Chapter 17: Confinement Problem

1. Chapter 17: Confinement Problem Dr. Wayne Summers Department of Computer Science Columbus State University Summers_wayne@colstate.edu http://csc.colstate.edu/summers

2. The Confinement Problem • Confinement problem preventing a server from leaking information that the user of the service considers confidential • Server must ensure that resources accessed on behalf of the client only include resources that client is authorized to access • Server must ensure that it does not reveal client’s data to any other unauthorized entity • Covert channel – path of communications not designed for communication • Rule of transitive confinement – if confined process invokes a second process, the second process must be as confined as the caller

3. Isolation • Virtual machine – program that simulates the hardware of a computer system • Sandbox – environment in which the actions of the process are restricted according to a security policy

4. Covert Channels • Covert storage channel uses an attribute of the shared resource • Covert timing channel uses a temporal or ordering relationship among accesses to a shared resource • Noiseless covert channel – covert channel that uses a resource available to only the sender and receiver • Noisy covert channel – covert channel that uses a resource available to subjects in addition to the sender and receiver

5. Covert channels • Requirements of covert storage channel • Sending and receiving processes have access to the same attribute of a shared object • Sending process is able to modify the attribute of the shared object • Receiving process is able to references the attribute of the shared object • Mechanism must exist for initiating both processes, and properly sequencing the respective accesses to the shared resource

6. Covert channels • Requirements of covert timing channel • Sending and receiving processes have access to the same attribute of a shared object • Sending and receiving processes must have access to a time reference (e.g. clock, timer,…) • Sending process must be able to control the timing of the detection of a change in the attribute by the receiving process • Mechanism must exist for initiating both processes, and properly sequencing the respective accesses to the shared resource