"Tools" menu and select
"Device Manager”
Temporal Element

Ahmad & Sami work in the same trading house.

Ahmad can read Bank 1’s CD, Gas’ CD.

Sami can read Bank 2’s CD, and same Gas’ CD. Faculty

If Ahmad could write to Gas’ CD, Sami can

read it: Sami can read information from Bank 1’s
CD, leading to the same conflict of interest.
Temporal Element

• CW-Simple Security Condition

o Let PR(S) be set of objects that S has
already read.
o S can read o if either condition holds:
✓ There is an o′ such that s has accessed o′
and CD(o′) = CD(o).
✓ (Meaning s has read something in os Faculty
dataset).
✓ For all o′ ∈ PR(s), COI (o′) ∈ COI (o).
✓ (Meaning s has not read any objects in
os conflict of interest class).
CW-*-Property

s can write to o if both of the following hold:

The CW-simple security condition

permits s to read o.

For all un-sanitised objects o', if s can Faculty

read o', then CD(o') = CD(o).

Says that s can write to an object if all the objects it

can read are in the same dataset.
Compare to Bell-LaPadula

Fundamentally Different

CW has no security labels, B-LP does.

CW has notion of past accesses, B-LP does

not.

Bell-LaPadula can capture state at any time. Faculty

Bell-LaPadula cannot track changes over time.