Access Control - Revision history

Tom: /* Context */

2025-11-30T23:28:26Z

‎Context

2025-11-30T23:22:04Z

‎Context

2025-11-30T23:16:10Z

‎Full Title or Meme

2025-06-08T18:35:51Z

‎Other Material

2024-11-14T18:59:05Z

‎Problems

2024-11-14T18:58:10Z

‎Problems

2024-11-14T18:56:49Z

‎Problems

2021-12-31T18:39:42Z

‎Solutions

2021-12-31T18:35:33Z

‎Solutions

2021-12-31T18:34:19Z

@@ Line 4: / Line 4: @@
 ==Context==
 ===Historical===
-* 4000 BCE (Mesopotamia): The earliest known wooden locks discovered in Iraq.
+* 4000 BCE (Mesopotamia): The earliest known wooden locks discovered in Iraq.<ref>SC DataCom, ''From Keys to Credentials: The History of Access Control'' https://www.scdatacom.net/blog/from-keys-to-credentials-the-history-of-access-controlnbsp</ref>
 * Egypt (c. 2000 BCE): Wooden pin locks used to secure temples and valuables.
 * Roman Era: Romans refined Greek wooden locks into metal keys and padlocks, later improved by the Chinese for trade routes.

@@ Line 3: / Line 3: @@
 ==Context==
 There are a variety of reasons to limit access to a resource on the web. The primary ones are:
 # Embarrassment - there are some things we just don't want others to know about us.

@@ Line 1: / Line 1: @@
 ==Full Title or Meme==
-[[Authorization]] of [[Access]] to a Resource is the primary end goal for nearly all [[Identity Management]].
+[[Authorization]] of [[Access]] to a Resource has evolved from ancient locks and guards to today’s digital authentication and authorization systems. It began with physical barriers thousands of years ago and now encompasses complex electronic and cloud‑based frameworks.
 ==Context==

@@ Line 13: / Line 13: @@
 Applying both rules means that no security boundary should be crossed without clear permission to do so. And a security policy that allows data flow (MAC) should not allow control flow (MIC).
 So, security boundaries need to distinguish between the two.
-*As a side note Microsoft Vista hashtag#UAC (user access control) is not a boundary of any sort, it is a UX that applies policy to override MAC. (I wrote the spec.)
+*As a side note Microsoft Vista UAC (user access control) is not a boundary of any sort, it is a UX that applies policy to override MAC. (Tom Jones wrote the spec.)
 *It is the rainbow books that described MAC & MIC rules.

@@ Line 9: / Line 9: @@
 ==Problems==
 Security boundaries seem to be mixing two security features which basically describes why cross-site scripting attacks are so common. The basic rule is this - Don't mix control messages with data messages. The two rules are:
-# Bell–LaPadula model focuses on data confidentiality (privacy - hashtag#MAC)
+# Bell–LaPadula model focuses on data confidentiality (privacy - MAC = Mandatory Access Control)
-# Biba Integrity Model is for the protection of data integrity (control - hashtag#MIC)
+# Biba Integrity Model is for the protection of data integrity (control - MIC = Mandatory Integrity Control)
 Applying both rules means that no security boundary should be crossed without clear permission to do so. And a security policy that allows data flow (MAC) should not allow control flow (MIC).
 So, security boundaries need to distinguish between the two.

← Older revision		Revision as of 18:56, 14 November 2024
Line 8:		Line 8:

	==Problems==		==Problems==
		+	Security boundaries seem to be mixing two security features which basically describes why cross-site scripting attacks are so common. The basic rule is this - Don't mix control messages with data messages. The two rules are:
		+	# Bell–LaPadula model focuses on data confidentiality (privacy - hashtag#MAC)
		+	# Biba Integrity Model is for the protection of data integrity (control - hashtag#MIC)
		+	Applying both rules means that no security boundary should be crossed without clear permission to do so. And a security policy that allows data flow (MAC) should not allow control flow (MIC).
		+	So, security boundaries need to distinguish between the two.
		+	*As a side note Microsoft Vista hashtag#UAC (user access control) is not a boundary of any sort, it is a UX that applies policy to override MAC. (I wrote the spec.)
		+	*It is the rainbow books that described MAC & MIC rules.

	==Solutions==		==Solutions==

@@ Line 17: / Line 17: @@
 ===Access Control Encryption===
-or ACE is a scheme for using attribute encryption to acquire access.<ref>Made Sedaghat +1, ''Cross-Domain Attribute-Based Access Control Encryption'' in ''Cryptology and Network Security''Springer ISBN 9783030925475<</ref>
+or ACE is a scheme for using attribute encryption to acquire access.<ref>Made Sedaghat +1, ''Cross-Domain Attribute-Based Access Control Encryption'' in ''Cryptology and Network Security'' Springer ISBN 9783030925475</ref>
 ==References==

@@ Line 10: / Line 10: @@
 ==Solutions==
-In general the wiki page on [[Authorization]] deals with [[Access Dontrol]] in an [[Identity Management]] ecosystem.
+In general the wiki page on [[Authorization]] deals with [[Access Control]] in an [[Identity Management]] ecosystem.
 In the following cases [[Access Control]] is addressed independently from [[Identity Management]].
@@ Line 20: / Line 20: @@
 ==References==
 * See wiki page on [[Access Token]].
 [[Category: Glossary]]
 [[Category: Authorization]]