Improving the granularity of access control for Windows 2000

Abstract

________________________________________________________________________This paper presents the mechanisms in Windows 2000 that enable fine-grained and centrally managed access control for both operating system components and applications. These features were added during the transition from Windows NT 4.0 to support the Active Directory, a new feature in Windows 2000, and to protect computers connected to the Internet. While the access control mechanisms in Windows NT are suitable for file systems and applications with simple requirements, they fall short of the needs of applications with complex data objects. Our goal was to use operating system access control mechanisms to protect a large object hierarchy with many types of objects, each with many data properties. We also wanted to reduce t he exposure of users to untrustworthy or exploited programs.We introduced three extensions to support these goals. First, we extended the entries in access control lists to provide an unlimited number of access rights for a single object and to allow grouping those rights for efficiency. Second, we extended the entries to specify precisely how access control lists are assigned to each distinct type of object, instead of treating all types identically. Finally, we extended the data structure identifying users' identity to the operating system to allow users to restrict the set of objects a program may access. These changes allow a single access control mechanism to be used to protect both system and application resources, as well as protect users from each other and users from their programs, simplifying both program development and system management.

An authorization scheme for version control systems

“…One is that resources that are protected in filesystems are different, and have different relationships with one another than in VCSes. The second is that typically, such schemes, such as the ones in POSIX-compliant systems [27] and Windows ACLs [29,30], have only two levels of administrators: a superuser ("root") and the owner of a file or directory. The owner has full discretion in handing out rights to resources that he owns.…”

Describing access control models as design patterns using roles

“…Sun's J2EE [28] uses the RBAC pattern in the authorization service (e.g., password management systems in UNIX and Windows) for E-Commerce applications [29]. Solaris 8 uses the RBAC pattern to restrict access to tools and utilities.…”

Access control with IBM Tivoli access manager

“…CORBA Security also uses the notion of permission groups, called rights families, to extend the number of permissions [Karjoth 2000]. A different approach is used in Windows 2000, where the object type field of an ACL entry specifies to which portion of an object it refers [Swift et al 2002].…”