Scribd
Upload
14 views13 pages

Access Control Systems Overview

Access control is the process of granting or denying requests to obtain information or enter physical facilities. It regulates the use of system resources according to a security policy by permitting access only to authorized entities. There are several models of access control including discretionary access control, which controls access based on the identity of the requestor and access rules, and mandatory access control, which controls access based on comparing security labels to clearances. Access control manages subjects (entities requesting access), objects (resources being accessed), and access rights (permissions to access objects like read, write, execute).

Uploaded by

makangara22
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
14 views13 pages

Access Control Systems Overview

Access control is the process of granting or denying requests to obtain information or enter physical facilities. It regulates the use of system resources according to a security policy by permitting access only to authorized entities. There are several models of access control including discretionary access control, which controls access based on the identity of the requestor and access rules, and mandatory access control, which controls access based on comparing security labels to clearances. Access control manages subjects (entities requesting access), objects (resources being accessed), and access rights (permissions to access objects like read, write, execute).

Uploaded by

makangara22
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd

Information

Systems Security
Access Control
Access Control Definitions
1/2

The process of granting or denying specific requests to:


(1) obtain and use information and related information
processing services; and
(2) (2) enter specific physical facilities”
Access Control Definitions
2/2

A process by which use of system resources is


regulated according to a security policy and is
permitted only by authorized entities (users,
programs, processes, or other systems) according to
that policy
Access Control Principles
• In a broad sense, all of computer security is
concerned with access control

“measures that implement and assure security


services in a computer system, particularly those that
assure access control service”
Access Control Policies
• Discretionary access control • Role-based access control
(DAC) (RBAC)
o Controls access based on the identity o Controls access based on the roles
of the requestor and on access rules that users have within the system and
(authorizations) stating what on rules stating what accesses are
requestors are (or are not) allowed to allowed to users in given roles
do
• Attribute-based access
• Mandatory access control control (ABAC)
(MAC) o Controls access based on attributes of
o Controls access based on comparing the user, the resource to be accessed,
security labels with security and current environmental conditions
clearances
Subjects, Objects, and
Access Rights
Access
Subject Object
right

An entity capable of A resource to which access is Describes the way in which a


accessing objects controlled subject may access an object

Three classes Could include:


• Owner • Read
• Write
• Group Entity used to contain and/or • Execute
• World receive information • Delete
• Create
• Search
Discretionary Access Control
(DAC)
• Scheme in which an entity may be granted access rights that
permit the entity, by its own violation, to enable another entity
to access some resource
• Often provided using an access matrix
o One dimension consists of identified subjects that may attempt data
access to the resources
o The other dimension lists the objects that may be accessed
• Each entry in the matrix indicates the access rights of a
particular subject for a particular object
Figure 4.2 Example of Access Control Structures
Table 4.2
Authorization
Table
for Files in
Figure 4.2

(Table is on page 113 in the textbook)


Protection Domains
• Set of objects together with access rights to those objects
• More flexibility when associating capabilities with protection
domains
• In terms of the access matrix, a row defines a protection domain
• User can spawn processes with a subset of the access rights of the
user
• Association between a process and a domain can be static or dynamic
• In user mode certain areas of memory are protected from use and
certain instructions may not be executed
• In kernel mode privileged instructions may be executed and
protected areas of memory may be accessed
UNIX File Access Control
UNIX files are administered using inodes (index
nodes)
• Control structures with key information needed for a particular file
• Several file names may be associated with a single inode
• An active inode is associated with exactly one file
• File attributes, permissions and control information are sorted in the
inode
• On the disk there is an inode table, or inode list, that contains the
inodes of all the files in the file system
• When a file is opened its inode is brought into main memory and
stored in a memory resident inode table

Directories are structured in a hierarchical tree

• May contain files and/or other directories


• Contains file names plus pointers to associated inodes
UNIX
File Access Control

 Unique user identification


number (user ID)
 Member of a primary group
identified by a group ID
 Belongs to a specific group
 12 protection bits
 Specify read, write, and
execute permission for the Figure 4.5 UNIX File Access Control
owner of the file, members
of the group and all other
users
 The owner ID, group ID, and
protection bits are part of the

Common questions

Powered by AI

The access matrix in DAC is a conceptual model where one axis lists subjects (users or processes) and the other lists objects (resources like files). Each cell in the matrix denotes the permissions for a subject-object pair, detailing specific access rights such as read, write, or execute. This structure allows for clear and administratively manageable assignment of permissions, helping organizations to implement fine-grained access controls .

The fundamental difference lies in who has control over resource permissions. MAC enforces policies set by the system, comparing security labels with clearances, and does not allow users to alter access controls, ensuring a high level of security and data protection. Conversely, DAC gives the resource owner the ability to decide who can access their resources, providing more flexibility but less centralized control, potentially leading to security vulnerabilities if mismanaged .

RBAC controls access based on defined roles within the system, assigning specific permissions according to users' job responsibilities. This means a user's access is determined by their role rather than individual attributes. ABAC, on the other hand, uses attributes associated with each user, resource, and current environmental conditions to determine access. This approach allows for more granular and dynamic access decisions compared to the fixed roles of RBAC .

DAC allows an entity such as a user to grant access rights to other entities, offering flexibility since the granting entity can manage access based on personal judgment. Often implemented using an access matrix, DAC enables specified entities to permit or deny access dynamically, as opposed to static policies set by administrators .

RBAC simplifies management by grouping users with similar roles, streamlining access permissions across the organization, which is beneficial in environments where roles are stable and well-defined. ABAC offers more flexibility and precision by allowing access decisions based on multiple user attributes and environmental variables, thereby efficiently managing complex and dynamically changing security policies in modern enterprises .

An inode in UNIX file access control contains essential metadata about a file, including its attributes, permissions, and control information. It contains pointers to the file's data blocks, ensuring that each inode is associated with precisely one file. This inode structure is maintained in an inode table on the disk and moved to main memory upon file access. It supports the hierarchical structure of directories and file management within the UNIX system .

In UNIX file access control, user IDs and group IDs are pivotal for managing access rights, determining which users or groups can read, write, or execute files. These IDs coupled with protection bits that specify permissions for the owner, group members, and others help enforce security by ensuring that access is provided only to the intended users, thereby preventing unauthorized actions on files .

The protection bits in UNIX file access control define permissions for the owner, group, and others, allowing precise control over who can read, write, or execute a file. By setting these bits appropriately, administrators can effectively categorize access levels, granting distinct permission settings for different classifications of users. This specificity is crucial for maintaining secure and organized file structures .

The hierarchical structure of directories in UNIX organizes files in a tree-like format, making it easier to implement and manage access control as permissions can be set at different levels, affecting entire branches or individual files. This organization aids in logical grouping and efficient tracking of file permissions, contributing to both improved access management and simplified navigation through the system .

Protection domains define a set of objects and the access rights permissible for these objects, which allows system administrators to specify precise security policies. By associating processes with protection domains dynamically or statically, systems can limit the scope of access depending on runtime conditions, considerably enhancing security. This capability ensures that only authorized processes can perform privileged operations, reducing the risk of unauthorized access .

You might also like