CSCE 465 Lecture 14

« previous | Tuesday, March 5, 2013 | next »

Security Theory I

Access Control Matrix and Foundational Results

Access Control Matrix

Protection state of system: describes current settings, values of system relevant to protection

State of system

• collection of current values of all memory location, storages, registers, etc.
• Subset of collection that deals with protection is protection state of system

Matrix

• Describes protection state precisely
• Matrix describing rights of subjects
• State transitions $⊢$ change elements of matrix
• Simplest abstraction mechanism for representing protection state.

|	objects (entities)
subjects | s1 |

• Objects and other subjects on columns
• Subjects on rows
• Rights in cells reflect subject's allowed actions, etc.

f | g | p | q

rwo | r | rwxo | w

a | ro | r | rwxo

State Transitions

Change protection state of system

State transitions due to commands

Represented by symbol $⊢$.

• $x_i{⊢}_{\tau }{x}_{i+1}$: command $\tau$ moves system from state $x_i$ to $x_{i+1}$.

Protection State Transitions

Represented by 6 primitive commands that update/alter matrix:

create subject $s$

creates new row and column

create object $o$

creates new column

destroy subject $s$

removes row and column corresponding to $s$

destroy object $o$

removes column corresponding to $o$

enter $r$ into $A[s,o]$

adds rights $r$from subject $s$ to object $o$

delete $r$ from $A[s,o]$

removes rights $r$from subject $s$ to object $o$

Example usage in transition commands:

(* Mono-operation command = single operation command *)
command make-owner(p, g)
  enter own into A[p,g];
end

(* Conditional Command = Applies operation if access is granted *)
command grant-read-file-1(p, f, q)
  if own in A[p,f] then
    enter r into A[q,f]
end

(* Multiple Conditions: let p give q r and w rights over f if p owns f and p has c rights over q *)
command grant-read-file-2(p,f,q)
  if own in A[p,f] and c in A[p,q] then
    enter r into A[q,f]
    enter w into A[q,f]
  end
end

Special Rights

• Copy rights allows possessor to grant rights to other
• Own rights enables possessors to add/delete privileges for themselves and others

Foundational Results

Given a computer system, how can we determine if it is secure?

Security vs. Safety

Let $R$ be set of generic (primitive) rights of system (no special rights)

When a generic right r is added to an element of access control matrix not already containing r, that right r is said to be leaked

• If a system can never leak a right r, it is said to be safe with respect to the right r.
• If a system can leak r, it is said to be unsafe with respect to right r

Safety refers to abstract model and security refers to actual implementation.

• Secure system corresponds to a model safe with respect to all rights
• However, a model safe with respect to all rights does not ensure a secure system

Our question can now be reworded into:

Does there exist an algorithm for determining whether a protection system S with initial state s_0 is safe with respect to a generic right r?

Here, "safe" = "secure" for an abstract model.

Algorithm exists, but only for case of mono-operational commands in which all states can be enumerated.

General Case: undecidable whether a given state of a protection system is safe for generic right

Security Policy and Models

X is a set of entities, I is information

Confidentiality

$I$ has confidentiality property with respect to $X$ if no $x\in X$ can obtain access to $I$.

Integrity

$I$ has integrity property with respect to $X$ if all $x\in X$ trust information in $I$.

Types:

• Trust the data contained in $I$
• Trust origin/identity of information in $I$

Availability

$I$ has availability property with respect to $X$ if all $x\in X$ can access $I$.

Example

Policy disallows cheating, including:

• Copying homework, with or without permission
• CSE class has students do homework on computer
• Anne forgets to read-protect her homework file
• Bill copies Anne's homework assignment

Bill cheated since

• Policy forbids copying homework assignment
• Bill did it
• System entered unauthorized state

• Anne didn't protect her homework (not required by security policy)
• She didn't breach security

Mechanisms

Entity or procedure that enforces some part of security policy

Access Control

Determines what rights a particular entity has for a set of objects

Answers questions like:

• Do you have right to read /etc/passwd?
• Does Alice right to view CSE website?

Access Control Policy

function $P(subj,obj,right)\to \{accept,deny\}$

Policy is a lot of these tuples, whether explicitly represented that way or not.

Matrix is shorthand notation