Access Control - Revision history

82.121.104.181: /* Background */

2005-09-08T00:43:47Z

Background

← Older revision		Revision as of 00:43, 8 September 2005
Line 169:		Line 169:
	Sometimes, also a developer uses the easier way to reach a goal.		Sometimes, also a developer uses the easier way to reach a goal.

	Sometimes it‘s just user friendly..		Sometimes it‘s just user friendly.

82.121.104.181: /* Background */

2005-09-08T00:43:20Z

Background

← Older revision		Revision as of 00:43, 8 September 2005
Line 169:		Line 169:
	Sometimes, also a developer uses the easier way to reach a goal.		Sometimes, also a developer uses the easier way to reach a goal.

	Sometimes it‘s just user friendly.		Sometimes it‘s just user friendly..

141.20.194.171 at 12:55, 14 December 2004

2004-12-14T12:55:21Z

@@ Line 133: / Line 133: @@
 {|border="0" cellspacing="0" cellpadding="5"
 |-
-|Sandboxing            ||access to a restricted environment
+|Sandboxing
 |-
-|Proof-Carrying-Code   ||tests the behaviour of a program
+|Proof-Carrying-Code
 |-
-|Object Request Brokers||controlling calls for several objects/resources
+|Object Request Brokers
 |}
@@ Line 147: / Line 152: @@
 ==Problems==
-problem if any level doesn’t controll access
+*problem if any level doesn’t controll access

141.20.194.171 at 12:45, 14 December 2004

2004-12-14T12:45:43Z

← Older revision		Revision as of 12:45, 14 December 2004
Line 132:		Line 132:


			{\|border="0" cellspacing="0" cellpadding="5"
	{\|
	\|Granularity		\|Granularity \|\|control access at the right level
		⚫	file access ↔ database file
	\|*control access at the right level
		⚫	different systems, different access controls
⚫	*file access ↔ database file
⚫	*different systems, different access controls
	\|-		\|-
		⚫	\|Sandboxing \|\|access to a restricted environment
	\|Sandboxing
⚫	\|access to a restricted environment
	\|-		\|-
	\|Proof-Carrying-Code		\|Proof-Carrying-Code \|\|tests the behaviour of a program
	\|tests the behaviour of a program
	\|-		\|-
	\|Object Request Brokers		\|Object Request Brokers\|\|controlling calls for several objects/resources
	\|controlling calls for several objects/resources
	\|}		\|}

141.20.194.171 at 12:37, 14 December 2004

2004-12-14T12:37:07Z

← Older revision		Revision as of 12:37, 14 December 2004
Line 133:		Line 133:

	{\|		{\|
	\|Granularity ~~\|control access at the right level~~		\|Granularity
	~~file~~ access ↔ ~~database~~ ~~file~~		\|*control access at the right level
			*file access ↔ database file
	different systems, different access controls		*different systems, different access controls
	\|-		\|-
	\|Sandboxing ~~\|access to a restricted environment~~		\|Sandboxing
			\|access to a restricted environment
	\|-		\|-
	\|Proof-Carrying-Code ~~\|tests the behaviour of a program~~		\|Proof-Carrying-Code
			\|tests the behaviour of a program
	\|-		\|-
	\|Object Request Brokers ~~\|controlling calls for several objects/resources~~		\|Object Request Brokers
			\|controlling calls for several objects/resources
	\|}		\|}

141.20.194.171 at 12:35, 14 December 2004

2004-12-14T12:35:47Z

← Older revision		Revision as of 12:35, 14 December 2004
Line 58:		Line 58:


	Acorn Risc Machine (ARM)		====Acorn Risc Machine (ARM)====

	*most commonly licensed to third-party vendors of embedded systems		*most commonly licensed to third-party vendors of embedded systems
Line 65:		Line 65:
	*hardware protection can be customized		*hardware protection can be customized

	Security Processors		====Security Processors====

	*hardware security support for cryptography and access control		*hardware security support for cryptography and access control
Line 75:		Line 75:

	==Operating Systems==		==Operating Systems==


	*access control for files and processes, ring management, IO-management, memory, processors s.o. as deep as the hardware permits it		*access control for files and processes, ring management, IO-management, memory, processors s.o. as deep as the hardware permits it
Line 81:		Line 82:

	Do it by groups and/or roles !		Do it by groups and/or roles !


	===Groups and Roles===		===Groups and Roles===


	*every user fits into one or some categories		*every user fits into one or some categories
Line 91:		Line 94:

	There‘s no final definition.		There‘s no final definition.


	===Access Control Lists===		===Access Control Lists===


	*just one column of the access control matrix stored for every resource		*just one column of the access control matrix stored for every resource
Line 108:		Line 113:
	*more attributes (take ownership, change permission, delete)		*more attributes (take ownership, change permission, delete)
	*arrangement in domains with trust between them		*arrangement in domains with trust between them


	===Capabilities===		===Capabilities===


			*just one row of the access control matrix stored for every resource
			*some experimental implementatios in the 70s
			*today a comeback in the form of public key certificates

			====Win 2k/XP====

			*used combined with ACL
			*group policies
			*active directory


	===Understands===		===Understands===


			{\|
			\|Granularity \|control access at the right level
			file access ↔ database file
			different systems, different access controls
			\|-
			\|Sandboxing \|access to a restricted environment
			\|-
			\|Proof-Carrying-Code \|tests the behaviour of a program
			\|-
			\|Object Request Brokers \|controlling calls for several objects/resources
			\|}

141.20.194.171 at 12:32, 14 December 2004

2004-12-14T12:32:06Z

@@ Line 75: / Line 75: @@
 ==Operating Systems==
 ===Groups and Roles===
 ===Access Control Lists===
 ===Capabilities===
 ===Understands===

217.231.46.193 at 12:30, 1 December 2004

2004-12-01T12:30:47Z

← Older revision		Revision as of 12:30, 1 December 2004
Line 5:		Line 5:


	~~Controled~~ are issues like		Controlled are issues like

	*access to files		*access to files
	*access to memory		*access to memory
	*execution of programs		*execution of programs
	*sharing ~~datas~~ with other principals		*sharing data with other principals

	Access is ~~controled~~ at different levels:		Access is controlled at different levels:

	*application		*application
Line 26:		Line 26:

	Protection Problem:		Protection Problem:
	preventing one process to ~~interfere~~ with another		preventing one process from interfering with another

	Confinement Problem:		Confinement Problem:
	preventing programs ~~communication~~ outwards through other than		preventing programs communicating outwards through other than
	authorized channels (e.g. memory overwriting)		authorized channels (e.g. memory overwriting)

Line 60:		Line 60:
	Acorn Risc Machine (ARM)		Acorn Risc Machine (ARM)

	*most commonly to third-party vendors of embedded systems ~~licensed~~		*most commonly licensed to third-party vendors of embedded systems
	*32-bit processor		*32-bit processor
	*~~separat~~ banks of registers for user and system processes		*separate banks of registers for user and system processes
	*hardware protection can be customized		*hardware protection can be customized

Line 83:		Line 83:
	==Problems==		==Problems==

	problem if any level doesn’t ~~controle~~ access		problem if any level doesn’t controll access

141.20.195.236 at 15:08, 30 November 2004

2004-11-30T15:08:34Z

@@ Line 1: / Line 1: @@
 Who and what has access to which resource has to be controled on every IT System.
 ==Introduction==
 ==Hardware Protection==
 ===Intel 80x86 (Pentium) Processors===
 ===Other Procssors===
 ==Operating Systems==
@@ Line 16: / Line 82: @@
 ==Problems==

Robsteinde at 13:39, 30 November 2004

2004-11-30T13:39:56Z

← Older revision		Revision as of 13:39, 30 November 2004
Line 1:		Line 1:
	Who and what has access to which resource has to be controled on every IT System.		Who and what has access to which resource has to be controled on every IT System.

			==Introduction==


	'''Contents:'''
			==Hardware Protection==
⚫	=Access Control=
			===Intel 80x86 (Pentium) Processors===
	*[[#Anchor][Access Control by Hardware]]
			===Other Procssors===
	== Access Control by Operating System ==

	== General Problems of Access Control ==
			==Operating Systems==
			===Groups and Roles===
		⚫	===Access Control Lists===
			===Capabilities===
			===Understands===


			==Problems==