Sebery J.Cryptography.An introduction to computer security.1989

{table { CREATE TABLE, CREATE ANY TABLE, ALTER ANY TABLE, BACKUP ANY TABLE, DROP ANY TABLE, LOCK ANY TABLE, COMMENT ANY TABLE, SELECT ANY TABLE, INSERT ANY TABLE, UPDATE ANY TABLE, DELETE ANY TABLE.

{tablespace { CREATE TABLESPACE, ALTER TABLESPACE, MANAGE TABLESPACE, DROP TABLESPACE, UNLIMITED TABLESPACE.

{ transaction { FORCE TRANSACTION, FORCE ANY TRANSACTION.

{ trigger { CREATE TRIGGER, CREATE ANY TRIGGER, ALTER ANY TRIGGER, DROP ANY TRIGGER.

{ user { CREATE USER, BECOME ANY USER, ALTER USER, DROP USER. { view { CREATE VIEW, CREATE ANY VIEW, DROP ANY VIEW.

Objects in Oracle are tables, views, sequences and procedures. The object privileges are

{ALTER,

{DELETE,

{EXECUTE,

{INDEX,

{INSERT,

{REFERENCES,

{SELECT,

{UPDATE.

A role is a group of several privileges and roles that are granted and revoked together. Any user with privilege CREATE ROLE can de ne their own role. The name of a role must be unique and di erent from user names and other role names. Oracle has nine prede ned roles. For instance, the role CONNECT encapsulates the following privileges:

ALTER SESSION, CREATE CLUSTER, CREATE DATABASE LINK, CREATE SEQUENCE, CREATE SESSION, CREATE SYNONYM, CREATE TABLE, CREATE VIEW

Note that before a role is executed, it is rst authorized. The authorization can be done by Oracle (using passwords), by the host (operating system) or by a network service.

562 16 DATABASE PROTECTION AND SECURITY

16.9.3 Oracle Security Server

The Oracle Security Server (OSS) supports centralized authorization and distributed authentication in an Oracle environment. To ensure secure management of database resources,

1.Identities must be named uniquely. A local Oracle server takes care that all local identities di er. This is no longer true in a distributed environment where two local servers may use the same names. To avoid collisions, OSS creates names according to the X.500 standard (see [112]). The names complying with the standard are called distinguished names (DNs) and are of the following format:

DN=([Country,][Org,][OrgUnit,][State,] [Locality,] CommonName)

where Org stands for Organization.

2.Any subject (active identity) should be able to talk to any server in the Oracle enterprise in a secure manner. The implementation of secure communication requires

a)A secure key establishment protocol. Oracle applies a version of the SKEME protocol described in [289]. Cryptographic operations (encryption and digital signature) are based on RSA,

b)A trusted Certi cation Authority (CA) that provides an authentic cryptographic key typically in the form of certi cates (a certi cate is a public key signed by CA).

The OSS includes three major components

{OSS Manager,

{OSS Repository,

{OSS Authentication Adapter.

The OSS Manager is an application of Oracle Enterprise Manager that administer the OSS Repository. The OSS Manager provides a graphical user interface (GUI) that is used to de ne and maintain information about identities and the authorizations granted to the identities for usage of database resources within the enterprise. Typically, the OSS Manager runs under Widows NT 4.0 or Windows 95.

The OSS Repository stores all information provided by the OSS Manager and in fact, acts as the Certi cation Authority (CA) for the OSS. In particular,

the Repository generates and stores certi cates of public keys of subjects. It also keeps information about certi cates that have expired or have been revoked. The Repository is a primary source of Oracle certi cates or in other words, it maintains the public key infrastructure (PKI) for the enterprise.

17 ACCESS CONTROL

A computing environment can be seen as a collection of resources which are shared by user processes under a watchful eye of the operating system. The collection typically includes hardware resources (the CPU, the main memory, disk space, I/O devices, etc.) and software resources (editors, compilers, debugging tools, etc.). Sharing of resources can take on di erent forms and each form of sharing requires di erent degree of the operating system attention or control. For example, resources such as printers may be accessed by every process as long as the operating system puts the interested processes in a queue so they can access the printer sequentially in some order. An editor can be accessed concurrently by many processes as long as each process does not modify it. Normally, personal data les can be accessed by their owners only. The main task of the operating system (OS) is to control the access to system resources. The classi cation of computer entities into resources (passive) and processes (active) is not disjoint as a process can be also a resource to which another process would like to have an access. In the access control vocabulary, passive entities or resources are called objects and active entities or processes are called subjects.

Any type of resource (object) has the well de ned collection of access operations specifying how the object can be manipulated by a subject. A subject can usually be granted a small subset of all possible access operations. This subset de nes access privileges (permissions) assigned to the subject. Whenever a subject wishes to access an object to perform some speci c operation (read, write, execute, etc.), the OS checks whether the subject has the corresponding access permissions to the object. If the subject holds the appropriate permissions, the OS grants the access, otherwise denies the access to the object.

The access control can be based on di erent policies. The choice of a security policy is crucial as it determines the performance, exibility, and availability of the computer system. The policy is normally de ned by the organization

566 17 ACCESS CONTROL

and re ects restrictions imposed on access control by the legal and business requirements. Consider the following aspects of access control policy:

1.Minimum versus maximum collection of privileges { The assignment of access permissions can be done using the minimum privilege principle where a subject gets assigned the smallest possible collection of access permissions that is enough for the subject to function normally. The other extreme is the maximum privilege principle which de nes widest range of permissions for subjects.

2.Open versus closed access control { OS has to verify each access request generated by a subject. There are two possibilities. All access requests are allowed unless they are explicitly forbidden. This is an open access control. In a closed access control, all access requests are forbidden unless explicitly authorized.

3.Granulation of access control { Each object has to be well de ned together with its basic collection of access permissions such as: read, write, delete, execute, and create. The permissions may be ordered so if a subject is assigned a privilege of a higher order to an object then the subject implicitly holds all lower-order privileges to the object.

There are three major types of access control:

{Mandatory access control (MAC) { Objects (information) are classi ed on hierarchical levels of security sensitivity (typically, top secret, secret, con - dential, unclassi ed). Subjects (users) are assigned their security clearance. Access of a subject to an object is granted or denied depending on the relation between the clearance of the subject and the security classi cation of the object.

{Discretionary access control (DAC) { Each object has its unique owner. The owner exercises their discretion over the assignment of access permissions.

{Role based access control (RBAC) { Rather than to subjects, permissions are assigned to roles. A subject always acts according to the currently delegated role and therefore acquires the appropriate permissions relevant to the current role. The subject can hold di erent permissions to objects depending on the role assigned to it.

There is a tendency to use mandatory access control for security policies that are governed by a central authority. Discretionary access control, on the other

hand, is set by the owner of an object and can be seen as a decentralized approach to access control.

Role based access control is gaining attention as a viable alternative to MAC and DAC [180, 449]. Access permissions are associated with roles rather than with subjects. Note that most institutions and organizations are role driven. A person who today is the manager of a branch may be asked to be the chair of a selection committee to appoint new sta or to be the acting chief manager for a day or perhaps, the person may be suspended as the manager for some time due to a pending investigation. Depending on circumstances, a person may become a member of new roles or may cease to be a member of other roles.

17.1 Mandatory Access Control

Mandatory access control, also called multilevel access control, originated from the research in military security models and deals with the problem of information ow control. The aim of MAC is to ensure that information ows in one direction. Note that most attacks involve interaction between an attacker (a hostile process or Trojan Horse) and a victim process. One would expect that the enforcement of information ows in one direction could decrease the eÆciency of attacks or perhaps eliminate some of them.

17.1.1 Lattice Model

Denning [136] developed a formal model of MAC using lattices. In the model, there is a collection of objects O (typically, les, program variables, data items, records, etc.), a collection of subjects S (processes) and a collection of security levels L. Security levels are assigned to both subjects and objects.

{Security clearance is a level assigned to a subject.

{Security classi cation is a level associated with an object.

Although levels are shared by both subjects and objects their interpretation is di erent. The decision about whether or not a subject s 2 S can access an object o 2 O is made after looking at the relation between the clearance of the subject and the classi cation of the object. If the clearance dominates the classi cation, the access is permitted, otherwise denied.

568 17 ACCESS CONTROL

The key issue now is the de nition of a relation , which can be used to compare two security levels (clearance with classi cation). It is said that the relation introduces a partial ordering if it is

{transitive, i.e. if a b and b c, then a c and

{antisymmetric, i.e. if a b and b a, then a = b.

A lattice is a partially ordered set hL; i in which a pair a1; a2 2 L has

{ The least upper bound aup 2 L, that is aup a1 and aup a2:

If there is an element c 2 L such that c a1 and c a2, then c aup.

{ The greatest lower bound adown 2 L, that is

a1 adown and a2 adown:

If there is an element c 2 L

If the lattice is nite, it contains two distinguished elements: the largest and the smallest in the lattice.

Consider the security levels L for the case when users are working on different projects and they (their processes) will need to access objects (data) with di erent sensitivity levels: top secret (TS), secret (S), con dential (C) and unclassi ed (U). There is a natural ordering among the sensitivity levels, namely, T S > S > C > U . It is obvious that for any project, there is a speci c collection of necessary objects so for each project, there are corresponding clusters of objects called compartments. Let the collection of object sensitivity be R = fT S; S; C; Ug and the collection of compartments be T . Then L = R T and a security level ` 2 L is a pair of (`R; `T ) where `R 2 R and `T 2 T . A relation can be de ned as

(` `0) ,

for `; `0 2 L. The relation can be used to control the access. A subject s 2 S with its clearance `s 2 L is granted access to an object o 2 O with its classi cation `o if and only if

`s `o

If this happens, we say that the subject s dominates the object o or simply s o. Note that the comparison of subject and object is performed using their labels (security levels).

Consider an example. Given a computer system which is working within

objects related to student data: , to academic sta ; , to visiting scholars; Æ, to executives of the university.

Assume the following clearance levels:

s1 $ (T S; f ; ; ; Æg) s2 $ (S; f ; ; g)

s3 $ (C; f ; g)

The notation s2 $ (S; f ; ; g) reads that s2 has the clearance on the level S and can access objects from compartments , and . The information classi cation levels are

The object o3 is classi ed on the level S and is stored in two compartmentsand . Denote that the clearance level assigned to s as (sR; sT ) and the information classi cation level assigned to o as (oR; oT ). The relation can be de ned as follows:

(s o) , (sR oR) and (sT oT )

The lattice hL; i has two distinguished elements. The smallest is (U;;) and the largest is (T S; T ). The subject s1 can access all objects as its label equals to the largest element in the lattice. The subject s2 can access o1 and o3. The subject s3 is permitted to access o1 only.

17.1.2 Bell-LaPadula Model

Bell and LaPadula [21] introduced a simple model for the information ow control which can be considered as a special case of the general lattice model. The collection of subjects is S and objects, O. The security levels are simply sensitivity levels or L = R = fT S; S; C; Ug with the order . A request generated by a subject is granted if the information ows from lower security levels to

570 17 ACCESS CONTROL

higher security levels. The model concentrates on two access permissions: read and write. Note that when

{A subject reads an objects, the information ows from the object to the subject or

s r o:

{ A subject writes into an object, the information ows from the subject to the object or

s !w o:

There is no violation of the information ow policy when a subject s1 with low clearance is allowed to write into an object o1 with high classi cation. Clearly, a subject s2 with high clearance is permitted to read object o2 with low security classi cation. If the two subjects are happened to be the same, s = s1 = s2, then we can write this as

The rules for information ow control are formulated as follows:

1.Simple security property { a subject can read information from an object if the clearance level of the subject dominates the security classi cation of the object.

2.?-property { a subject can write into an object if the clearance level of the subject is dominated by the security classi cation of the object.

In other words, the simple security property indicates that read down property while the ?-property is termed as write up property.

The existence of so-called covert channels makes it possible for the information to ow in prohibited directions. Consider an example. Assume that there are two subjects with di erent security clearances. Two subjects may conspire to create a covert channel that will be used by the process sL with lower security clearance to read some information from the process sH with higher security clearance. Both processes can agree before hand on an object that is rightfully accessible for both of them. Process sL can write into the objects and sH can read it. Every time sH wants to communicate a single bit to sL, sH puts or releases read lock on the object. sL at the agreed instance of time attempts to write into the object. If the attempt