Access Control Matrix

Present by

Napasakorn Sukjay 51-7038-002-5

Poom Samaharn 51-7038-006-6

TopicIntroductionAccess Control MatrixAccess Control List (ACL)Capability List (C-List)The confused deputyComparison between ACL and C-List Summary

IntroductionAccess control matrix is a model of system resource’s

protection. It was first proposed by Butler W. Lampson [1] , an American computer scientist, in 1971. The protection schemes in this model do not allow unauthorized users or subjects to use

system resources. In other words, a particular subject has limitedly accessing rights to some specific objects if not all.

For access control system, it likes using locked doors. The doors can be opened by anyone who owns the right keys.

Another example is checking the movie ticket at a theatre. Viewers with the valid tickets are allowed to pass the door and

watch the movie.Because of increasing in system complexity, the

derivative forms of access control matrix such as access control list (ACL) and capability list (C-list) are better applied.

Those derivatives have some advantages and disadvantages.

Access Control Matrix

Access control matrix consists of triple parts such as subject, object, and access operation. A subject is an

active entity in a computer system such as user, program, process, and thread. An object is a passive

entity or system resource such as file, directory, database record and printer. In access control matrix’s schema, the subjects and objects are placed in a table.

Each row represents a subject and each column represents an object. The data inside the table are set of access operations such as read, write, and execute. The

access operations are responsible for interactions between subjects and objects.

A schematic view

A user requests access operations for objects/resources.

The reference monitor checks request validity and return either granting access or denying access.

Access Request

Reference Monitor

Grant/ Deny

Principle of access control is as follows

1. Assign subjects on the system.2. Assign objects which are recognized by

associated programs.3. Assign access operations that subjects

can use.4. Assign subjects which interact with

objects thru processes.

Access Control Matrix

Table 1: Access Control Matrix [3]r = read w = write x = execute - = not allowed

Corresponding to table 1, there are three users (Bob, Alice, and Sam) and one program (Acct. program) as subjects. They are aligned in row order.

For column alignment, there are five objects that comprise OS, accounting Program, accounting data, insurance data, and payroll data.

Noticeably, the accounting program performs as both subject and object. This approach protects accounting data from corruption or changing by other programs. If other subjects attempt to modify account data, that attempt

will be rejected. However, this protection can be intentionally avoided. The system administrator, Sam, would substitute the accounting program with a

fallacious version. This would cause the protection failure of the original accounting program. However, Alice and Bob are still being able to read and

execute the account program (original or fallacious) without corrupting it in any circumstances.

Access Control List (ACL)

In practical, the system should better not to assign numerous numbers of objects and subjects in a large access control matrix. With a large amount of matrix entries and extreme scattering

of data [2], the large access control matrix would waste too much memory space (e.g. 10,000 subjects x 1,000,000 objects =

1,000,000,000 matrix entries). It also takes quite a while to check and pair between any subject and any object. For better performance of authorization operation, the

access control matrix is split into two doable options or derivatives. The first is access control list and the later is capability. The matrix is split into columns which represents objects. These columns are

called “access control lists” (ACLs). An ACL acts for a column in the access control matrix. ACL is attached to an object and specifies its

related subjects.

Access Control List (ACL)

According to table1 and table 2, if we look for insurance data we can write:

Table 2: Access Control Matrix [3]

Table 1:The composition of an ACL entry [3]

The composition of an ACL entry

Access Control Lists (ACLs) cont.

Figure 1: Access Control Lists (ACLs)

From the figure 1, there are three subjects (Alice, Bob and Fred)

and three objects (file1, file 2, and file 3). Each object is set for particular subject permissions. According to figure 1, each file or object has its

own ACL. File 1 links to two subjects that are Alice and Fred. File 1 allows

a permission to read for both subjects. For ACL of file 2, it allows a

permission to write file 2 for Alice and a permission to read file 2 for

Bob.

Capability List (C-List)

The second derivative of access control matrix is “capability list or C-list”. In this case, the access control matrix is spilt into rows, each row represent one subject. A capability list is attached to a subject and specifies its related objects. Each entry in the list is a capability which is a pair of object

and a set of access operations. Permissions to access objects for each subject are listed in each C-list.

Capability List (C-List) cont.6

From access control matrix, if we look for Alice’s C-list we can write:

Table 1: Access Control Matrix [3]

Capability (C-List) cont.

From figure 2, there are three subjects

(Alice, Bob and Fred) and three objects (file 1, file 2, and file 3). Each subject is assigned permission for operate on each object. For example, Alice has a permission to write on file 2, read and write on file 3.

Figure 2: Capability (C-List)

Confused Deputy

A deputy is a program that acts on behalf of users or subjects. One of the known deputies is “compiler”.

Compiler, a program that transforms source code into a binary form, must act as a deputy for many users. This act causes a classical security problem which is called

“confused deputy”. A confused deputy is a deputy that is inappropriately manipulated. This “confused deputy” problem is commonly found in computer systems.

Confused Deputy cont.

From table 3, the compiler is granted a permission to write anything into a file named “Bill”. The file “Bill” contains critical information

for resources. There is a user named “Alice”. Alice can invoke the compiler and give it a file name to get debugging output. If Alice invokes to compiler

and provide “Bill” as the name of debugging file, the compiler will get confused. Although, Alice does not have a permission to write anything on file “Bill”, the compiler which is the deputy of Alice will overwrite file “Bill”

with debugging information.

*r = read w = write x = execute - = not allowed

Table 3: Access Control Matrix for confused Deputy [3]

The confused deputy cont.

Figure 3: The confused deputy [3]

When the “confused deputy” problem occurs, C-list can prevent it but ACLs have difficulties to avoid this problem. The confusion prevention of C-list is

providing C-list to the compiler shortly before starting debugging process. Alice must give her C-List to compiler if she wants to invoke the compiler. Once

receiving C-list, the compiler checks all permissions related to the target file. The complier will know that Alice does not have the permission to overwrite file “Bill”. On the other hand, ACLs do not have similar protection mechanism to avoid the

confusion.

Comparison between ACL and C-List

Figure 4: Comparison between Access control list and capability [3]

Comparison between ACL and C-List cont.

Access Control List and Capability List look similar but there are many differences. The obvious and

significant difference is the direction of arrows of both approaches

According to figure 4, the arrows for ACLs direct from the resources (objects) to users (subjects) but the

arrows for C-lists direct from users to the resources. This means that the capability pairing between users and

resources is generated by the system. Thus, the permission of users to access files can be modified by

the system itself. Oppositely, the system with ACL approach must need a special method for pairing users to files. This is the first advantage of capability over the

ACL. The table 4 displays other advantages and disadvantages between both.

ACL vs. C-List

Table 4: ACL vs. C-List [3]

Summary

Access control matrix is a model of system resource’s protection. Access control matrix consists of subjects, objects, and

access operations. Subjects are placed in all rows on the matrix table. Objects are placed in all columns. The table are useful for manipulating and protecting system resources. For example, one user can read a file but cannot overwrite it. In practical, the access control matrix is split into two approaches. The first is ACL which

corresponds to the columns. The second is C-list which corresponds to the row. ACL focuses on objects but C-List focuses

on subjects.Both have differences and the differences give some

advantages and disadvantages over other. One common problem such as confused deputy can be prevented by C-list. However, ACL is more commercially use because it does not have high overhead

and easy to implement.

References

 [1] “Access Control Matrix”, Available at: http://en.wikipedia.org/wiki/Access_Control_Matrix

,accessed February 2009. [2] J.Crampton. “Access Control”, Available at:

http://faculty.ksu.edu.sa/mazyad/CEN448/AccessControl.ppt, accessed February 2009. [3] M. Stamp. “Information Security Principles and

Practice” , John Wiley & Sons Inc., NJ. 2006

Thank you