Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

In almost any security system I've ever seen, what is controlled is that which person has access to which part.

However, in real life, in many situations, security systems also consider when and where a person is permitted to do something.

For example, you can drive fast in day, but you can't drive fast in night, or you can marry a homosexual officially in X, but you can't marry the same gender in Y.

Does constraint-based security has any meaning in the context of software. For example, a system can prevent you from entering in certain times of the day (after work for example), or another system can let you stay signed in, only if you type fast enough, or another system can let you enter data, only if you are currently located in the USA (Geolocation API), etc.

Why computer security systems don't match real life scenarios?

share|improve this question
10  
Where do the adverbs come in? You can read a file quickly? You can log in quietly? You can kill a process violently? –  Caleb Aug 14 '11 at 14:06
    
Can you provide a use case, where your approach is desperately needed? I'm strained to think of examples, other than cross-state homosexual wedding bureaus of course. –  Gleno Aug 14 '11 at 15:06
    
@Gleno, for example, a system may check to see if the working hour is started or not. If yeah, it can let employees login. –  Saeed Neamati Aug 14 '11 at 17:11
    
@Caleb, I updated the question. However, I think adverb semantically means any constraint in time, space, state, action, etc. However, to be more explicit, I used the term constraint –  Saeed Neamati Aug 14 '11 at 17:15
    
@Saeed, is that a common problem where you are from? Employees sneaking into the system at off hours? They better not do that of some reason! –  Gleno Aug 14 '11 at 22:11
show 1 more comment

2 Answers

up vote 14 down vote accepted

They do this, if it is needed. I worked for a large bank once, where the id cards had access rights to different parts of different buildings and at different times. So if you wanted to work over the weekend you had to make sure, that you would be able to enter the building.

But setting up such a system requires a lot of work. Each rule must be set up and assigned to a person or a group. You only want to do this kind of work if absolutely necessary, otherwise people will ignore it and managers will grant access rights to their whole team at any time to make sure they don't have to do extra work just because somebody needs to do some extra hours or come in very early.

It just generates extra work. I was doing contract work in that bank. The ID system was smart enough that you could limit building access to the date the contract would end. So when my contract was renewed for another three months, of course they forgot to renew ID access as well, so I had to get a paper signed from my boss and walk to the security department (different building several blocks away) to get my ID card updated.

There are many other rules of this kind. For example you can watch certain videos on Youtube only from within certain countries, depending on different rules. In Germany you can't watch Youtube videos if they use background music with copyrights from the major music production companies. Google Music Beta is only available in the United States.

With each new layer of security you add complexity. Some rules are difficult to implement, like location by IP, which you can get around by using a proxy server. This increases the risk of bugs and invites laziness by users.

share|improve this answer
add comment

Constraint based security systems have too many flaws in the general case that you stated that implementing it in computers would be terrible. Just from your examples:

Driving: I CAN follow the speed limits for my time of day and place, but I don't have to, and usually don't - it's impossible to get anywhere in Montana driving the speedlimit. Not only is this an example of not following the constraint (law) it's also showing an imperitive where I wouldn't want to.

Marriage rights: I CAN get married to group 'x' in state 'y' but will state 'z' recognize my marriage to group 'x' because they outlaw the marriage of group 'x' in their state. This is an example of constraint inconsistency, and can be hazardous to employees, in the effect that it can limit their ability to perform their basic tasks with which they are charged based on location (geolocation that you stated later), and can hurt the overall ability of the company.

ToD Restrictions: Is this a server side or client side qual, because if the computer doesn't have to check in with the server for time, someone can easily get into the bios of the client side computer (assuming it's not locked, they usually aren't) and change the time such that they can log on.

Typing Speed Restrictions: This would just be dumb, much akin to laws like No selling alcohol to Moose - Alaska. Most employees aren't in a situation where typing is ALWAYS an imperitive, what am I supposed to do when I want to research a method in python, sit and hold the space key while I read?

The problem with constraint based restrictions in general is the fact that just because there's a constraint doesn't mean that someone won't go around it, and in worst cases that the constraints aren't uniform so people don't want to deal with them in that manner. Secondly, the reason that you see constraints in society but not so much in computer systems is that constraints in society show up in the form of laws and rules that are PHYSICALLY enforcable, as opposed to computer systems where everything is a little more grey and murky.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.