Why applications don't have constraint-based security?

Question

In almost any security system I've ever seen, what is controlled is that which person has access to which part.

However, in real life, in many situations, security systems also consider when and where a person is permitted to do something.

For example, you can drive fast in day, but you can't drive fast in night, or you can marry a homosexual officially in X, but you can't marry the same gender in Y.

Does constraint-based security has any meaning in the context of software. For example, a system can prevent you from entering in certain times of the day (after work for example), or another system can let you stay signed in, only if you type fast enough, or another system can let you enter data, only if you are currently located in the USA (Geolocation API), etc.

Why computer security systems don't match real life scenarios?

Answer 1

They do this, if it is needed. I worked for a large bank once, where the id cards had access rights to different parts of different buildings and at different times. So if you wanted to work over the weekend you had to make sure, that you would be able to enter the building.

But setting up such a system requires a lot of work. Each rule must be set up and assigned to a person or a group. You only want to do this kind of work if absolutely necessary, otherwise people will ignore it and managers will grant access rights to their whole team at any time to make sure they don't have to do extra work just because somebody needs to do some extra hours or come in very early.

It just generates extra work. I was doing contract work in that bank. The ID system was smart enough that you could limit building access to the date the contract would end. So when my contract was renewed for another three months, of course they forgot to renew ID access as well, so I had to get a paper signed from my boss and walk to the security department (different building several blocks away) to get my ID card updated.

There are many other rules of this kind. For example you can watch certain videos on Youtube only from within certain countries, depending on different rules. In Germany you can't watch Youtube videos if they use background music with copyrights from the major music production companies. Google Music Beta is only available in the United States.

With each new layer of security you add complexity. Some rules are difficult to implement, like location by IP, which you can get around by using a proxy server. This increases the risk of bugs and invites laziness by users.

Answer 2

Constraint based security systems have too many flaws in the general case that you stated that implementing it in computers would be terrible. Just from your examples:

Driving: I CAN follow the speed limits for my time of day and place, but I don't have to, and usually don't - it's impossible to get anywhere in Montana driving the speedlimit. Not only is this an example of not following the constraint (law) it's also showing an imperitive where I wouldn't want to.

Marriage rights: I CAN get married to group 'x' in state 'y' but will state 'z' recognize my marriage to group 'x' because they outlaw the marriage of group 'x' in their state. This is an example of constraint inconsistency, and can be hazardous to employees, in the effect that it can limit their ability to perform their basic tasks with which they are charged based on location (geolocation that you stated later), and can hurt the overall ability of the company.

ToD Restrictions: Is this a server side or client side qual, because if the computer doesn't have to check in with the server for time, someone can easily get into the bios of the client side computer (assuming it's not locked, they usually aren't) and change the time such that they can log on.

Typing Speed Restrictions: This would just be dumb, much akin to laws like No selling alcohol to Moose - Alaska. Most employees aren't in a situation where typing is ALWAYS an imperitive, what am I supposed to do when I want to research a method in python, sit and hold the space key while I read?

The problem with constraint based restrictions in general is the fact that just because there's a constraint doesn't mean that someone won't go around it, and in worst cases that the constraints aren't uniform so people don't want to deal with them in that manner. Secondly, the reason that you see constraints in society but not so much in computer systems is that constraints in society show up in the form of laws and rules that are PHYSICALLY enforcable, as opposed to computer systems where everything is a little more grey and murky.