1. 1 Access Control Matrix CSSE 442 Computer Security Larry Merkle, Rose-Hulman Institute March 16, 2007

2. 2 Acknowledgements Many of these slides came from Matt Bishop, author of Computer Security: Art and Science Others came from either Mark Ardis or Andy Kinley

3. 3 Chapter 2: Access Control Matrix Overview Access Control Matrix Model Special Rights Principle of Attenuation of Privilege

4. 4 Overview Protection state of system Describes current settings, values of system relevant to protection Access control matrix Describes protection state precisely Matrix describing rights of subjects (processes and users) State transitions change elements of matrix

5. 5 Description objects subjects s1s2…sns1s2…sn o 1 o 2 … o m Subjects S = { s 1,…,s n } Objects O = { o 1,…,o m } Subjects can be objects Rights R = { r 1,…,r k } Entries A[s i, o j ]   R A[s i, o j ] = { r x, …, r y } means subject s i has rights r x, …, r y over object o j

6. 6 Rights Unix r = read w = write x = execute AFS r = read l = list i = insert d = delete w = write k = lock a = administer

7. 7 Example Processes p, q Files f, g Rights r, w, x, a(ppend), o(wn) fgpq prworrwxow qarorrwxo

8. 8 In-class exercise Consider a computer system with three users: Alice, Bob, and Cyndy. Alice owns the file alicerc, and Bob and Cyndy can read it. Cyndy can read and write the file bobrc, which Bob owns, but Alice can only read it. Only Cyndy can read and write the file cyndyrc, which she owns. Assume that the owner of each of these files can execute it. a. Create the corresponding access control matrix. b. Cyndy gives Alice permission to read cyndyrc, and Alice removes Bob’s ability to read alicerc. Show the new access control matrix.

9. 9 Protection State Transitions Sequences of state transitions are represented as transformation procedures (commands) Primitive operations alter the ACM directly, but are not invoked directly Ex: enter own into a[p, q] Commands combine primitive operations and are invoked directly

10. 10 Protection State Transitions Example command create_file(p, f) create object f; enter own into a[p, f]; enter r into a[p, f]; enter w into a[p, f]; end

11. 11 In-class Exercises Find and correct the errors in Bishop’s definitions of the primitive operations Exercise 4a on page 45

12. 12 Copy Right Allows possessor to give rights to another Often attached to a right, so only applies to that right r is read right that cannot be copied rc is read right that can be copied Is copy flag copied when giving r rights? Depends on model, instantiation of model

13. 13 Own Right Usually allows possessor to change entries in ACM column So owner of object can add, delete rights for others May depend on what system allows Can’t give rights to specific (set of) users Can’t pass copy flag to specific (set of) users

14. 14 Attenuation of Privilege Principle says you can’t give rights you do not possess Restricts addition of rights within a system Usually ignored for owner Why?