Protection & Security

1. 12 Protection & Security Kai Bu kaibu@zju.edu.cn http://list.zju.edu.cn/kaibu/cmpt300

2. strictly an internal problem: how to provide controlled access to programs and data stored in a computer system? Protection & Security

3. strictly an internal problem: how to provide controlled access to programs and data stored in a computer system? Protection & Security internal and external problem: how to protect information integrity by preventing unauthorized access, malicious destruction or alteration of data, and accidental introduction of inconsistency?

4. ProtectionSecurity

5. ProtectionSecurity specify&enforce access controls

6. Principle of Least Privilege • Give programs, users, & even systems just enough privileges to perform tasks • Minimize the damage from failure or compromise of a component

7. Need-to-Know Principle • At any time, a process should be able to access only resources that it currently requires to complete its task • Example: when process p invokes procedure A(), A() should access only its own variables and formal parameters • Minimize the risks of possible security violations

8. Protection Domain • Specify resources a process may access • Define a set of objects and the types of operations to be invoked on each object • Access right: the ability to execute an op on an object • Domain: a collection of ordered-pair access rights <object-name, rights-set>

9. Protection Domain • <O4, {print}> shared by D2 and D3

10. Protection Domain • Static vs Dynamic the association between proc & domain is fixed or dynamic throughout the process’s lifetime • Domain switching enable proc to switch from one domain to another toward need-to-know

11. Domain Realization • User as a domain object access depends on user identity • Process as a domain object access depends on proc identity • Procedure as a domain object access depends on local variables defined within the procedure

12. Access Matrix • access(i,j): define a set of operations that a process in domain Di can invoke on object Oj

13. Access Right Switch • Include domains among the objects of the access matrix Require three additional ops: copy, owner, control

14. Copy • Denote by an asterisk * • Copy only within a column • Example: copy F2-read from D2 to D3

15. Copy: Variants • Transfer copy access(i,j) to access(k,j); remove access(i,j); • Limited Copy copy R* only as R to access (k,j); proc in Dkcannot further copy R;

16. Owner • If access(i,j) includes the owner right, proc in domain Di can add or remove any right in any entry in column j;

17. Control • Apply only to domain objects • If access(i,j) includes the control right, proc executing in domain Dican change any right in row j original

18. Control • Apply only to domain objects • If access(i,j) includes the control right, proc executing in domain Dican change any right in row j modified

19. how to implement access matrix?

20. Global Table • Consist of a set of ordered triples <domain, object, rights-set> • Search and compare, allow or error • Limitations: possibly large, addition I/O needed; data redundancy: e.g., if all can read a particular obj, a separate entry needed in every domain;

21. Access Lists for Objects • Each column as an access list for an obj • Consist of a set of ordered pairs: <domain, rights-set> • An additional default set of access rights may be used

22. Capability Lists for Domains • Each row as an access list for a domain • Consist of a set of ordered pairs: <object, rights-set>

23. Lock-Key • Each object has a list of unique locks • Each domain has a list of unique keys • A process executing in a domain can access an object only if that domain hasa key that matches one of the locks of the object

24. Revocation of Access Rights • For access-list scheme: search the access list for any rights to be revoked; delete them from the list.

25. Revocation of Capabilities • Reacquisition • Back-pointers • Indirection • Keys

26. Revocation of Capabilities • Reacquisition periodically delete capabilities from each domain; reacquire deleted capabilities upon next access; • Back-pointers • Indirection • Keys

27. Revocation of Capabilities • Reacquisition • Back-pointers maintain a list of pointers for each obj; point to the obj’s capabilities; follow pointers to change capabilities; • Indirection • Keys

28. Revocation of Capabilities • Reacquisition • Back-pointers • Indirection indirectly point capabilities to objects; capability points to a unique entry in a global table, which points to the object; delete a table entry to revoke; • Keys

29. Revocation of Capabilities • Reacquisition • Back-pointers • Indirection • Keys associate each capability with a key; associate each object with a master key; match the keys when assigning rights; replace master keys to revoke;

30. ProtectionSecurity specify&enforce access controls

31. ProtectionSecurity what if AccessControl violation?

32. SecuritySecurity what if AccessControl violation?

33. Security what if AccessControl violation? intruder/cracker: those attempting to breach security; threat: the potential for security violation; attack: the attempt to break security;

34. Security Violations • Breach of confidentiality unauthorized reading of data • Breach of integrity unauthorized modification of data • Breach of availability unauthorized destruction of data • Theft of service unauthorized use of resources • Denial of service prevent legitimate use of the system

35. Security Attacks • Masquerading breach authentication; pretend someone else • Man-in-the-middle masquerade as sender to receiver, AND masquerade receiver to sender

36. how programs breach security?

37. Trojan, Trap, Bomb • Trojan Horse a code segment that misuses its env • Trap Door a hole in the software that can be used only by its designer • Logic Bomb a security hole to be created when a predefined set of parameters was met

38. Stack/Buffer Overflow • Program neglects bounds checking • Attacker sends more data than expected • Overwrite return address on the stack with address of the exploit code

39. Viruses • A fragment of self-replicating code embedded in a legitimate program • Categories: file, boot, macro, source code, polymorphic, encrypted, stealth, tunneling, multipartite, armored cont.

40. Viruses • Polymorphic change each time it is installed to avoid detection by antivirus software; • Encrypted include decryption code along with the encrypted virus • Stealth modify parts of the system that could be used to detect it;

41. what’s beyond program?

42. system and network threats

43. system and network threats abuse of service & network connection

44. Worms • A process that uses spawn mechanism to duplicate itself • Use up system resources and lock out all other processes The Morris Internet Worm: copy worm to hooked systems:

45. Port Scanning • A means for a cracker to detect a system’s vulnerabilities to attack • Create a TCP/IP connection to a specific port or a range of ports • Use known bugs of answering services

46. Denial of Service • Disrupt legitimate use of a system or facility • Example: TCP SYN Flood • DDoS: Distributed Denial of Service

47. how to defend against attacks?

48. how to defend against attacks? cryptography based on secrets

49. Encryption Components: • A set K of keys • A set M of messages • A set C of ciphertexts • An encrypting function E : K  (M  C) • A decrypting function D : K  (C  M) Types: symmetric vs asymmetric

50. Symmetric Encryption • The same key to encrypt and decrypt