Discretionary Access Control Model Research Articles

Using formal security models in secure databases

The paper contains key provisions (requirements) that should be followed when building secure databases using the capabilities of the main formal access control models, such as discretionary access control models, mandatory access control models, role-based access control models. At the same time, it is noted that any security model does not provide protection but only provides the principle of building a secure database, the implementation of which should ensure the security properties inherent in the model. The security of the database is equally determined by: the properties of the model itself (one or more), its (their) adequacy to the threats affecting the system, and how it (they) is correctly implemented(s). The decisive factor in making a decision is always an assessment of a specific situation, which will allow you to make the right choice, including the complex use of formal models.

On the representation of role-based access control models by object-oriented HRU model: taxonomic leaf-based hierarchy case

In this paper the possibility of representing of some types of role-based access control models by object-oriented discretionary access control model is considered. The role-based security models with taxonomic hierarchy are considered. The permissions of the role-based access control model are represented as a set of pairs of object and access right. A hierarchy of classes of the object-oriented HRU model, based on the role-based access control policy, is constructed. Commands of the object-oriented HRU model, corresponding to the reassignment of roles in the original role-based model, are described.

Evaluating the effects of access control policies within NoSQL systems

Access control is a key service of any data management system. It allows regulating the access to data resources at different granularity levels on the basis of access control models which vary on the protection options they offer. The more powerful is the access control model in terms of protection requirements, the more difficult is for security administrators to understand the effect of a set of access control policies on the protected resources. This is further complicated within schemaless systems, like NoSQL datastores, when fine grained access control policies are specified for data resources characterized by heterogeneous structures. The lack of a reference data model and related manipulation languages exacerbates this issue. To the best of our knowledge, a general approach to evaluate the impact of access control policies on the protected resources within NoSQL systems is still missing. In this paper, we start to fill this void, by proposing a data model agnostic approach, which, starting from schemaless datasets protected by different discretionary access control models, derives a view of the protected resources that points out authorized and unauthorized contents. Experimental results show the approach efficiency even with large datasets.

О ПРЕДСТАВЛЕНИИ НЕКОТОРЫХ РОЛЕВЫХ МОДЕЛЕЙ РАЗГРАНИЧЕНИЯ ДОСТУПА ОБЪЕКТНО-ОРИЕНТИРОВАННОЙ МОДЕЛЬЮ HRU

In this paper the possibility of representing of some types of role-based access control models by object-oriented discretionary access control model is considered. The role-based security model without hierarchy and the role-based security model with hierarchy with inheritance "from above" are considered. The permissions of the role-based access control model are represented as a set of pairs of object and access right. A hierarchy of classes of the object-oriented HRU model based on the role-based access control policy is constructed. Commands of the object-oriented HRU model corresponding to the reassignment of roles in the original role-based model are described.

Quantitative Analysis Method of EXRBAC Model withN-Dimensional Security Entropy

On how to evaluate the performance of access control models, a method ofN-dimensional security entropy is described in this paper. According to the definition and description of the information entropy in information theory, the definition of the One-dimensional Security Entropy is introduced and the one-dimensional security entropy in Discretionary-access Control model is discussed firstly. Then theN-dimensional security entropy is extended based on the unauthorized access, and by means of theN-dimensional security entropy, the quantitative security performance is measured in RBAC model. In order to measure the security of management information system with complex role level, an extension of RBAC access control (EXRBAC) model is presented in this paper, which could get quantitative analysis withN-dimensional security entropy methods. Through analyzing and comparing the security performance of these three access control models, it is shown that the EXRBAC model performance is improved in multi-class and multi-level roles condition.

Breaking and fixing the Android Launching Flow

The security model of the Android OS is based on the effective combination of a number of well-known security mechanisms (e.g. statically defined permissions for applications, the isolation offered by the Dalvik Virtual Machine, and the well-known Linux discretionary access control model). Although each security mechanism has been extensively tested and proved to be effective in isolation, their combination may suffer from unexpected security flaws. We show that this is actually the case by presenting a severe vulnerability in Android related to the application launching flow. This vulnerability is based on a security flaw affecting a kernel-level socket (namely, the Zygote socket). We also present an exploit of the vulnerability that allows a malicious application to mount a severe Denial-of-Service attack that makes the Android devices become totally unresponsive. Besides explaining the vulnerability (which affects all versions of Android up to version 4.0.3) we propose two fixes. One of the two fixes has been adopted in the official release of Android, starting with version 4.1. We empirically assess the impact of the vulnerability as well as the efficacy of the countermeasures on the end user. We conclude by extending our security analysis to the whole set of sockets, showing that other sockets do not suffer from the same vulnerability as the Zygote one.

Group-based Discretionary Access Control for Epidemiological Resources

Scientific repositories promote information sharing at a global scale. However, users will share sensitive resources in such repositories only if they are trustable. In addition, they must provide intuitive mechanisms to manage who can access to resource collections. Current approaches, which rely on a central administration, are not flexible and do not scale to cope with large numbers of users. Moreover, discretionary access control is a legal standard for health-related resources. This work proposes a group-based discretionary access control model with decentralized permission and group management The model also differentiates permissions for data and meta-data, enabling the sharing of meta-data while protecting sensitive data. The access control model is introduced and formalized using Barker's Unifying Metamodel. We also describe how the model has been implemented in the Epidemic Marketplace, an open software information platform for epidemic studies, designed to foster cooperative behavior and data sharing.

A logic-based safety analysis algorithm for discretionary access control

For the issue of the discretionary access control (DAC) model safety analysis, a logic method is proposed. This method takes the GD model as the classic DAC model and Prolog as the basic language to describe system states and state transfer rules. A general program based on this logic method is proposed for DAC safety analysis, but this program may never be terminal for some safety analysis goal. The safety analysis algorithm is achieved by simplifying the general program according to the property of the DAC model state transfer rules. This safety analysis algorithm is easier to understand and implement than the previous algorithms and its time complexity is O(N+M+T), in which N, M, and T are the numbers of the rights with copy flag, the policies for right transferring, and the policies for right permitting, respectively.

Combining Discretionary Policy with Mandatory Information Flow in Operating Systems

Discretionary Access Control (DAC) is the primary access control mechanism in today’s major operating systems. It is, however, vulnerable to Trojan Horse attacks and attacks exploiting buggy software. We propose to combine the discretionary policy in DAC with the dynamic information flow techniques in MAC, therefore achieving the best of both worlds, that is, the DAC’s easy-to-use discretionary policy specification and MAC’s defense against threats caused by Trojan Horses and buggy programs. We propose the Information Flow Enhanced Discretionary Access Control (IFEDAC) model that implements this design philosophy. We describe our design of IFEDAC, and discuss its relationship with the Usable Mandatory Integrity Protection (UMIP) model proposed earlier by us. In addition, we analyze their security property and their relationships with other protection systems. We also describe our implementations of IFEDAC in Linux and the evaluation results and deployment experiences of the systems.

The Policy Machine: A novel architecture and framework for access control policy specification and enforcement

The ability to control access to sensitive data in accordance with policy is perhaps the most fundamental security requirement. Despite over four decades of security research, the limited ability for existing access control mechanisms to generically enforce policy persists. While researchers, practitioners and policy makers have specified a large variety of access control policies to address real-world security issues, only a relatively small subset of these policies can be enforced through off-the-shelf technology, and even a smaller subset can be enforced by any one mechanism. In this paper, we propose an access control framework, referred to as the Policy Machine (PM) that fundamentally changes the way policy is expressed and enforced. Employing PM helps in building high assurance enforcement mechanisms in three respects. First, only a relatively small piece of the overall access control mechanism needs to be included in the host system (e.g., an operating system or application). This significantly reduces the amount of code that needs to be trusted. Second, it is possible to enforce the precise policies of resource owners, without compromise on enforcement or resorting to less effective administrative procedures. Third, the PM is capable of generically imposing confinement constraints that can be used to prevent leakage of information to unauthorized principals within the context of a variety of policies to include the commonly implemented Discretionary Access Control and Role-Based Access Control models.

A type system for Discretionary Access Control

Discretionary Access Control (DAC) systems provide powerful resource management mechanisms based on the selective distribution of capabilities to selected classes of principals. We study a type-based theory of DAC models for a process calculus that extends Cardelli, Ghelli and Gordon's pi-calculus with groups (Cardelliet al. 2005). In our theory, groups play the role of principals and form the unit of abstraction for our access control policies, and types allow the specification of fine-grained access control policies to govern the transmission of names, bound the (iterated) re-transmission of capabilities and predicate their use on the inability to pass them to third parties. The type system relies on subtyping to achieve a selective distribution of capabilities to the groups that control the communication channels. We show that the typing and subtyping relationships of the calculus are decidable. We also prove a type safety result, showing that in well-typed processes all names:(i)flow according to the access control policies specified by their types; and(ii)are received at the intended sites with the intended capabilities.We illustrate the expressive power and the flexibility of the typing system using several examples.

A criterion-based multilayer access control approach for multimedia applications and the implementation considerations

In this article, a novel criterion-based multilayer access control (CBMAC) approach is presented to enhance existing access control models such as Role-Based, Mandatory, and Discretionary Access Control models to support multilayer (multilevel) access control. The proposed approach is based on a set of predefined security criteria which are extracted from authorization rules. The security attributes of objects and users are specified by security criterion expressions (serving as locks) and the elements (serving as keys) of security criterion subsets respectively. An object embedded with a number of security criterion expressions becomes a secure object while a user associated with a security criterion subset is called a secure user. The multilayer access control is achieved by evaluating the embedded security criterion expressions (actuating locks) by the elements (keys) in a user's security criterion subset. The paper also provides the details of integrating the proposed approach with existing access control models and presents the implementation considerations of Criterion-Based Role-Based Multilayer Access Control, the integration of CBMAC and Role-Based Access Control.

다양한 크기의 데이터 그룹에 대한 접근 제어를 지원하는 데이터베이스 보안 시스템

최근 병원 및 은행 등의 대규모 데이터베이스에 접근하는 사용자의 요구 사항이 다양해짐에 따라 데이터베이스 보안에 대한 중요성도 커졌다. 기존의 접근 제어 정책을 이용한 데이터베이스 보안 모델들이 존재하지만 이들은 복잡하고, 다양한 유형의 접근제어를 원하는 사용자의 보안 요구를 충족시키지 못한다. 본 논문에서는 데이터베이스를 접근하는 각 사용자별로 다양한 크기의 데이터 그룹에 대한 접근 제어론 제공하며, 임의의 정보에 대한 사용자의 접근 권한의 변화를 유연하게 수용하는 데이터베이스 보안 시스템을 제안하였다. 이를 위해 다양한 크기의 데이터 그룹을 테이블, 속성, 레코드 키에 의해 정의하였고, 사용자의 접근 권한은 보안 등급, 역할과 보안 정책들에 의해 정의하였다. 제안하는 시스템은 두 단계로 수행된다. 제 1단계는 수정된 강제적 접근 제어(Mandatory Access Control: MAC)정책과 역할 기반 접근 제어(Role-Based Access Control: RBAC)정책에 의해 수행된다. 이 단계에서는 사용자 및 데이터의 보안 등급과 역할에 의해 접근이 제어되며, 모든 형태의 접근 모드에 대한 제어가 이루어진다. 제 2단계에서는 수정된 임의적 접근 제어(Discretionary Access Control: RBAC)정책에 의해 수행되며, 1단계 수행결과가 다양한 크기의 데이터 항목에 대한 read 모드 접근제어 정책에 따라 필터링되어 사용자에게 제공한다. 이를 위해 사용자 그룹은 보안 등급에 의한 그룹, 역할에 의한 그룹, 사용자 부분집합으로 이루어진 특정 사용자 그룹으로 정의하였고 Block(s, d, r) 정책을 정의하여 특정 사용자 5가 특정 데이터 그룹 d에 'read' 모드, r로 접근할 수 없도록 하였다. 제안한 시스템은 사용자별 데이터에 대한 접근 제어가 복잡하게 요구되는 특정 유전체 연구 센터의 정보에 대한 보안 관리를 위해 사용하였다.안성, 동진벼는 안성, 서산 및 화순, 삼강벼는 안성, 서산, 화순 및 계화도 그리고 용문벼는 안성과 충주였다. 유지보수성을 증대할 수 있는 잇점을 가진다.역되어 MC-3에서 수행된다.위해 가상현실 기술을 이용한 컴퓨터 지원 교육훈력 시스템(CATS ; Computer Assister Training System)을 개발 중이며 일부 개발부분을 소개하였다.하며, 제 2선적제도의 발달과 해운경영의 국제성에 맞추어 근해해역에서 활동하는 우리나라의 선박에대해서 부분적으로 선박의 국적을 점차 개방시켜 나가는 정책을 검토해야 할 단계라는 것이다. 이러한 점에 있어서 지난 30여년간 외항해운부문에 중점을 두어온 우리나라의 해운정책은 이제 근해해운정책의 개발에도 관심을 기울여야 하는 전환점에 있다고 할 수있다.의 목적과 지식)보다 미학적 경험에 주는 영향이 큰 것으로 나타났으며, 모든 사람들에게 비슷한 미학적 경험을 발생시키는 것 이 밝혀졌다. 다시 말하면 모든 사람들은 그들의 문화적인 국적과 사회적 인 직업의 차이, 목적의 차이, 또한 환경의 의미의 차이에 상관없이 아름다 운 경관(High-beauty landscape)을 주거지나 나들이 장소로서 선호했으며, 아름답다고 평가했다. 반면에, 사람들이 갖고 있는 문화의 차이, 직업의 차 이, 목적의 차이, 그리고 환경의 의미의 차이에 따라 경관의 미학적 평가가 달라진 것으로 나타났다.corner$</TEX>적 의도에 의한 경관구성의 일면을 확인할수 있지만 엄밀히 생각하여 보면 이러한 예의 경우도 최락의 총체적인 외형은 마찬가지로 <TEX>$\ulcorner$</TEX>순응<TEX>$\lrcorner$</TEX>의 범위를 벗어나지 않는다. 그렇기 때문에도 <TEX>$\ulcorner$</TEX>순응<TEX>$\lrcorner$</TEX>과 <TEX>$\ulcorner$</TEX>표현<TEX>$\lrcorner$</TEX>의 성격과 Due to various requirements for the user access control to large databases in the hospitals and the banks, database security has been emphasized. There are many security models for database systems using wide variety of policy-based access control methods. However, they are not functionally enough to meet the requirements for the complicated and various types of access control. In this paper, we propose a database security system that can individually control user access to data groups of various sites and is suitable for the situation where the user's access privilege to arbitrary data is changed frequently. Data group(s) in different sixes d is defined by the table name(s), attribute(s) and/or record key(s), and the access privilege is defined by security levels, roles and polices. The proposed system operates in two phases. The first phase is composed of a modified MAC (Mandatory Access Control) model and RBAC (Role-Based Access Control) model. A user can access any data that has lower or equal security levels, and that is accessible by the roles to which the user is assigned. All types of access mode are controlled in this phase. In the second phase, a modified DAC(Discretionary Access Control) model is applied to re-control the 'read' mode by filtering out the non-accessible data from the result obtained at the first phase. For this purpose, we also defined the user group s that can be characterized by security levels, roles or any partition of users. The policies represented in the form of Block(s, d, r) were also defined and used to control access to any data or data group(s) that is not permitted in 'read ' mode. With this proposed security system, more complicated 'read' access to various data sizes for individual users can be flexibly controlled, while other access mode can be controlled as usual. An implementation example for a database system that manages specimen and clinical information is presented.

Information flow control in object-oriented systems

We describe a high assurance discretionary access control model for object oriented systems. The model not only ensures protection against Trojan horses leaking information, but provides the flexibility of discretionary access control at the same time. The basic idea of our approach is to check all information flows among objects in the system in order to block possible illegal flows. An illegal flow arises when information is transmitted from one object to another object in violation of the security policy. The interaction modes among objects are taken into account in determining illegal flows. We consider three different interaction modes that are standard interaction modes found in the open distributed processing models. The paper presents formal definitions and proof of correctness of our flow control algorithm.

A temporal access control mechanism for database systems

The paper presents a discretionary access control model in which authorizations contain temporal intervals of validity. An authorization is automatically revoked when the associated temporal interval expires. The proposed model provides rules for the automatic derivation of new authorizations from those explicitly specified. Both positive and negative authorizations are supported. A formal definition of those concepts is presented, together with the semantic interpretation of authorizations and derivation rules as clauses of a general logic program. Issues deriving from the presence of negative authorizations are discussed. We also allow negation in rules: it is possible to derive new authorizations on the basis of the absence of other authorizations. The presence of this type of rule may lead to the generation of different sets of authorizations, depending on the evaluation order. An approach is presented, based on establishing an ordering among authorizations and derivation rules, which guarantees a unique set of valid authorizations. Moreover, we give an algorithm detecting whether such an ordering can be established for a given set of authorizations and rules. Administrative operations for adding, removing, or modifying authorizations and derivation rules are presented and efficiency issues related to these operations are also tackled in the paper. A materialization approach is proposed, allowing to efficiently perform access control.