166 reputation
5
bio website jcwhitson.co.uk
location United Kingdom
age 31
visits member for 2 years, 5 months
seen Mar 31 '13 at 14:51

I'm a freelance web developer with a background in automated testing. My fondest wish is to find a quantum computing question on SO.


Jul
25
awarded  Teacher
Jul
25
comment How dependable can data encryption be without re-entry of password on startup?
And the types of locks used on even high-end computer equipment are hardly high-security.
Jul
25
answered If the attacker knows part of the password but not the length, does that help him in any way?
Jul
25
comment Is there an access-control model defined in terms of application structure?
Yeah, I suppose you're right - I was hoping that in the same way that RBAC is a well-known formal model that can be applied to many different operating systems, there might be a formal model suitable for applying to many different web applications. I suppose if I want one I'll have to write it myself! Thanks for your patience and the paper, which looks highly relevant.
Jul
24
revised Is there an access-control model defined in terms of application structure?
added 166 characters in body
Jul
24
comment Is there an access-control model defined in terms of application structure?
A very simple concrete example: in a UNIX filesystem, I might want to specify that 'a user has read and write permissions for every file underneath the user's home directory' (ignore symlinks!) and that 'a user has read permissions for every file underneath any directory the user owns'. That's the kind of rule I'm talking about, but I'm looking for a formal model like RBAC that takes in the whole general case of that-kind-of-thing. A bit vague, I know, but I've never seen a system with these properties, so I don't really know how to describe it clearly.
Jul
24
comment Is there an access-control model defined in terms of application structure?
Thanks for your answer D.W.. I have a pretty clear idea of the answers to all those questions, but it's the last that's proving troublesome - the 'limits on these actions' need to be something more sophisticated than just a list of <principal, action, resource> triples - I want to be able to say that all principals related to a resource in such-and-such a way have this or that action allowed, with 'related' defined in the terms of my question. I guess that comes under 'common policies', but I can't find a proper way to express these sorts of policies.
Jul
24
awarded  Supporter
Jul
24
revised Is there an access-control model defined in terms of application structure?
added 1036 characters in body
Jul
24
comment Is there an access-control model defined in terms of application structure?
Thanks for the advice Dennis, I appreciate it. The NIST survey is particularly useful. I thoroughly agree about the dangers of rolling one's own access control, but as far as I can tell that's standard practice for web apps, even 'enterprise' ones: these sorts of rules exist (cf. linkedin etc.), but appear to be implemented explicitly in code on an ad hoc basis. Thanks again for your answer, hopefully I'll find some gold in the NIST paper.
Jul
24
comment Is there an access-control model defined in terms of application structure?
I've implemented the prototype of the access control logic in Clojure, but I'm looking for a formal model rather than code or library support - implementing an ad hoc scheme is straightforward, but for this application I'd very much like a proper formally-specified access control model.
Jul
24
comment Is there an access-control model defined in terms of application structure?
Thanks, that's extremely interesting. I've added more detail to my question, hopefully it's a little clearer now - the goal isn't access control per se, but applying arbitrary rules to find out what level of access a user should have to particular objects.
Jul
24
revised Is there an access-control model defined in terms of application structure?
added 292 characters in body
Jul
24
awarded  Student
Jul
24
awarded  Editor
Jul
24
revised Is there an access-control model defined in terms of application structure?
added 216 characters in body
Jul
24
comment Is there an access-control model defined in terms of application structure?
Not quite, at least not as I see it: RBAC schemes allow users to be hierarchically classified into groups, but what I want to do is more complex. I have users and the access-controlled objects within groups, and many different types of groups with different relationships, amongst them; I then want to define permissions rules based on the various relationships that might link a user and an object. Does that make sense? I suppose it's a much generalized case of something like the LinkedIn system, in/out of my network and that sort of thing. I think I've explained it poorly...
Jul
24
asked Is there an access-control model defined in terms of application structure?
Jul
24
awarded  Autobiographer