1 Grand Challenges in Authorization Systems Prof. Ravi Sandhu Executive Director and Endowed Chair November 14, © Ravi Sandhu World-Leading Research with Real-World Impact! Institute for Cyber Security

Mutually Supportive Technologies © Ravi Sandhu 2 World-Leading Research with Real-World Impact! AUTHENTICATION INTRUSION DETECTION CRYPTOGRAPHY ACCESS CONTROL ASSURANCE RISK ANALYSIS SECURITY ENGINEERING & MANAGEMENT

Cyber Security Objectives © Ravi Sandhu 3 World-Leading Research with Real-World Impact! INTEGRITY modification AVAILABILITY access CONFIDENTIALITY disclosure

Cyber Security Objectives © Ravi Sandhu 4 World-Leading Research with Real-World Impact! INTEGRITY modification AVAILABILITY access CONFIDENTIALITY disclosure USAGE purpose

Cyber Security Objectives © Ravi Sandhu 5 World-Leading Research with Real-World Impact! INTEGRITY modification AVAILABILITY access CONFIDENTIALITY disclosure USAGE purpose USAGE

6 World-Leading Research with Real-World Impact! Authorization Systems © Ravi Sandhu Policy Specification Dynamics Agility Enforcement Grand Challenge arena

 Discretionary Access Control (DAC)  Owner controls access  But only to the original, not to copies  Mandatory Access Control (MAC)  Same as Lattice-Based Access Control (LBAC)  Access based on security labels  Labels propagate to copies  Role-Based Access Control (RBAC)  Access based on roles  Can be configured to do DAC or MAC  Generalizes to Attribute-Based Access Control (ABAC) © Ravi Sandhu 7 World-Leading Research with Real-World Impact! Access Control Models Numerous other models but only 3 successes: SO FAR

Discretionary Access Control © Ravi Sandhu 8 World-Leading Research with Real-World Impact! File F A:r A:w File G B:r A:w B cannot read file F A trusted not to copy F to G B cannot read file F A trusted not to copy F to G ACL

Discretionary Access Control © Ravi Sandhu 9 World-Leading Research with Real-World Impact! File F A:r A:w File G B:r A:w But trusting A does not stop Trojan Horses ACL A Program Goodies Trojan Horse executes read write

Mandatory Access Control © Ravi Sandhu 10 World-Leading Research with Real-World Impact! Unclassified Confidential Secret Top Secret can-flow dominance 

Mandatory Access Control © Ravi Sandhu 11 World-Leading Research with Real-World Impact! Low User High Trojan Horse Infected Subject High User Low Trojan Horse Infected Subject COVERT CHANNEL Information is leaked unknown to the high user

Role-Based Access Control © Ravi Sandhu 12 World-Leading Research with Real-World Impact!  Access is determined by roles  A user’s roles are assigned by security administrators  A role’s permissions are assigned by security administrators Is RBAC MAC or DAC or neither?  RBAC can be configured to do MAC  RBAC can be configured to do DAC  RBAC is policy neutral RBAC is neither MAC nor DAC!

Role-Based Access Control © Ravi Sandhu 13 World-Leading Research with Real-World Impact! ROLES USER-ROLE ASSIGNMENT PERMISSIONS-ROLE ASSIGNMENT USERS PERMISSIONS... SESSIONS ROLE HIERARCHIES CONSTRAINTS

Server Pull Enforcement Model © Ravi Sandhu 14 World-Leading Research with Real-World Impact! ClientServer User-role Authorization Server

Client Pull Enforcement Model © Ravi Sandhu 15 World-Leading Research with Real-World Impact! ClientServer User-role Authorization Server

 Trojan Horse  Covert Channels  Inference  Analog Hole  Assured Enforcement  Privelege Escalation  Policy Comprehension and Analysis © Ravi Sandhu 16 World-Leading Research with Real-World Impact! Tough Challenges Tough Challenges NOT EQUAL TO Grand Challenges

 How can we be “secure” while being “insecure”?  What is the value of access control when we know that ultimately it can be bypassed? © Ravi Sandhu 17 World-Leading Research with Real-World Impact! Grandest Challenge

18 World-Leading Research with Real-World Impact! Authorization Systems © Ravi Sandhu Policy Specification Dynamics Agility Enforcement Grand Challenge arena

 How do we determine the balance between too much and too little?  How do we enforce policies across multiple layers of the software stack?  How do we build dynamics into policy specifications and enforcement mechanisms?  How do we understand and control what we have done? © Ravi Sandhu 19 World-Leading Research with Real-World Impact! Grand Challenges

 Computer scientists could never have designed the web because they would have tried to make it work.  But the Web does “work.”  What does it mean for the Web to “work”? © Ravi Sandhu 20 World-Leading Research with Real-World Impact! Butler Lampson Paraphrased