Access Control

• Fundamental concept:
  • Protection System (specification)
  • Reference monitor (enforcement mechanism)
• Models:
  • Discretionary Access Control
  • Mandatory Access Control

Definitions

• Access Control: Control the permissions of subjects on objects
• Access Control Policy: Set of rules after which access should be granted
• Subject: Entity performing an action (e.g., users, processes)
• Object: Entity on which an action is performed (e.g., resource, file)
• Operation: Action to be taken
• Access control mechanism
  • Enforces Access Control Policy
  • Authorize requests from subject to object
  • Enforcement levels
    • Operating System: TCB (determine security by allowed control flows)
    • Applications: Database, JVM, Browser, Python
    • Multi-layered: Virtual Machine + OS + Application
  • Important: All layers should be consistent with system security goals
• Safety problem:
  • Ensure that current and future protection states ensure security goals
  • Given:
    • Set of rules (policy)
    • Initial access matrix
    • Generic access right a
  • Task: Manipulate matrix using policy so that any subject gets a
  • Problem: Undecidible

Protection System

• Definition Protection System
  • Define access control specification
  • Protection state
    • Operations that subjects can perform on objects
    • e.g., State of access Matrix
  • Set of protection state operations
    • Modify protection state
    • Important for adding new subjects/objects
• Defintion Protection Domain
  • Set of objects and actions a process can perform
• Goals
  • Determine whether the enforcement mechanism enforces policy correctly
  • Determine whether the policy expresses effective goals

Reference monitor

• Purpose: Access control enforcement mechanism
• Components
  • Reference monitor interface (e.g., LSM)
  • Reference validation mechanism (e.g., SELinux)
  • Policy store (e.g., policy database) Is this the implementation???
• Reference monitor concept (guarantees)
  • This is a major focus of the course
  • Complete Mediation
  • Tamperproof
  • Verifiable

Complete mediation

• Always be invoked for security-sensitive calls
• Security-sensitive call: Operation that may not be authorized for every subject
• Evaluation criteria:
  • Interface mediates all requests?
  • All resources mediated?
  • Verifiability to enforce security goals?

Tamperproof

• Not modifiable by untrusted entities (e.g., subjects)
• Not modifiable code/data affecting reference monitor
• Detection of tamperproofing: Integrity guarantees (e.g., Biba)
• Evaluation criteria:
  • Is reference monitor protected?
  • Is system TCB protected?

Verifiable

• Subject to analysis/tests
• Determine correctness of code/policy
• Test/analyse reference validation mechanism
• Evaluation criteria:
  • Is TCB code correct?
  • Enforcement of security goals of system by protection system?

Discretionary Access Control

• Definition
  • Access is based on user’s identity/groups
  • User can pass access rights to other users
• Prominent example: Lampson’s Access Matrix
• Two classes:
  • Capabilities: Subject has list of objects with actions
  • Access Control List: Object has list of allowed subjects

Lampson’s Access Matrix

• Lampson (1970)
• Matrix indicating access rights for certain operation
• Rows: Subjects (e.g, users, processes)
• Columns: Objects (e.g., resources, files)
• Cell contains information if action is allowed (authorized operations)
• Problem: Doesn’t protect security goals
  • Malicious code executed by user can change permissions (i.e., change protection state)
  • e.g., change permissions

UNIX Access Control

• Objects: Files, sockets, etc.
• Model: Access Control List (columns of ACM)
• Additional roles
• Discretionary protection state:
  • Subjects may change protection state
  • e.g., add access for others

Mandatory Access Control

• Definition
  • Access is based on rules
  • Rules can’t be changed by user

Mandatory Protection System (MPS)

• Task: Define security goals/access control specification
• Modified only by trusted administrators
• Immutable to user-space processes
• Components
  • Mandatory protection state
  • Labeling state
  • Transition state
• Challenges:
  • How to set up a MPS?
  • How to manage a MPS?
  • Status quO: Dynamic analysis to setup Mandatory Access Control policy (e.g., kRazor)
  • Problem:
    • This results in a functional policy
    • => Can’t solve safety problem
• Stakeholders:
  • Programmers (what do they need to know?)
  • OS Distributor
  • Administrators
  • Users

Mandatory protection state

• Definition of protection state
• Immutable set of labels
• Operations that subject labels can perform on object labels
• Matrix (subject labels/object labels/operations)
• Enforce security against bad code using labels

Labeling state

• Immutable mapping subjects/objects to labels
• e.g., for new subjects/objects
• Example:
  • New (malicious) process wants to modify kernel memory => Deny access/map to labels which does not have this privilege

Transition state

• Immutable relabeling strategies/rules for subjects/object
• Examples
  • Process reads adversary-controlled object label => Remove privileges
  • Process reads adversary-controlled object label => remove write-permission for objects which can be read by higher-level privileges