Access Control Reference Monitor

Question 1

What is a reference monitor?

Answer 1

The reference monitor can be found in all computers. All access decisions are based on a set of security parameters for both the subject and object.

The access privileges of subjects and protection attributes of objects are stored in a database. This allows the reference monitor to enforce the access control policies.

The reference monitor is also responsible for writing subject requests and its decisions to an audit file (logging).

Question 2

What are the three main properties of the reference monitor?

Answer 2

The three main properties are:

1. Complete mediation: The reference monitor should always be invoked. It cannot be bypassed by any user or program.
2. Tamper-proof: It must be immutable and its integrity unquestionable.
3. Verifiability: It must be small enough to be subjected to analysis and testing to ensure its correctness.

Question 3

Where is the reference monitor situated on a computer?

Answer 3

There is no strict rule governing reference monitor placement. It can be implemented in:

1. Hardware
2. In the OS/OS kernel,
3. In VMs and middelware (typical for cloud computing)
4. As an application
5. As a service.

In short, it can be placed anywhere. In modern computers the reference model is typically implemented in hardware. This provides performance benefits while also ensuring mediation (circumventing hardware is impossible).