Bài giảng Bảo mật cơ sở dữ liệu - Chapter 3: Access Control-Discretionary Access Control

Nội dung text: Bài giảng Bảo mật cơ sở dữ liệu - Chapter 3: Access Control-Discretionary Access Control

1. Chapter 3 Access Control Discretionary Access Control
2. Agenda 1. Access Control 2. Discretionary Access Control
3. Access Control “Access control” is where security engineering meets computer science. Its function is to control which (active) subject have access to a which (passive) object with some specific access operation. Access Reference subject object request monitor
4. Access Control Determine whether a principal can perform a requested operation on a target object – Principal: user, process, etc. – Operation: read, write, etc. – Object: file, tuple, etc. Lampson defined the familiar access matrix and its two interpretations ACLs and capabilities [Lampson70]
5. Why are we still talking about access control? An access control policy is a specification for an access decision function The policy aims to achieve – Permit the principal’s intended function (availability) – Ensure security properties are met (integrity, confidentiality) • Limit to “Least Privilege,” Protect system integrity, Prevent unauthorized leakage, etc. • Also known as ‘constraints’ Enable administration of a changeable system (simplicity)
6. Example: Access Control Prof Alice manages access to course objects ‣ Assign access to individual (principal: Bob) ‣ Assign access to aggregate (course-students) ‣ Associate access to relation (students(course)) ‣ Assign students to project groups (student(course, project, group)) Prof Alice wants certain guarantees ‣ Students cannot modify objects written by Prof Alice ‣ Students cannot read/modify objects of other groups Prof Alice must be able to maintain access policy ‣ Ensure that individual rights do not violate guarantees ‣ However, exceptions are possible – students may distribute their results from previous assignments for an exam
7. Access Control is Hard Because Access control requirements are domain-specific – Generic approaches over-generalize Access control requirements can change – Anyone could be an administrator The Safety Problem [HRU76] – Can only know what is leaked right now Access is fail-safe, but Constraints are not – And constraints must restrict all future states
8. Safety Problem Determine if an unauthorized permission is leaked given – An initial set of permissions and – An access control system, mainly administrative operations For a traditional approach, the safety problem is undecidable – Access matrix model with multi-operational commands – Main culprit is create – create object/subject with own rights – Prove reduction of a Turing machine to the multi-operational access matrix system
9. Safety Problem Result led to Safe, but limited models: take-grant, schematic protection model, typed access matrix model Further support for models in which the constraints are implicit in the model – e.g., lattice models Check safety on each policy change – constraint approach of RBAC
10. Compare to Other CS Problems Processor design – Hard, but can get some smart people together to construct one, fixed, testable design Network protocol design – TCP: A small number of control parameters necessary to manage all reasonable options, within a layered architecture – Constraints, such as DDoS, are ad hoc Software design – Specific goals in mind to achieve function, constraints are ad hoc
11. Access Control Models Discretionary Access Matrix – UNIX, ACL, various capability systems Mandatory (Usually) Access Matrix – TE, RBAC, groups and attributes, parameterized Plus Transitions – DTE, SELinux, Java Lattice Access Control Models – Bell-LaPadula, Biba, Denning Predicate Models – ASL, OASIS, domain-specific models, many others Safety Models – Take-grant, Schematic Protection Model, Typed Access Matrix
12. Administration Discretionary Access Control – Users (typically object owner) can decide permission assignments Mandatory Access Control – System administrator decides on permission assignments Flexible Administrative Management – Access control models can be used to express administrative privileges
13. Type Enforcement [BoebertKain84]
14. Group and Attributes
15. Access Control Discretionary Access Control – Access Matrix Model – Implementation of the Access Matrix – Vulnerabilities of the Discretionary Policies – Additional features of DAC
16. Discretionary Access Control • Discretionary Access Control is an individual user can set an access control mechanism to allow or deny access to an object. • Relies on the object owner to control access. • DAC is widely implemented in most operating systems, and we are quite familiar with it. • Strength of DAC: Flexibility: a key reason why it is widely known and implemented in mainstream operating systems.
17. Discretionary Access Control ❖ Access to data objects (files, directories, etc.) is permitted based on the identity of users. ❖ Explicit access rules that establish who can, or cannot, execute which actions on which resources. ❖ Discretionary: users can be given the ability of passing on their privileges to other users, where granting and revocation of privileges is regulated by an administrative policy.
18. Discretionary Access Control ❖DAC is flexible in terms of policy specification ❖This is the form of access control widely implemented in standard multi-user platforms Unix, NT, Novell, etc.
19. Limitation of DAC Global policy: DAC let users to decide the access control policies on their data, regardless of whether those policies are consistent with the global policies. Therefore, if there is a global policy, DAC has trouble to ensure consistency. Information flow: information can be copied from one object to another, so access to a copy is possible even if the owner of the original does not provide access to the riginal copy. This has been a major concern for military. Malicious software: DAC policies can be easily changed by owner, so a malicious program (e.g.,a downloaded untrustworthy program) running by the owner can change DAC policies on behalf of the owner. Flawed software: Similarly to the previous item, flawed software can be “instructed” by attackers to change its DAC policies.
20. Discretionary Access Control Access control matrix – Describes protection state precisely – Matrix describing rights of subjects – State transitions change elements of matrix State of protection system – Describes current settings, values of system relevant to protection
21. Access Control Discretionary Access Control – Access Control Matrix Model – Implementation of the Access Matrix – Vulnerabilities of the Discretionary Policies – Additional features of DAC
22. Access Control Matrix Model Access control matrix – Firstly identify the objects, subjects and actions. – Describes the protection state of a system. – State of the system is defined by a triple (S, O, A) • S is the set of subject, • O is the set of objects, • A is the access matrix – Elements indicate the access rights that subjects have on objects • Entry A[s, o] of access control matrix is the privilege of s on o
23. Description objects (entities) o o s s 1 m 1 n Subjects S = { s1, ,sn } s1 Objects O = { o1, ,om } s2 Rights R = { r1, ,rk } Entries A[si, oj]  R subjects A[si, oj] = { rx, , ry } means subject si has rights r , , r over sn x y object oj
24. Boolean Expression Evaluation ACM controls access to database fields – Subjects have attributes – Action/Operation/Verb define type of access – Rules associated with objects, action pair Subject attempts to access object – Rule for object, action evaluated, grants or denies access
25. Example Subject Annie – Attributes role (artist), groups (creative) Verb paint – Default 0 (deny unless explicitly granted) Object picture – Rule: Annie paint picture if: ‘artist’ in subject.role and ‘creative’ in subject.groups and time.hour ≥ 0 and time.hour < 5
26. ACM at 3AM and 10AM At 3AM, time condition At 10AM, time condition met; ACM is: not met; ACM is: picture picture paint annie annie
27. Access Controlled by History Statistical databases need to Name Position Age Salary – answer queries on groups Alice Teacher 45 40K – prevent revelation of individual Bob Aide 20 20K records Cathy Principal 37 60K Query-set-overlap control Dilbert Teacher 50 50K – Prevent an attacker to obtain Eve Teacher 33 50K individual piece of information using a set of queries C – A parameter r (=2) is used to determine if a query should be answered
28. Access Controlled by History Query 1: Name Position Age Salary – sum_salary(position = teacher) Celia Teacher 45 40K Leonard Teacher 50 50K – Answer: 140K Matt Teacher 33 50K Query 2: – sum_salary(age > 40 & position = teacher) Name Position Age Salary – Should not be answered as Matt’s Celia Teacher 45 40K salary can be deduced Leonard Teacher 50 50K Can be represented as an ACM
29. Solution: Query Set Overlap Control (Dobkin, Jones & Lipton ’79) Query valid if intersection of query coverage and each previous query < r Can represent as access control matrix – Subjects: entities issuing queries – Objects: Powerset of records – Os(i) : objects referenced by s in queries 1 i – M[s,o] = read iff q  o r qi −( 1) Os
30. Solution: Query Set Overlap Control (Dobkin, Jones & Lipton ’79) Query 1: O1 = {Celia, Leonard, Matt} so the query can be answered. Hence – M[asker, Celia] = {read} – M[asker, Leonard] = {read} – M[asker, Matt] = {read} Query 2: O2 = {Celia, Leonard} but | O2  O1 | = 2; so the query cannot be answered – M[asker, Celia] =  – M[asker, Leonard] = 
31. Access Control Discretionary Access Control – Access Matrix Model – Implementation of the Access Control Matrix – Vulnerabilities of the Discretionary Policies – Additional features of DAC
32. ACM Implementation ACM is an abstract model – Rights may vary depending on the object involved ACM is implemented primarily in three ways – Authorization Table – Capabilities (rows) – Access control lists (columns)
33. Authorization Table ◼ Three columns: subjects, actions, objects ◼ Generally used in DBMS systems
34. Access Control List (ACL) Matrix is stored by column. Each object is associated with a list Indicate for each subject the actions that the subject can exercise on the object
35. Capability List Matrix is stored by row Each user is associated with a capability list Indicating for each object the access that the user is allow to exercise on the object
36. ACLs vs Capability List Immediate to check the authorization holding on an object with ACLs. (subject?) Immediate to determine the privileges of a subject with Capability lists. (object?) Distributed system, – authenticate once, access various servers – choose which one? Limited number of groups of users, small bit vectors, authorization specified by owner. – Which one?
37. Basic Operations in Access Control Grant permissions – Inserting values in the matrix’s entries Revoke permissions – Remove values from the matrix’s entries Check permissions – Verifying whether the entry related to a subject s and an object o contains a given access mode
38. Access Control Discretionary Access Control – Access Matrix Model – State of Protection System – Implementation of the Access Matrix – Vulnerabilities of the Discretionary Policies – Additional features of DAC
39. Vulnerabilities of the Discretionary Policies No separation of users from subjects No control on the flow the information Malicious code, i.e., Trojan horse
40. Example Vicky, a top-level manager A file Market on the new products release John, subordinate of Vicky A file called “Stolen” with two hidden operations – Read operation on file Market – Write operation on file Stolen
41. Example (cond)
42. Example (cond) • Restriction should be enforced on the operations that processes themselves can execute. • Mandatory policies provide a way to enforce information flow control through the use of labels
43. Access Control Discretionary Access Control – Access Matrix Model – State of Protection System – Implementation of the Access Matrix – Vulnerabilities of the Discretionary Policies – Additional features of DAC
44. DAC – additional features and recent trends Flexibility is enhanced by supporting different kinds of permissions – Positive vs. negative – Strong vs. weak – Implicit vs. explicit – Content-based
45. Positive and Negative Permissions Positive permissions → Give access Negative permissions → Deny access Useful to specify exceptions to a given policy and to enforce stricter control on particular crucial data items
46. Positive and Negative Permissions + - Main Issue: Conflicts
47. Authorization Conflicts Main solutions: – No conflicts – Negative permissions take precedence – Positive permissions take precedence – Nothing take precedence – Most specific permissions take precedence
48. Weak and Strong Permissions Strong permissions cannot be overwritten Weak permissions can be overwritten by strong and weak permissions
49. Implicit and Explicit Permissions Some models support implicit permissions Implicit permissions can be derived: – by a set of propagation rules exploiting the subject, object, and privilege hierarchies – by a set of user-defined derivation rules
50. Derivation Rules: Example Ann can read file F1 from a table if Bob has an explicit denial for this access Tom has on file F2 all the permissions that Bob has Derivation rules are a way to concisely express a set of security requirements
51. Derivation Rules Derivation rules are often expressed according to logic programming Several research efforts have been carried out to compare the expressive power of such languages We need languages based on SQL and/or XML
52. Content-based Permissions Content-based access control conditions the access to a given object based on its content This type of permissions are mainly relevant for database systems As an example, in a RDBMS supporting content- based access control it is possible to authorize a subject to access information only of those employees whose salary is not greater than 30K
53. Content-based Permissions Two most common approaches to enforce content-based access control in a DBMS are done: – by associating a predicate (or a Boolean combination of predicates) with the permission – by defining a view which selects the objects whose content satisfies a given condition, and then granting the permission on the view instead of on the basic objects
54. DAC models - DBMS vs OS Increased number of objects to be protected Different granularity levels (relations, tuples, single attributes) Protection of logical structures (relations, views) instead of real resources (files) Different architectural levels with different protection requirements Relevance not only of data physical representation, but also of their semantics
55. Cost Benefits Saves about 7.01 minutes per employee, per year in administrative functions – Average IT admin salary - $59.27 per hour – The annual cost saving is: • $6,924/1000; $692,471/100,000 Reduced Employee downtime – if new transitioning employees receive their system privileges faster, their productivity is increased – 26.4 hours for non-RBAC; 14.7 hours for RBAC – For average employee wage of $39.29/hour, the annual productivity cost savings yielded by an RBAC system: • $75000/1000; $7.4M/100,000
56. Agenda 1. Access Control 2. Discretionary Access Control 3. Matrix-based models 4. Graph-based models 5. Discretionary models specific to databases
57. Graph-based models A graphical model or probabilistic graphical model (PGM) is a probabilistic model for which a graph expresses the conditional dependence structure between random variables. They are commonly used inprobability theory, statistics—particularly Bayesian statistics—and machine learning.
58. Graph-based models 1. Access Control 2. Discretionary Access Control 3. Matrix-based models 4. Graph-based models 5. Discretionary models specific to databases