04 Access Control - Cheat Sheet

Access control: “prevention of unauthorized use of a resource, including the prevention of use of a resource in an unauthorized manner” (s.2). Authentication first, then access control against the authorization database; auditing throughout (s.3).

Three policies (s.4-6)

	DAC	MAC	RBAC
Based on	requestor identity + rules	security labels vs clearances	roles of users
Holder may pass on access?	yes (discretionary)	no (mandatory)	rights belong to roles
Note	traditional	military; TOP SECRET, SECRET, CONFIDENTIAL, UNCLASSIFIED	increasingly popular

Can combine two or all three for different resource classes.

Requirements (s.8-9)

Reliable input · fine vs coarse specifications · least privilege (minimum resources and authorizations needed) · closed policy (only what is authorized, most used) vs open policy (all except prohibited) · administrative policies (who edits the rules).

Elements (s.10-11)

Subject (owner, group, world) · object (files, directories, records, programs) · access right (read, write, execute, delete, create, search).

Access matrix (s.12-19)

Rows subjects, columns objects, sparse; can decompose by row/column (rows = capability lists, s.13; columns = ACLs, added context). Extended matrix adds subjects (control, owner), processes (wakeup, stop), disk drives (seek). Copy flag * = delegation.

• Transfer $\{r,r^{\ast }\}$ if $A[S,X]=r^{\ast }$, or owner, or ($A[S,X]=r$ and $A[S,S^{\prime }]=\text{control}$).
• Delete $\{r\}$ if owner or control.
• Access function: request $(S_0,\alpha ,X)$ $\to$ controller checks $\alpha \in A[S_0,X]$ $\to$ allow, or protection violation.

RBAC (s.20-27)

Rights to roles, users to roles, many-to-many.

Model	Adds
RBAC0	base: user, role, permission, session
RBAC1	role hierarchies (inheritance)
RBAC2	constraints: mutual exclusion, cardinality, prerequisite
RBAC3	RBAC1 + RBAC2

Quiz one-liners

Minimum permissions = least privilege · every request checked = complete mediation (Chapter 1) · labels + clearances = MAC.

Details: 04 Access Control - Chunk 01 (s.1-28) · 04 Access Control - Index · Concept - RBAC Reference Models · Concept - Access Matrix