Chapter 14: Protection

1. Chapter 14: Protection

2. Objectives • Discuss the goals and principles of protection in a modern computer system • Explain how protection domains combined with an access matrix are used to specify the resources a process may access • Examine capability and language-based protection systems /68

3. Chapter 14: Protection • Goals of Protection • Principles of Protection • Domain of Protection • Access Matrix • Implementation of Access Matrix • Access Control • Revocation of Access Rights • Capability-Based Systems • Language-Based Protection /68

4. Goals of Protection • Operating system consists of a collection of objects, hardware or software • Each object has a unique name and can be accessed through a well-defined set of operations. • Protection problem - ensure that each object is accessed correctly and only by those processes that are allowed to do so. /68

5. Principles of Protection • Guiding principle – principle of least privilege • Programs, users and systems should be given just enough privileges to perform their tasks /68

6. Domain Structure • Access-right = <object-name, rights-set>where rights-set is a subset of all valid operations that can be performed on the object. • Domain = set of access-rights /68

7. Domain Implementation (UNIX) • System consists of 2 domains: • User • Supervisor • UNIX • Domain = user-id • Domain switch accomplished via file system. • Each file has associated with it a domain bit (setuid bit). • When file is executed and setuid = on, then user-id is set to owner of the file being executed. When execution completes user-id is reset. /68

8. Domain Implementation (MULTICS) • Let Di and Djbe any two domain rings. • If j < i Di  Dj /68

9. Access Matrix • View protection as a matrix (access matrix) • Rows represent domains • Columns represent objects • Access(i, j) is the set of operations that a process executing in Domaini can invoke on Objectj /68

10. Access Matrix /68

11. Use of Access Matrix (1/2) • If a process in Domain Ditries to do “op” on objectOj, then “op” must be in the access matrix. • Can be expanded to dynamic protection. • Operations to add, delete access rights. • Special access rights: • owner of Oi • copy op from Oi to Oj • control – Di can modify Dj access rights • transfer – switch from domain Di to Dj /68

12. Use of Access Matrix (2/2) • Access matrix design separates mechanism from policy. • Mechanism • Operating system provides access-matrix + rules. • If ensures that the matrix is only manipulated by authorized agents and that rules are strictly enforced. • Policy • User dictates policy. • Who can access what object and in what mode. /68

13. Implementation of Access Matrix • Each column = Access-control list for one object Defines who can perform what operation. Domain 1 = Read, Write Domain 2 = Read Domain 3 = Read • Each Row = Capability List (like a key)Fore each domain, what operations allowed on what objects. Object 1 – Read Object 4 – Read, Write, Execute Object 5 – Read, Write, Delete, Copy /68

14. Access Matrix of Figure A With Domains as Objects Figure B /68

15. Access Matrix with Copy Rights • Copy • Transfer • Limited copy /68

16. Access Matrix With Owner Rights /68

17. Modified Access Matrix Figure B /68

18. Implementation of Access Matrix • Global Table • Access lists for objects • Capability lists for domains • Lock-Key Mechanism • Comparison /68

19. Access Control • Protection can be applied to non-file resources • Solaris 10 provides role-based access control to implement least privilege • Privilege is right to execute system call or use an option within a system call • Can be assigned to processes • Users assigned roles granting access to privileges and programs /68

20. Role-based Access Control in Solaris 10 /68

21. Revocation of Access Rights • Questions: • Immediate versus delayed. • Selective versus general. • Partial versus total. • Temporary versus permanent. • Access List – Delete access rights from access list. • Simple • Immediate • Capability List – Scheme required to locate capability in the system before capability can be revoked. • Reacquisition, if deleted periodically. • Back-pointers • Indirection • Keys /68

22. Capability-Based Systems • Hydra • Fixed set of access rights known to and interpreted by the system. • Interpretation of user-defined rights performed solely by user's program; system provides access protection for use of these rights. • Cambridge CAP System • Data capability - provides standard read, write, execute of individual storage segments associated with object. • Software capability -interpretation left to the subsystem, through its protected procedures. /68

23. Language-Based Protection • Specification of protection in a programming language allows the high-level description of policies for the allocation and use of resources. • Language implementation can provide software for protection enforcement when automatic hardware-supported checking is unavailable. • Interpret protection specifications to generate calls on whatever protection system is provided by the hardware and the operating system. /68

24. Protection in Java 2 • Protection is handled by the Java Virtual Machine (JVM) • A class is assigned a protection domain when it is loaded by the JVM. • The protection domain indicates what operations the class can (and cannot) perform. • If a library method is invoked that performs a privileged operation, the stack is inspected to ensure the operation can be performed by the library. /68

25. Stack Inspection /68

26. End of Chapter 14 /68

27. Chapter 15: Security

28. Objectives • To discuss security threats and attacks • To explain the fundamentals of encryption, authentication, and hashing • To examine the uses of cryptography in computing • To describe the various countermeasures to security attacks /68

29. Chapter 15: Security • The Security Problem • Program Threats • System and Network Threats • Cryptography as a Security Tool • User Authentication • Implementing Security Defenses • Firewalling to Protect Systems and Networks • Computer-Security Classifications • An Example: Windows XP /68

30. The Security Problem • Security must consider external environment of the system, and protect the system resources • Intruders (crackers) attempt to breach security • Threat is potential security violation • Attack is attempt to breach security • Attack can be accidental or malicious • Easier to protect against accidental than malicious misuse /68

31. Security Violations • Categories • Breach of confidentiality • Breach of integrity • Breach of availability • Theft of service • Denial of service • Methods • Masquerading (breach authentication) • Replay attack • Message modification • Man-in-the-middle attack • Session hijacking /68

32. Standard Security Attacks /68

33. Security Measure Levels • Security must occur at four levels to be effective: • Physical • Human • Avoid social engineering, phishing, dumpster diving • Operating System • Network • Security is as week as the weakest chain /68

34. Program Threats • Trojan Horse • Code segment that misuses its environment • Exploits mechanisms for allowing programs written by users to be executed by other users • Spyware, pop-up browser windows, covert channels • Trap Door • Specific user identifier or password that circumvents normal security procedures • Could be included in a compiler • Logic Bomb • Program that initiates a security incident under certain circumstances • Stack and Buffer Overflow • Exploits a bug in a program (overflow either the stack or memory buffers) /68

35. C Program with Buffer-overflow Condition #include <stdio.h> #define BUFFER SIZE 256 int main(intargc, char *argv[]) { char buffer[BUFFER SIZE]; if (argc < 2) return -1; else { strcpy(buffer,argv[1]); return 0; } } /68

36. Layout of Typical Stack Frame /68

37. Modified Shell Code #include <stdio.h> int main(intargc, char *argv[]) { execvp(‘‘\bin\sh’’,‘‘\bin \sh’’, NULL); return 0; } /68

38. Hypothetical Stack Frame After attack Before attack /68

39. Program Threats (Cont.) • Viruses • Code fragment embedded in legitimate program • Very specific to CPU architecture, operating system, applications • Usually borne via email or as a macro • Visual Basic Macro to reformat hard drive Sub AutoOpen() Dim oFS Set oFS = CreateObject(’’Scripting.FileSystemObject’’) vs = Shell(’’c:command.com /k formatc:’’,vbHide) End Sub /68

40. Program Threats (Cont.) • Virus dropper inserts virus onto the system • Many categories of viruses, literally many thousands of viruses • File • Boot • Macro • Source code • Polymorphic • Encrypted • Stealth • Tunneling • Multipartite • Armored /68

41. A Boot-sector Computer Virus /68

42. System and Network Threats • Worms – use spawn mechanism; standalone program • Internet worm • Exploited UNIX networking features (remote access) and bugs in finger and sendmail programs • Grappling hook program uploaded main worm program • Harmless attack? • Port scanning • Automated attempt to connect to a range of ports on one or a range of IP addresses • Zombie systems, inconsequential systems, … • Denial of Service • Overload the targeted computer preventing it from doing any useful work • Distributed denial-of-service (DDOS) come from multiple sites at once /68

43. The Morris Internet Worm /68

44. Cryptography as a Security Tool • Broadest security tool available • Source and destination of messages cannot be trusted without cryptography • Means to constrain potential senders (sources) and or receivers (destinations) of messages • Based on secrets (keys) /68

45. Secure Communication over Insecure Medium /68

46. Encryption • Encryption algorithm consists of • Set of K keys • Set of M Messages • Set of Cciphertexts (encrypted messages) • A function E : K → (M→C). That is, for each k K, E(k) is a function for generating ciphertexts from messages. • Both E and E(k) for any k should be efficiently computable functions. • A function D : K → (C → M). That is, for each k K, D(k) is a function for generating messages from ciphertexts. • Both D and D(k) for any k should be efficiently computable functions. • An encryption algorithm must provide this essential property: Given a ciphertextc C, a computer can compute m such that E(k)(m) = c only if it possesses D(k). • Thus, a computer holding D(k) can decrypt ciphertexts to the plaintexts used to produce them, but a computer not holding D(k) cannot decrypt ciphertexts. • Since ciphertexts are generally exposed (for example, sent on the network), it is important that it be infeasible to derive D(k) from the ciphertexts /68

47. Symmetric Encryption • Same key used to encrypt and decrypt • E(k) can be derived from D(k), and vice versa • DES is most commonly used symmetric block-encryption algorithm (created by US Govt) • Encrypts a block of data at a time • Triple-DES considered more secure • Advanced Encryption Standard (AES), twofish up and coming • RC4 is most common symmetric stream cipher, but known to have vulnerabilities • Encrypts/decrypts a stream of bytes (i.e wireless transmission) • Key is a input to psuedo-random-bit generator • Generates an infinite keystream /68

48. Asymmetric Encryption • Public-key encryption based on each user having two keys: • public key – published key used to encrypt data • private key – key known only to individual user used to decrypt data • Must be an encryption scheme that can be made public without making it easy to figure out the decryption scheme • Most common is RSA block cipher • Efficient algorithm for testing whether or not a number is prime • No efficient algorithm is know for finding the prime factors of a number /68

49. Asymmetric Encryption (Cont.) • Formally, it is computationally infeasible to derive D(kd , N) from E(ke , N), and so E(ke, N) need not be kept secret and can be widely disseminated • E(ke , N) (or just ke) is the public key • D(kd , N) (or just kd) is the private key • N is the product of two large, randomly chosen prime numbers p and q (for example, p and q are 512 bits each) • Encryption algorithm is E(ke , N)(m) = mkemod N, where kesatisfies kekdmod (p−1)(q −1) = 1 • The decryption algorithm is then D(kd , N)(c) = ckdmod N /68

50. Asymmetric Encryption Example • For example. make p = 7and q = 13 • We then calculate N = 7∗13 = 91 and (p−1)(q−1) = 72 • We next select kerelatively prime to 72 and< 72, yielding 5 • Finally,we calculate kdsuch that kekdmod 72 = 1, yielding 29 • We how have our keys • Public key, ke, N = 5, 91 • Private key, kd , N = 29, 91 • Encrypting the message 69 with the public key results in the cyphertext 62 • Cyphertext can be decoded with the private key • Public key can be distributed in cleartext to anyone who wants to communicate with holder of public key /68