Bài giảng An toàn hệ điều hành - Chương: Securing Operating System
Securing Operating System
1
Overview
2
Security goals
ꢀ Secrecy: limit read
ꢀ Integrity: limit write
ꢀ Availability: limit consume
which subjects (e.g., processes and users)
system access
can perform which operations (e.g., read
and write) on which objects (e.g., files and
sockets)
limits operations based on a security requirement,
3
TRUST MODEL
ꢀ A trust model defines a set of software or data upon
which system depends for correct enforcement of
system security goals
ꢀ Trust model of operating system is Trusted Computing
Base (TCB)
ꢀ A system TCB should consist of the minimal amount
of software necessary to enforce the security goals
correctly
4
THREAT MODEL
ꢀ A threat model defines a set of operations that an
attacker may use to compromise a system
ꢀ The model assume a powerful attacker who is
capable of injecting operations from the network and
may be in control of some of the running software on
the system
ꢀ Assume that the attacker may try any and all
operations that are permitted to the attacker
5
ACCESS CONTROL FUNDAMENTALS
ꢀ Fundamental concepts of access control:
ꢀ Protection system: defines the access control
specification
ꢀ Reference monitor: enforces specification
6
PROTECTION SYSTEM
ꢀ A protection system consists of a protection
state, which describes:
ꢀ the operations that system subjects can perform on
system objects, and
ꢀ a set of protection state operations, which enable
modification of that state.
7
PS: LAMPSON’S ACCESS MATRIX
ꢀ Lampson defined the idea that a protection state
is represented by an access matrix
ꢀ access control list (ACL): store columns
ꢀ C-List (capability list ): store rows
8
PS: Problem of Access Matrix
ꢀ A problem of access matrix: untrusted processes
can tamper with the protection system
ꢀ Untrusted user processes can add new subjects,
objects, or operations assigned to cells
ꢀ Discretionary access control (DAC) system:
permits untrusted process to modify protection
state
9
PS: MANDATORY PROTECTION SYSTEMS
A mandatory protection system is a protection system that can only be
modified by trusted administrators via trusted software, consisting of the
following state representations:
• A mandatory protection state is a protection state where subjects and
objects are represented by labels where the state describes the operations
that subject labels may take upon object labels;
• A labeling state for mapping processes and system resource objects to
labels;
• A transition state that describes the legal ways that processes and system
resource objects may be relabeled.
10
11
REFERENCE MONITOR
12
Reference Monitor Interface
ꢀ Defines where the authorization module needs to be
invoked to perform an authorization query to the
protection state:
ꢀ a labeling query to the labeling state, or
ꢀ a transition query to the transition state
ꢀ It ensures that all security-sensitive operations are
authorized by the access enforcement mechanism
13
Authorization Module
ꢀ The authorization module determines the exact
queries that are to be made to the policy store
ꢀ Takes interface’s inputs (e.g., process identity, object
references, and system call name), and converts
these to a query
ꢀ The challenge of the module:
ꢀ to map the process identity to a subject label
ꢀ to map the object references to an object label,
ꢀ to determine the actual operations to authorize
14
Policy Store
ꢀ The authorization module is answered by the
policy store
ꢀ Database for the protection state, labeling state,
and transition state
ꢀ The policy store responds to authorization,
labeling, and transition queries based on the
protection system that it maintains
15
SECURE OPERATING SYSTEM DEFINITION
A secure operating system is an operating system where its access enforcement
satisfies the reference monitor concept
The reference monitor concept defines the necessary and sufficient properties of
any system that securely enforces a mandatory protection system, consisting of
three guarantees:
1.Complete Mediation: The system ensures that its access enforcement
mechanism mediates all security-sensitive operations.
2.Tamperproof: The system ensures that its access enforcement
mechanism, including its protection system, cannot be modified by untrusted
3.Verifiable:The access enforcement mechanism, including its protection
system,“must be small enough to be subject to analysis and tests, the
completeness of which can be assured”
16
Security Kernels
17
UNIX PROTECTION SYSTEM
ꢀ UNIX is a discretionary access control (DAC) system
ꢀ UNIX protection system consists of a protection state and a set of
operations that enable processes to modify that state
ꢀ All UNIX resources are represented as files. The protection state
specifies that subjects may perform read, write, and execute operations
on files.
ꢀ UNIX process identity consists of a user id (UID), a group id (GID)
ꢀ Files are also associated with an owner UID and an owner GID.
ꢀ A process with the owner UID can modify any aspect of the protection
state for this file
18
UNIX mode bits
ꢀ A compressed access control list format
ꢀ To specify the access rights of identities to files
ꢀ Mode bits define the rights of three types of subjects: (1) the file
owner UID; (2) the file group GID;and (3) all other subjects
19
Using mode bits authorization
• First, the UNIX authorization mechanism checks whether the
process identity’s UID corresponds to the owner UID of the file,
and if so, uses the mode bits for the owner to authorize access.
• If the process identity’s GID or supplementary groups
correspond to the file’s group GID, then the mode bits for the
group permissions are used.
• Otherwise, the permissions assigned to all others are used.
20
Tải về để xem bản đầy đủ
43 trang
12820
Free
Bạn đang xem 20 trang mẫu của tài liệu "Bài giảng An toàn hệ điều hành - Chương: Securing Operating System", để tải tài liệu gốc về máy hãy click vào nút Download ở trên
File đính kèm:
- bai_giang_an_toan_he_dieu_hanh_chuong_securing_operating_sys.pdf
