Lecture

Access Control Policies: Authentication and Authorization

Graph Chat

Chat with Graph Search

Ask any question about EPFL courses, lectures, exercises, research, news, etc. or try the example questions below.

DISCLAIMER: The Graph Chatbot is not programmed to provide explicit or categorical answers to your questions. Rather, it transforms your questions into API requests that are distributed across the various IT services officially administered by EPFL. Its purpose is solely to collect and recommend relevant references to content that you can explore to help you answer your questions.

In course

COM-402: Information security and privacy

This course provides an overview of information security and privacy topics. It introduces students to the knowledge and tools they will need to deal with the security/privacy challenges they are likely to encounter in today's world. The tools are illustra ...

Description

This lecture delves into access control policies, focusing on authentication and authorization mechanisms. The instructor discusses the importance of differentiating between subjects, objects, and operations, emphasizing the principles of least privilege and the UNIX philosophy. Various authentication methods such as passwords, biometrics, and one-time passwords are explored, along with the concepts of role-based access control (RBAC), discretionary access control (DAC), and mandatory access control (MAC). The lecture also covers the challenges and trade-offs associated with biometrics, OAuth, and Kerberos, highlighting the need for secure and user-friendly authentication protocols.

Instructors (4)

Marcel Busch

Jean-Pierre Hubaux

Jean-Pierre Hubaux is a full professor at EPFL and head of the Laboratory for Data Security. Through his research, he contributes to laying the foundations and developing the tools for protecting privacy in today’s hyper-connected world. He has pioneered the areas of privacy and security in mobile/wireless networks and in personalized health. He is the academic director of the Center for Digital Trust (C4DT). He leads the Data Protection in Personalized Health (DPPH) project funded by the ETH Council and is a co-chair of the Data Security Work Stream of the Global Alliance for Genomics and Health (GA4GH). From 2008 to 2019 he was one of the seven commissioners of the Swiss FCC. He is a Fellow of both IEEE (2008) and ACM (2010). Recent awards: two of his papers obtained distinctions at the IEEE Symposium on Security and Privacy in 2015 and 2018. He is among the most cited researchers in privacy protection and in information security. Spoken languages: French, English, German, Italian

James Richard Larus

Expertise James Larus is a Professor Emeritus and former Dean of the School of Computer and Communication Sciences (IC) at EPFL (école Polytechnique Fédérale de Lausanne). Before joining IC in October 2013, Larus was a researcher, manager, and director in Microsoft Research for over 16 years and an Assistant and Associate Professor in the Computer Sciences Department at the University of Wisconsin, Madison.Larus has been an active contributor to numerous communities. He published over 100 papers (with 14 be

Mathias Josef Payer

Mathias Payer is a security researcher and professor at the EPFL school of computer and communication sciences (IC), leading the HexHive group. His research focuses on protecting applications in the presence of vulnerabilities, with a focus on memory corruption and type violations. He is interested in software security, system security, binary exploitation, effective mitigations, fault isolation/privilege separation, strong sanitization, and software testing (fuzzing) using a combination of binary analysis and compiler-based techniques. More details are available in his CV.

Official source

Ontological neighbourhood

Computer engineering

Computer security: Authentication

Related concepts (31)

Access control

In physical security and information security, access control (AC) is the selective restriction of access to a place or other resource, while access management describes the process. The act of accessing may mean consuming, entering, or using. Permission to access a resource is called authorization. Locks and login credentials are two analogous mechanisms of access control. Physical security Geographical access control may be enforced by personnel (e.g. border guard, bouncer, ticket checker), or with a device such as a turnstile.

Discretionary access control

In computer security, discretionary access control (DAC) is a type of access control defined by the Trusted Computer System Evaluation Criteria (TCSEC) as a means of restricting access to objects based on the identity of subjects and/or groups to which they belong. The controls are discretionary in the sense that a subject with a certain access permission is capable of passing that permission (perhaps indirectly) on to any other subject (unless restrained by mandatory access control).

Organisation-based access control

In computer security, organization-based access control (OrBAC) is an access control model first presented in 2003. The current approaches of the access control rest on the three entities (subject, action, object) to control the access the policy specifies that some subject has the permission to realize some action on some object. OrBAC allows the policy designer to define a security policy independently of the implementation. The chosen method to fulfill this goal is the introduction of an abstract level.

Password

A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of password-protected services that a typical individual accesses can make memorization of unique passwords for each service impractical. Using the terminology of the NIST Digital Identity Guidelines, the secret is held by a party called the claimant while the party verifying the identity of the claimant is called the verifier.

Password strength

Password strength is a measure of the effectiveness of a password against guessing or brute-force attacks. In its usual form, it estimates how many trials an attacker who does not have direct access to the password would need, on average, to guess it correctly. The strength of a password is a function of length, complexity, and unpredictability. Using strong passwords lowers the overall risk of a security breach, but strong passwords do not replace the need for other effective security controls.

Related lectures (64)

Access Control: Password-based Cryptography

Explores access control and password-based cryptography, including challenges, biometrics, and the biometric passport case study.

Authentication: Basics

Covers the process of verifying identity, traditional methods like passwords, and modern approaches such as biometrics.

Password Security

Emphasizes the importance of safeguarding passwords and avoiding sharing them.

Public-Key Cryptography: Post-Quantum and Access Control

Explores public-key cryptography, post-quantum systems, and access control mechanisms in depth.