access control-信息安全概论-课件-05.ppt

Copyright ? 2008 by Jingsha He November 25, 2008 Copyright ? 2008 by Jingsha He 1 Introduction to Information Security Prof. Jingsha He School of Software Engineering Beijing University of Technology November 25, 2008 Copyright ? 2008 by Jingsha He 2 Fact of the Lecture Following the World War II, the now two famous pair, Julius and Ethel Rosenburg, were convicted and executed for spying on the U.S. bomb project for the Soviet Union in 1953. At one point, the two invented a clever password system: a cardboard Jell-O box was torn into two and one half and given to a contact whom they would need to identify later. The complex edge shape and color matching made a complex key impossible to forge. Without matching secrets, it is impossible to prove someone’s identity. November 25, 2008 Copyright ? 2008 by Jingsha He 3 Practices Access Control November 25, 2008 Copyright ? 2008 by Jingsha He 4 Identification Authentication Encryption Decryption Access Control CEO Identification Authentication Encryption Decryption Regular Employee Information Flow Auditing November 25, 2008 Copyright ? 2008 by Jingsha He 5 Design Principles Objectives Simplicity Easy to understand Lower probability of making mistakes and incurring errors in the design and implementation Lower chance of introducing inconsistencies within a security policy or a set of security policies Restriction Limit the set of access privileges that are granted to an entity to just what are absolutely necessary November 25, 2008 Copyright ? 2008 by Jingsha He 6 Principle 1: Least Privilege Statement A subject should be given only those privileges that are absolutely necessary for the subject to complete its tasks or functions The so-called “need-to-know” rule Requirements Spatial Grant the privileges that are absolutely needed Temporal Grant the privileges only when it is absolutely needed Challenges Less granularity of privileges Example: write vs. append Super user roles are a common practice Convenience vs. secur