Bài giảng Bảo mật cơ sở dữ liệu - Chương 3: Access Control Discretionary Access Control trình bày 2 nội dung chính là Access Control và Discretionary Access Control. Đây là một tài liệu hữu ích dành cho các bạn sinh viên ngành Công nghệ thông tin dùng làm tài liệu học tập và nghiên cứu.
Trang 1Access Control
Trang 3Access Control
Sx ‘“‘Access control” is where security engineering meets computer science
%x Its function is to control which (active) subject have access
Trang 4Access Control
%x Determine whether a principal can perform a requested operation on a target object
- Principal: user, process, etc
- QOperation: read, write, etc - Object: file, tuple, etc
%x Lampson defined the familiar access matrix and its two
Trang 5Why are we still talking about
access control?
xx An access control policy is a specification for an access
decision function
3x The policy aims to achieve
- Permit the principal’s intended function (availability)
- Ensure security properties are met (integrity, confidentiality)
Limit to “Least Privilege,” Protect system integrity, Prevent unauthorized leakage, etc
Also known as ‘constraints’
Trang 6Example: Access Control
%x Prof Alice manages access to course objects > Assign access to individual (principal: Bob) > Assign access to aggregate (course-students)
> Associate access to relation (students(course))
> Assign students to project groups (student(course, project,
group))
%x Prof Alice wants certain guarantees
> Students cannot modify objects written by Prof Alice > Students cannot read/modify objects of other groups %x Prof Alice must be able to maintain access policy
> Ensure that individual rights do not violate guarantees
Trang 7Access Control is Hard Because
sx Access control requirements are domain-specific
-— Generic approaches over-generalize
Xš Access control requirements can change
- Anyone could be an administrator
Xš The Safety Problem [HRU76]
- Can only know what is leaked right now
%= Access is fail-safe, but Constraints are not
Trang 8Safety Problem
%x Determine if an unauthorized permission is leaked given
- An initial set of permissions and
- An access control system, mainly administrative operations
Sx For a traditional approach, the safety problem is
undecidable
- Access matrix model with multi-operational commands
- Main culprit is create — create object/subject with own rights - Prove reduction of a Turing machine to the multi-operational
Trang 9Safety Problem
Result led to
%x Safe, but limited models: take-grant, schematic protection model, typed access matrix model
$x Further support for models in which the constraints are implicit in the model
- e.g., lattice models
Trang 10Compare to Other CS Problems
%x Processor design
- Hard, but can get some smart people together to construct one,
fixed, testable design
%=x Network protocol design
- TCP: A small number of control parameters necessary to manage
all reasonable options, within a layered architecture
- Constraints, such as DDoS, are ad hoc
Sx Software design
Trang 11Access Control Models
%x Discretionary Access Matrix
- UNIX, ACL, various capability systems
%x Mandatory (Usually) Access Matrix
- TE, RBAC, groups and attributes, parameterized
Xš Plus Transitions
- DTE, SELinux, Java
Trang 12Administration
%x Discretionary Access Control
- Users (typically object owner) can decide permission assignments
%=x Mandatory Access Control
- System administrator decides on permission assignments
%x Flexible Administrative Management
- Access control models can be used to express administrative
Trang 13Type Enforcement | BoebertKain84] oe =
Subject Type Can Access Object Type To Perform Operations
Trang 15Access Control
** Discretionary Access Control
- Access Matrix Model
- Implementation of the Access Matrix
Trang 16Discretionary Access Control
Discretionary Access Control is an individual user can set an access control mechanism to allow or deny
access to an object
Relies on the object owner to control access
DAC is widely implemented in most operating systems, and we are quite familiar with it
Strength of DAC: Flexibility: a key reason why it is widely known and implemented in mainstream
Trang 17Discretionary Access Control
Access to data objects (files, directories, etc.) Is
permitted based on the identity of users
Explicit access rules that establish who can, or
Cannot, execute which actions on which resources
Discretionary: users can be given the ability of passing on their privileges to other users, where granting and revocation of privileges is regulated
Trang 18Discretionary Access Control
* DAC 1s flexible in terms of policy specification
* This is the form of access control widely implemented in standard multi-user platforms
Trang 19
Limitation of DAC
%x Global policy: DAC let users to decide the access control policies on their data, regardless of whether those policies are consistent with the global policies Therefore, if there is a global policy, DAC has trouble to ensure consistency
%x Information flow: information can be copied from one object to another, so access to a copy is possible even if the owner of the original does not provide access to the riginal copy This has been a major concern for military
%x Malicious software: DAC policies can be easily changed by owner, sO a_ malicious program (e.g.,a downloaded untrustworthy program) running by the owner can change DAC policies on behalf of the owner
Trang 20Discretionary Access Control
x Access control matrix
- Describes protection state precisely - Matrix describing rights of subjects
- State transitions change elements of matrix
* State of protection system
Trang 21Access Control
x Discretionary Access Control
- Access Control Matrix Model
- Implementation of the Access Matrix
Trang 22Access Control Matrix Model
xx Access control matrix
- Firstly identify the objects, subjects and actions - Describes the protection state of a system
- State of the system 1s defined by a triple (S, O, A)
* Sis the set of subject, * Ois the set of objects, * Ais the access matrix
- Elements indicate the access rights that subjects have on objects
Trang 23Description objects (entities) ol om sl sn %x Subjects S = { sl, ,sn } sl %x Objects O = { ol, v2 ,0m } Xš Rights # = { rl, ,rk } *< Entries A[si, oj] Ñ k Xš A[si, oj] = { rx, ., ry } means subject sz has rights rx, ., ry over File 1 File 2 File 3 Program 1 object oj
Trang 24Boolean Expression Evaluation
xx ACM controls access to database fields
- Subjects have attributes
- Action/Operation/Verb define type of access - Rules associated with objects, action pair
** Subject attempts to access object
Trang 25Example xx Subject Annie - Attributes role (artist), groups (creative) x Verb paint - Default O (deny unless explicitly granted) x Object picture - Rule:
Annie paint picture if:
‘artist’ in subject.role and
‘creative’ in subject.groups and
Trang 26ACM at 3AM and IOAM
Trang 27Access Controlled by History
sx Statistical databases need to Name | Position [Age [Salary |
— answer qu eri es on or oup S Alice Teacher 45 40K — prevent revelation of individual | Bob Aide 20 | 20K records Cathy Principal | 37 60K be X Query-set-overlap control Dilbert | Teacher |50 | 50K - Prevent an attacker to obtain
Trang 28Access Controlled by History
*< Query 1: [Name | Position | Age | Salary - Celia Teacher 45 - sum_salary(position = teacher) -— Answer: l40K *< Query 2:
- sum_salary(age > 40 & position =
teacher) Pe en [ae [Sa
- Should not be answered as Matt s|€ela | Teacher | 45
Trang 29Solution: Query Set Overlap Control
(Dobkin, Jones & Lipton `79)
* Query valid if intersection of query coverage and each previous query <r
x Can represent as access control matrix
- Subjects: entities issuing queries
- Objects: Powerset of records
— Os(i) : objects referenced by s in queries Ÿ ;
- M[s,o] = read iff V œ‹| <r
Trang 30Solution: Query Set Overlap Control
(Dobkin, Jones & Lipton `79)
* Query |: Ol = {Celia, Leonard, Matt} so the
query can be answered Hence
asker, Celia] = {read} asker, Leonard] = {read} asker, Matt] = {read}
* Query 2: O2 = {Celia, Leonard} but |O2 7™ O11=
2; so the query cannot be answered
Trang 31Access Control
x Discretionary Access Control
- Access Matrix Model
Trang 32ACM Implementation
xx ACM is an abstract model
- Rights may vary depending on the object involved
xx ACM is implemented primarily in three ways
- Authorization Table - Capabilities (rows)
Trang 33Authorization Table
Trang 34Access Control List (ACL)
%x Matrix is stored by column
%x Each object is associated with a list
%x Indicate for each subject the actions that the subject can exercise on the object
Trang 35Capability List
Xš Matrix is stored by row
%x Each user is associated with a capability list
Trang 36ACLs vs Capability List
** Immediate to check the authorization holding on an object with ACLs (subject?)
xx Immediate to determine the privileges of a subject with Capability lists (object?)
x Distributed system,
- authenticate once, access various servers
- choose which one?
xx Limited number of groups of users, small bit vectors, authorization specified by owner
Trang 37Basic Operations in Access Control x Grant permissions - Inserting values in the matrix’s entries x Revoke permissions —- Remove values from the matrix’s entries x Check permissions
Trang 38Access Control Discretionary Access Control
- Access Matrix Model
- State of Protection System
- Implementation of the Access Matrix
Trang 39Vulnerabilities of the Discretionary Policies
* No separation of users from subjects
*< No control on the flow the information
Trang 40Example
x Vicky, a top-level manager
X A file Market on the new products release
** John, subordinate of Vicky
X A file called “Stolen” with two hidden
operations
Trang 41Example (cond) Application read Market write Stolen File Market File Stolen
Aug 00; product X; price 7,000 Dec 00; product Y; price 3,500
Jan 01; product Z; price 1,200
owner Vicky owner John
Trang 42Example (cond) invokes Vicky Application read Market write Stolen File Market File Stolen
Aug 00; product X; price 7,000 Aug 00; product X; price 7,000
Dec 00; product Y; price 3,500 Dec 00; product Y; price 3,500
Jan 01; product Z; price 1,200 Jan 01; product Z; price 1,200
owner Vicky owner John
( Vicky,write,Stolen )
Restriction should be enforced on the operations that processes themselves can execute
Trang 43Access Control
x Discretionary Access Control
- Access Matrix Model
- State of Protection System
- Implementation of the Access Matrix
Trang 44DAC — additional features and recent trends
x Flexibility is enhanced by supporting different kinds of permissions
- Positive vs negative - Strong vs weak
Trang 45Positive and Negative
Permissions
Positive permissions > Give access * Negative permissions > Deny access
* Useful to specify exceptions to a given
policy and to enforce stricter control on
Trang 46Positive and Negative
Permissions
Trang 47Authorization Conflicts
*< Main solutions:
- No conflicts
- Negative permissions take precedence - Positive permissions take precedence - Nothing take precedence
Trang 48Weak and Strong Permissions
x Strong permissions cannot be overwritten
* Weak permissions can be overwritten by
Trang 49Implicit and Explicit Permissions
x Some models support implicit permissions * Implicit permissions can be derived:
— by a Set of propagation rules exploiting the subject, object, and privilege hierarchies
Trang 50Derivation Rules: Example
x Ann can read file Fl from a table if Bob has an explicit denial for this access
*'Tom has on file F2 all the permissions that Bob has
Trang 51Derivation Rules
* Derivation rules are often expressed according to logic programming
x Several research efforts have been carried out to compare the expressive power of such languages
Trang 52Content-based Permissions
xx Content-based access control conditions the access to a given object based on its content
xx This type of permissions are mainly relevant for database systems
xx As an example, in a RDBMS supporting content- based access control it 1s possible to authorize a
subject to access information only of those
Trang 53Content-based Permissions
*'T'wo most common approaches to enforce
content-based access control in a DBMS are done:
— by associating a predicate (or a Boolean combination of predicates) with the
permission
— by defining a view which selects the objects whose content satisfies a given condition, and then granting the permission on the view
Trang 54DAC models - DBMS vs OS
*< Increased number of objects to be protected
*< Different granularity levels (relations, tuples,
single attributes)
*< Protection of logical structures (relations, views)
instead of real resources (files)
%x Different architectural levels with different
protection requirements
** Relevance not only of data physical
Trang 55Cost Benefits
%x Saves about 7.01 minutes per employee, per year in administrative functions
- Average IT admin salary - $59.27 per hour
- The annual cost saving is:
* $6,924/1000; $692,471/100,000
%x Reduced Employee downtime
if new transitioning employees receive their system privileges faster, their productivity is increased
26.4 hours for non-RBAC; 14.7 hours for RBAC
For average employee wage of $39.29/hour, the annual productivity cost savings yielded by an RBAC system:
Trang 57Graph-based models
xx A graphical model or probabilistic graphical
model (PGM) is a probabilistic model for which
a graph expresses the conditional dependence structure between random variables
xx They are commonly used inprobability theory,