Re: Avoiding IBAC

On Wed, October 15, 2014 16:59, Karp, Alan H wrote:
> Neal H. Walfield wrote:
>>
>> Based on your description, it seems that the system needs ACLs to
>> describe the desired policies.  When Alice grants Bob access to a
>> file, the system needs to check whether Bob is authorized.  So, for
>> HR-only documents, the administrator needs to add an ACL to the
>> relevant files (or filter) that says HR can access these files.  Or,
>> is there a way to do this using capabilities?
>>
> I believe that access control has four parts:
>
> 1. identification: knowing whom to hold responsible
> 2. authentication: proving the right to act as an identified party
> 3. authorization: granting a right to an authenticated party
> 4. access decision: deciding whether or not to honor a request
>

Maybe we should make that seven:

5. attenuation : turning a right into a weaker version of that right
suitable for attenuated authorization (delegation).
6. decomposition : turning a right to a composite into a right to a
component suitable for decomposed authorization (delegation)
7. logging : keeping track of identities tied to authorizations and
honored requests for accountability purposes.



> When we talk about capabilities on this list, we're usually referring to
> #4.  However, deciding to delegate typically uses #2 to influence #3.  In
> your scenario, I think it would be easier to assign roles to people and
> label the files, but you can use ACLs.  The key point is that you are
> using the roles or ACLs to  make authorization decisions, not access
> decisions.
>
> ________________________
> Alan Karp
> Principal Scientist
> Enterprise Services, Office of the CTO
> Hewlett-Packard Company
> 1501 Page Mill Road
> Palo Alto, CA 94304
> (650) 857-3967, fax (650) 857-7029
> http://www.hpl.hp.com/personal/Alan_Karp
>
>
>
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>
>