Access Control: An Introduction To Access Control

The Problem

Your building is secure at night, but during the day there are several doors that have to be open. Anybody could walk in. What can you do?

The Solution

You need an Access Control System.

What is an Access Control System?

Access Control is an electronic security system which permits or restricts access to specific areas of a premises. It not only protects property against unwanted visitors but ensures the safety of both the property and of the people inside.

In simple terms, an Access Control System provides control of entry (or exit) through nominated doors via a control panel and some form of electric locking facility.

An Access Control System can be as simple or as complicated as you wish but in each case, the solution will always provide an easy passage for permitted persons around the building.

Door Entry or Access Control?

Door entry is commonly associated with a single door or gate, whereas access control is more suited to multiple doors or entry points.

Access Control can also incorporate a host of other features which enhance other areas of the business.

Access Control / Door Entry Technology

There are a number of ways that a permitted user can open a door that is fitted with a system.

PIN Code Entry

The most common unit is the keypad system. This comprises a control unit with a series of numbered push buttons, or a touch-sensitive pad, connected to the lock release mechanism via a control unit located at the entrance.

Magstripe (also called Swipe Card) Readers

Each entry point has a card reader and the user “swipes” an encoded card similar to a credit card to gain entry.

This technology is widely used and there are many choices of manufacturers.

Proximity Readers

Rather than swiping the card or tag, it is simply presented to a reader which typically will see the card at a distance of about 100mm. This is a fast, non-contact, method of entry.

Long Range Readers

Long range proximity readers (of approximately a meter or so) automatically unlock or open a door when it detects the card.

This is particularly suitable for compliance with the Disability Discrimination Act  (DDA) as no action is required by the card bearer.

Smartcard Readers

For systems that use cards or tags, these cards can also carry additional information which can be used for other building services – – for example, time and attendance functions, integration with payroll systems, car park management and even vending machine applications.

Biometric Readers

A Biometric Reader system uses unique human characteristics – such as finger prints or a retina scan – to clearly identify those who are permitted access.

As there are no cards or tags which can be stolen or lost, or open to misuse, this type of system significantly increases the level of security.

What about Visitors?

You will want to welcome most of those who visit your premises, so it must be easy for them to let you know they are there.

The three most common means of attracting attention are:

• A simple door bell system which alerts your staff to the fact that there is someone waiting outside.

• An audio intercom panel which allows the visitor to have a direct conversation with a member of your staff and, if appropriate, the door can be remotely released.

• An audio intercom panel with a camera facility which allows your staff to see who wants to enter the building before permitting access.

Once access has been permitted, the visitor can either be escorted around or issued with a card or pin number for the duration of their visit.

Things to Consider

When planning an access control system, you should consider the following:

• How many entry/exit points
• Where are these located>
• Level of security desired
• The movement of staff around the building
• Method of operation
• Future growth of building
• Turnover of employees
• Disability access
• Interface with other systems – for example, the fire alarm

As with any type of security system, it is sensible to employ a company that you can trust. Make sure you use a NSI (NACOSS) approved organisation; this will ensure that your system will be designed and installed by professionals.

Analysis of a Mandatory Access Restriction System for Oracle DBMS

This paper is devoted to the analysis of mandatory access restriction system for Oracle DBMS. As the result, several leakage channels are discovered.
This paper is devoted to the analysis of mandatory access restriction system for Oracle DBMS. As the result, several leakage channels are discovered.

For many information system based on DBMS it is often a problem to implement access restriction, which takes information value into account. It is usually crucial for large-scale information systems of government or corporate use (i.e. geographical information systems or document management systems). Such system usually imply mandatory access model. One of the features of the mandatory model is prevention of either intentional or accidental decrease of information value thanks to information flow control. Mandatory access model is implemented by labeling all the subjects and objects belonging to the access restriction system.

Oracle DBMS is currently one of the most powerful and popular industrial DBMS. Starting from Oracle9i version, Oracle Label Security (OLS) component is implemented, which makes it possible to organize mandatory access to stored data. OLS is a set of procedures and limitations built into database kernel, which allow implementation of record-level access control. In order to enable OLS it is necessary to create a security policy containing a set of labels. Whenever this policy is created it should be applied to protected tables and users should receive rights to corresponding labels.
Analysis for possible leakage channels of confidential information seems interesting for the reviewed system.
We are offering the following common analysis algorithm of the implemented mandatory access model.
1) Access object types are determined according to the published documentation and investigation of the DBMS (e.g., tables, strings, or columns).
2) Commands of SQL are analyzed in terms of how users can modify access objects.
3) Several objects with different confidentiality levels are created for each access object type.
4) Several user (access subject) accounts are created with different mandatory access rights.
5) A sequence of SQL-queries is formed, which are executed with different mandatory access restriction rights and objects with different confidentiality level. According to the analysis of execution of these queries it is possible to build an access model, and to make a conclusion whether the system has vulnerabilities, which can lead to leakage or corruption of confidential information.
Let us consider access objects in OLS. These are table records, which have unique labels. It is often implied that tables are access objects in OLS because security policy is applied to tables. However tables do not have labels themselves; they just contain labeled rows.
The following basic SQL operations handle individual records:
- CREATE – creation of a new record;
- SELECT – reading of an existing record;
- UPDATE – modification of an existing record;
- DELETE – deletion of a record.
Our experiments consisted of sequences of queries called by users with different mandatory access rights to objects of different confidentiality levels. These experiments made it possible to construct the mandatory access model of OLS to records. We define two variables: I and J. I is a value of object’s label. Smaller values of I indicate higher confidentiality level (the value of 0 corresponds to “top secret”). J is a value of subject’s access level.
The model can be presented in the following formalized view:


1. CREATE \ SELECT \ UPDATE \ DELETE, j = i
2. SELECT, j  i

Such mandatory access model on record-level is quite correct and it meets criteria of Bell-La Padula security model. So OLS works correctly on the level of table records.
However, beside records as representation of stored data, users can interact with other data representation, which are not affected by the mandatory access policy. Tables are an example of such objects. Users indeed can modify structure of tables, i.e. add new fields, change their names, and modify data types. OLS loses its ability to work properly on table level.
For instance, a user with higher mandatory rights has a right to create a new field in a table. The name of the field may be confidential itself, and OLS mechanism does not prevent this operation. A user with lower access rights has always a possibility to query names of all the fields.
For example, a new field is created with the name new_password_xxx (where xxx is a top secret information) with the following sql-query:
ALTER TABLE user1.test_table ADD (new_password VARCHAR2(30));
If another user who does not have any mandatory rights executes the following query (SELECT * FROM user1.test_table; ), he gets an empty data set, however all field names ofuser1.test_table are exposed to him. As it was shown above, column name can contain classified information.
Operations shown in the example create duplex channels of data exchange between subjects with higher and lower access rights, and therefore they can cause leakage of classified information.
In the issue of the foresaid, the mandatory access model implemented in Oracle is not complete, and this fact makes it possible to exchange classified information without any control of the mandatory access system, which decreases information value.
Also you can read about actual methods of biometric keyboard signature authentication from our site: http://www.allmysoft.com/biometric-keyboard-signature-authentication.html