Date post: | 26-Dec-2015 |
Category: |
Documents |
Upload: | beverley-butler |
View: | 217 times |
Download: | 0 times |
Access Control &Digital Rights Management
KAIST KSEUichin Lee
Objectives
• Access control: what, how?– Access Control: Principle and Practice. R. S.
Sandhu and P. Samarati, IEEE Communications Magazine, 9(32):40–49, 1994
• Digital rights management– Digital Rights Management, S.R. Subramanya and
Byung K. Yi, IEEE Potential, 2006
Access Control
• Control user access to system resources• May implement specific security policy
– Organization policy– Government policy
• Requirements include– Restrict read access (confidentiality)– Restrict write access (integrity)– Restrict execute access (for applications)
Why Access Control?
• Limit authorized users’ access to resources they need or allowed to use
• Limit damage caused by– unauthorized users– malicious software, viruses
• Prevent interference between applications
General Model
• User requests access to resource– read, write or execute– e.g. Alice tries to open example.txt for editing
• Reference monitor– check validity of a request– grant or deny access accordingly
General Model
AuthorizationDatabase
Authentication Access ControlObjects
SecurityAdministrator
User ReferenceMonitor
Auditing
Reference Monitor
• System process or module that controls access to system resources
• Required characteristics– completeness: always invoked, impossible to
bypass– isolation: must be tamper proof– verifiability: must be shown to be properly
implemented
Access Control
• Policy vs. Mechanism• Policies: high level guidelines that determine
how accesses are controlled and access decisions are determined
• Mechanisms: low-level software and hardware functions that can be configured to implement a policy
Access Matrix
• Subject, object, activity• Authorization is expressed in terms of access rights or
access modes (e.g., read, write, execute, own)
File 1 File 2 File 3 File 4 Account 1 Account 2
JohnOwnR, W
OwnR, W
InquiryCredit
Alice ROwnR, W W R
InquiryDebit
InquiryCredit
Bob R, W ROwnR, W
InquiryDebit
Implementation of Access Matrix
• Access matrix in reality: very large and sparse• Two popular approaches: (1) access control list (ACL)
for files and (2) capability lists of users
File1
File2
File3
File4
John
Alice
Bob
Capability lists of users Access control list for files
Access Control Policies• DAC – Restricting access to objects based on the identity and need-
to-know of the user, process, and/or groups to which they belong– Discretionary, in the sense that a subject is capable of passing certain
access permission on to another subject [NCSC-TG-004]– Widely used in operating systems (Unix, Windows)
• MAC – Restricting access to objects based on fixed security attributes or “clearance labels” assigned to users and to files or other objects.– Mandatory, in the sense that controls cannot be modified by users or
their programs [Bell & Lapadula] – Depends on system-enforced mechanisms that override the intentions of
the resource owner– Widely used in government and DoD systems
• MAC and DAC are not mutually exclusive, and may be used in conjunction
DAC Policies
• User’s identity and authorizations (or rules) that specify the access modes (e.g., read, write, execute) on each object
• Each request of a user is checked against the specified authorizations
• Flow of information is possible: a user who is able to read data can pass it to other users not authorized to read it without the cognizance of the owner
• Example: Unix systems
MAC Policies
• Based on the classification of subjects and objects in the system
• Each user and each object in the system is assigned a security level– Object’s security level represents sensitivity of the
information contained in the object (i.e., potential damage could result from unauthorized disclosure of the information)
– User’s security level (or clearance) represents trustworthiness not to disclose sensitive information to users not cleared to see it
MAC Policies
• Example: military/government arenas:– Top Secret (TS), Secret (S), Confidential (C), and
Unclassified (U)– Policy: TS > S > C > U
• Access to an object by a subject:– Read down: a subject’s clearance must dominate
the security level of the object being read– Write up: a subject’s clearance must be dominated
by the security level of the object being written
MAC Policies
• S subject writes a TS object (yet cannot read it) can overwrite TS data! (still can send email to TS subjects)
– Many systems do not allow write-up, but limit writing to the same level as the subject
• S subject cannot write C or U data S cannot send an email to C or U users
Conventional Access Control Models
• Identity Based Access Control (IBAC)– Access permissions are directly associated with a subject (e.g. ACLs)– Difficult to scale
• Role Based Access Control (RBAC) [Sandhu 1993, NIST 2004]– Access permissions are based on the role(s) a subject is performing– Better scalability and ease of use, but also has drawbacks (more later)
• Lattice Based Access Control (LBAC) [Sandhu 1993]– Implemented in the US defense sector to address MAC requirements
Subjects Subjects Roles Roles
PermissionsPermissions
Actions Actions ResourcesResources
SessionContextsSessionContexts
User
Assig
nmen
t
Perm
issio
nAs
signm
ent
Sess
ion
Role
s
User
Sess
ions
Attribute Based Access Control (ABAC)
• Subject Attributes– Associated with a subject (user, application, process) that defines
the identity and characteristics of the subject– E.g. identifier, name, job title, role
• Resource Attributes– Associated with a resource (web service, system function, or data)– E.g. Dublin Core metadata elements
• Environment Attributes– Describes the operational, technical, or situational environment or
context in which the information access occurs– E.g. current date time, current threat level, network security
classification
ABAC Policy Formulation1. S, R, and E are subjects, resources, and environments, respectively;2. SAk (1 k K), RAm (1 m M), and EAn (1 n N) are the pre-defined
attributes for subjects, resources, and environments, respectively;3. ATTR(s), ATTR(r), and ATTR(e) are attribute assignment relations for
subject s, resource r, and environment e, respectively:
N
M
K
EAEAEAeATTR
RARARArATTR
SASASAsATTR
...)(
...)(
...)(
21
21
21
ABAC Policy Formulation (Cont’d)4. We also use the function notation for the value assignment of individual
attributes. For example:
5. In the most general form, a Policy Rule that decides on whether a subject s can access a resource r in a particular environment e, is a Boolean function of s, r, and e’s attributes:
Role(s) = “Service Consumer”ServiceOwner(r) = “XYZ, Inc.”
CurrentDate(e) = “01-23-2005”
))(),(),((
),,(_:
eATTRrATTRsATTRf
ersaccesscanXRule
The access control decision process in essence amounts to the evaluation of applicable policy rules in the policy store.
ABAC Policy Rule Examples• Modeling conventional RBAC rules:
– “User with role ‘Manager’ may access the ‘ApprovePurchase’ web service”
• Modeling richer access control semantics– “A resource may only be accessed by its owners”
• Modeling mandatory access control– “Classified files can be accessed by users with equal or higher clearance”
'')(
'')(
),,(_:1
chaseApprovePurrName
ManagersRole
ersaccesscanRule
)()(
),,(_:
rOwnerIDsUserID
ersaccesscanRule
2
)()(
),,(_:
rtionClassificasClearance
ersaccesscanRule
3
CP-ABE: Ciphertext-Policy Attribute-Based Encryption
Brent WatersSRI International
John BethencourtCMU
Amit SahaiUCLA
IEEE Symposium on Security and Privacy (SP), 2007
22
What is Ciphertext-Policy Attribute-Based Encryption (CP-ABE)?
• Type of identity-based encryption– One public key– Master private key used to make more restricted
private keys• But very expressive rules for which private
keys can decrypt which ciphertexts– Private keys have “attributes” or labels– Ciphertexts have decryption policies
23
Remote File Storage:Interesting Challenges
• Scalability• Reliability• … But we also want
security
24
• Good:– Flexible access policies
• Bad:– Data vulnerable to compromise– Must trust security of server
Remote File Storage:Server Mediated Access Control
Access control list:Kevin, Dave, andanyone in IT department
Sarah:IT department,backup manager
?
25
• More secure, but loss of flexibility• New key for each file:
– Must be online to distribute keys• Many files with same key:
– Fine grained access control not possible
Remote File Storage:Encrypting the Files
26
Remote File Storage:We Want It All
• Wishlist:– Encrypted files for untrusted storage– Setting up keys is offline– No online, trusted party mediating access to files or keys– Highly expressive, fine grained access policies
• Ciphertext-policy attribute-based encryption does this!– User private keys given list of “attributes”– Files can encrypted under “policy” over those attributes– Can only decrypt if attributes satisfy policy
27
Remote File Storage:Access Control via CP-ABE
Public KeyMSK
SecretKeySarah:“manager”“IT dept.”
SecretKeyKevin:“manager”“sales”
OR
IT dept. AND
manager marketing
28
Collusion Attacks:The Key Threat
• Important potential attack• Users should not be able to
combine keys• Essential, almost defining
property of ABE• Main technical trick of our
scheme: preventing collusion
SKSarah:“A”, “C”
SKKevin:“B”, “D”
AND
A B
?
29
$ cpabe-setup
$ cpabe-keygen -o sarah_priv_key pub_key master_key \
sysadmin it_dept 'office = 1431' 'hire_date = 2002'
$ cpabe-enc pub_key security_report.pdf
(sysadmin and (hire_date < 2005 or security_team)) or
2 of (executive_level >= 5, audit_group, strategy_team))
Implementation:The cp-abe Toolkit
Digital Rights Management
S.R. Subramanya and Byung K. YiIEEE Potential 2006
Digital Rights Management
• Mission: protect rights of digital media producers while enabling access for fair use– grant exclusive rights in exchange for disclosure
• Reality: DRM is just protection technology, and is fast eroding our rights of fair use– may never be able to reuse parts of any digital content
(documents, film, images, audio, etc.)– hinders progress of science and the useful arts
DRM
• Broadly refers to a set of policies, techniques and tools that guide the proper use of digital content
DRM
• Facilitate packaging of raw content into an appropriate form for easy distribution– Offline (CD/DVD), online (CDN, P2P)
• Track and protect the content for temper-proof transmission
• Protect content from unauthorized use• Enable specifications of suitable rights
DRM Architecture
Potable, networked devices (sometimes
with local DRM agent)
Super-distribution: P2P distribution (yet, authorization is needed via a license server)
Content Protection:Encryption or Digital
watermarking
DRM Operation Example
Some Thoughts on DRM in ebooks• Status: B&N (Nook), Amazon (Kindle), and Adobe all provide readers
that run on incompatible DRM standards. – Thanks to DRM, data silos — you can't cross-check to see if you bought book 3
in a series from Apple and book 5 from Amazon without a lot of fiddling around.
– Even when the file format is the same (ePub) the DRM prevents files from, say, the Adobe Digital Editions system from being read by a rival's reader.
– The main effect of DRM, from a platform vendor's perspective, is to lock end-users into their platform in perpetuity
• Problem: Platforms age and die DRM-free is a way to go?• Alternative: watermarking
– It doesn't prevent copying, but makes the original source of a copied file easy to find, which is a deterrent to piracy.
– This appears to be the current best practice in the music industry (in the iTunes store, all music downloads are watermarked)
Excerpts from “More on DRM and ebooks,” Charlie Stross Apr 2012 http://www.antipope.org/charlie/blog-static/2012/04/more-on-drm-and-ebooks.html