Thanks to visit codestin.com
Credit goes to www.scribd.com

Scribd
Upload
55 views13 pages

Lecture4 AccessControl

Access control is the process of granting or denying requests to obtain information or enter physical facilities. It regulates use of system resources according to a security policy. There are different types of access control policies like discretionary access control (DAC), mandatory access control (MAC), role-based access control (RBAC), and attribute-based access control (ABAC). DAC controls access based on the identity and authorization rules, MAC controls access based on comparing security labels to clearances, RBAC controls access based on user roles, and ABAC controls access based on attributes. Access control specifies the relationship between subjects like users and objects like files through access rights like read, write, execute.

Uploaded by

makangara22
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
55 views13 pages

Lecture4 AccessControl

Access control is the process of granting or denying requests to obtain information or enter physical facilities. It regulates use of system resources according to a security policy. There are different types of access control policies like discretionary access control (DAC), mandatory access control (MAC), role-based access control (RBAC), and attribute-based access control (ABAC). DAC controls access based on the identity and authorization rules, MAC controls access based on comparing security labels to clearances, RBAC controls access based on user roles, and ABAC controls access based on attributes. Access control specifies the relationship between subjects like users and objects like files through access rights like read, write, execute.

Uploaded by

makangara22
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 13

Information

Systems Security
Access Control
Access Control Definitions
1/2

The process of granting or denying specific


requests to:
(1) obtain and use information and related
information processing services; and
(2) (2) enter specific physical facilities”
Access Control Definitions
2/2

A process by which use of system resources is


regulated according to a security policy
and is permitted only by authorized entities
(users, programs, processes, or other
systems) according to that policy
Access Control Principles
• In a broad sense, all of computer security is
concerned with access control

“measures that implement and assure


security services in a computer system,
particularly those that assure access control
service”
Access Control Policies
• Discretionary access • Role-based access
control (DAC) control (RBAC)
o Controls access based on the o Controls access based on the
identity of the requestor and roles that users have within the
on access rules system and on rules stating
(authorizations) stating what what accesses are allowed to
requestors are (or are not) users in given roles
allowed to do
• Attribute-based
• Mandatory access access control (ABAC)
control (MAC) o Controls access based on
o Controls access based on attributes of the user, the
comparing security labels with resource to be accessed, and
security clearances current environmental
conditions
Subjects, Objects, and
Access Rights

Access
Subject Object
right

Describes the way in


An entity capable of A resource to which
which a subject may
accessing objects access is controlled
access an object

Three classes Could include:


• Owner • Read
Entity used to contain • Write
• Group and/or receive • Execute
• World information • Delete
• Create
• Search
Discretionary Access Control
(DAC)

• Scheme in which an entity may be granted access


rights that permit the entity, by its own violation, to
enable another entity to access some resource
• Often provided using an access matrix
o One dimension consists of identified subjects that may
attempt data access to the resources
o The other dimension lists the objects that may be
accessed
• Each entry in the matrix indicates the access rights
of a particular subject for a particular object
Figure 4.2 Example of Access Control Structures
Table 4.2
Authorization
Table
for Files in
Figure 4.2

(Table is on page 113 in the textbook)


Protection Domains
• Set of objects together with access rights to those
objects
• More flexibility when associating capabilities with
protection domains
• In terms of the access matrix, a row defines a protection
domain
• User can spawn processes with a subset of the access
rights of the user
• Association between a process and a domain can be
static or dynamic
• In user mode certain areas of memory are protected
from use and certain instructions may not be executed
• In kernel mode privileged instructions may be executed
UNIX File Access Control
UNIX files are administered using inodes (index
nodes)
• Control structures with key information needed for a particular file
• Several file names may be associated with a single inode
• An active inode is associated with exactly one file
• File attributes, permissions and control information are sorted in the
inode
• On the disk there is an inode table, or inode list, that contains the
inodes of all the files in the file system
• When a file is opened its inode is brought into main memory and
stored in a memory resident inode table

Directories are structured in a hierarchical tree

• May contain files and/or other directories


• Contains file names plus pointers to associated inodes
UNIX
File Access Control

● Unique user identification


number (user ID)
● Member of a primary group
identified by a group ID
● Belongs to a specific group
● 12 protection bits
● Specify read, write, and
execute permission for the
owner of the file, members
of the group and all other
users Figure 4.5 UNIX File Access Control
● The owner ID, group ID, and
protection bits are part of the
file’s inode

You might also like