%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{23}{November 26, 1996}{Ron Rivest}{Kenneth Hon} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Access Control}


Today's lecture talks about access control.  Access control can be
discretionary or mandatory, and is used in shared computer systems.  In
a shared computer system, there is sharing of resources; however, the
authorizations granted to users may be different.  One example is the
medical information on the smartcard, where the subjects may include
doctors, nurses, and pharmacists.


\section{Background}

Within the framework of access control, there are subjects, objects and kinds of access that the subjects can have.  Access control serves as a policy, or language, that determines rules such as "who can gain what kind of access to what?"  Access control may also incorporate concepts such as groups, where subjects who have same access is combined together, label on the objects, or the time of day for request, etc.

\begin{description}

\item[Subject]
A subject is a principle agent, or active party, such as user processes or protocols.  Subjects are allowed different accesses or modifications to certain information.

\item[Object]
An object is information which the subject can access through various ways.  Examples of objects include files, i/o devices, segments of memory,  and in a higher level, information database.

\item[Access]
The actual operation that the subject can perform on the object.  Kinds of accesses include read, write, append, and delete, etc. 

\end{description}



\section{Criteria}
There are various criteria that should be taken into consideration for access control:

\begin{itemize}
\item 
{\bf Economy of mechanism:} The system that provides the access control should be simple and easily understood.

\item
{\bf Fail-safe defaults:} access for the subjects should be denied in
the case when the system fails.  This is to prevent subjects from
accessing objects that they are not permitted to during a system failure.

\item
{\bf Open-design: } open design means that the design should be open
to the public for scrutiny.  This is a controversial criterion, since
there are advantages as well as disadvantages.  One advantage is that
the user can now obtain information about the design.  The drawback is
that opening the design may provide the adversaries with a easier way to
break into the system.

\item
{\bf Complete mediation: } every time the subject tries to access the
object, the process is being checked.  This can be achieved by having
each access intercepted by some type of  "guardian".  Note that this is
mainly to prevent people from violation rather than detecting the
violation.

\item
{\bf Psychological acceptability: } the overhead of the system should be minimized to make it convenient for the users.  If the overhead is too large, the users will not use it even with good design and implementation.
 
\item
{\bf Separation of privilege: } in this case, two or more subjects are
required so as to gain access to various objects.

\item
{\bf Least privilege: } the subjects should be given the access to
certain object only when it is necessary in order to get a specific task
done.  No subjects should be given more rights than he/she should. 

\end{itemize}

Among the various criteria discussed above, psychological acceptability
is considered the most important, followed by fail-safe defaults, least
privilege, complete mediation, and economy of mechanism.  Other criteria
include the least common mechanism and issues related to detection
and protection.


\section{Security Mechanism}
There are two main favors of the security mechanisms, namely
discretionary access control and mandatory access control.  These
security mechanisms determines who gets to set the policy of access
control.  In discretionary access control systems, the users gets to
determine the policies.  For example, in word processing, the author may
be allowed to determine the kinds of access to other users.  On the
other hand, in mandatory access control system the user does not set the
policy for access control --  it is the companies or the organizations
that determines the policies.  For example, some companies require that
the documents of the company be labeled as top secret so that people
without authority to top secrets should not be allowed to read them.  This is an example of mandatory access control.  


\section{Issues of Access Control}
There are various issues that comes out when developing an access control system.  First of all, there are issues concerning the creation of new subjects and objects.  One must determine who should have the rights to create them, and under what circumstances should new subjects and objects be created.  Also, policies must be set to determine who can grant rights to others.  For example, if you have read access to a certain object, can you then grant similar rights to somebody else?  This also relates to the idea of transferring rights as well as revocation.  Moreover, what rights should the running programs have?  In this case, least privilege can be one of the solutions.  As mentioned above, least privilege means that  the program should be given certain access only when it is necessary to perform a specific task.  An alternative maybe to allow the program to have the rights similar to those of the user.  Finally, what rights should the creator of the programs have?  For example, one can grant certain rights to the creator, such as changing password, or sending email.  These are all issues that needs to be considered when developing an access control system.


\section{Access Control List}


Access Control Lists (ACLs) are lists that stores the information of
which subject has the right to access what.  In general, ACLs are in
table format, with different subjects, or groups, in one axis and the
different objects on the other.  An example of an ACL is shown below:

\begin{tabular}{|l|l|l|l|r|}  \hline\hline
Sub|Obj  &  O1   & O2   &   O3 \\ \hline
S1       & ORWX  & R    &   W  \\ \hline
S2       & --    & OR   &   X  \\ \hline\hline
\end{tabular}



S1 and S2 denotes the first and second subjects (groups) and  O1, O2, O3 denotes the first, second and the third objects respectively.  The symbols for the various combinations of subjects and objects represent the accesses that the subject can have on that particular object.


ACL is important in access control system.  For example, whenever a user
tries to access certain object, he/she needs to be authenticated, via
ACL, to ensure that the user is associated with the access control.
Also, by changing the ACL, revocation can be performed and certain users
can be excluded from certain rights even though he/she may belong to a
particular group which has that privilege.


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}



