0

I have a server that enforces access control by means of cryptography, by not giving up data, or by a combination thereof.

By the former (cryptography), I mean: If a user requests some data, the server gives it in an encrypted form. The server doesn't check who you are or anything, it just gives it to you. And if you are able to decrypt it, by implication, you have access.

With the second strategy, I mean: If a user requests some data, the server first checks if you are on a privileged list. If you are, the server gives up the data.

Two different strategies.

I wonder if there is some simple terminology that exists for these common strategies that I can use?

Improve this question

2 Answers 2

Reset to default
0

In your first example, you're talking about a kind of rule-based access control, though it's generally considered poor practice to offer sensitive data just for the asking, even if it is encrypted.

Your second example is discretionary access control. Windows AD permissions are another example of this.

Improve this answer
4
  • Why is the first example rule-based access control, if no rules are in place? Couldn't it be just as well seen as part of a DAC and a public domain?
    – Tom K.
    Oct 3, 2018 at 19:35
  • I would argue that the first is an example of authorization. If you don't have the decryption keys, you don't have permission to view the data. This is different from authentication because at no point does the server actually verify who you are.
    – Mr. Llama
    Oct 3, 2018 at 19:48
  • @Tom It's not, really. Rule-based just fit the best in my mind because access to the data is dependent on a conditional. In reality, it's less access control than it is just giving the data away with ths hope that only the right people can read it.
    – BaselineSec
    Oct 3, 2018 at 19:52
  • @Llama Authorization is tied directly to authentication in most scenarios, the obvious exception being public data. The given example is just a poor attempt at access control. For example, if you lock your house and give keys to your friends, the assumption is that everyone with a key is authorized to enter the house. But if a key is lost, the person who finds it has access to your house, but not necessarily authorization.
    – BaselineSec
    Oct 3, 2018 at 19:57
0

The first is not "access control" as it is usually understood, it's using cryptography to provide confidentiality. Access is not controlled, making sense of the data is.

The second is an access control list.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .