Operating Systems Security Design Objectives Protection by separation Memory and address protection Access control for general objects Directory Access control lists, matrix Capability File protection mechanisms User authentication, passwords Trusted OS 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly) Design Objectives Access to resources Controlling unintentional and intentional corruption of data Protection of one user’s computation from interference from other users Memory protection File protection General control of access to objects User authentication 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Protection by separation Physical separation: use of different objects Temporal separation: use of different times Logical separation: limiting program access to domains Cryptographic separation: concealment of data and computations 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Memory and address protection Fence, Fence register Can protect operating system from one user, but not users from each other Relocation (relocation factor) Base/Bounds register (variable fence register/upper address limit register) For instructions code and for data space Tagged architecture: every word of machine memory has extra bits identifying access rights. Only OS instructions can set them. 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Memory and address protection II Segmentation: program divided into segments represented as pair <name, offset>. OS maintains a table of segment names and true addresses in memory. Segments can be non-contiguous, and stored on auxiliary devices. Protection can be checked each time it is referenced. Fragmentation can be a problem Paging: programs divided into equal sized page frames represented as pair <page, offset> Paging and segmentation 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Access control for general objects Objects: memory, files, executing program in memory, directory, hardware device, data structures, table of the OS, instructions, passwords/user authentication mechanism, protection mechanism itself. Goals: Check every access Enforce least privilege Verify acceptable usage 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly) Directory File directory (problems) (Fig 4-10 and 4-11) Shared objects (list becomes too long) Revocation of access Pseudonyms (two different files with the same name) 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Access control list, matrix One list for each object (Fig 4-12) Access Control Matrix(Table 4-1) 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly) Capability A ticket giving permission to a subject to have certain type of access to an object Server holds tickets on behalf of users Encrypt capabilities under a key available only to the access control mechanism Domain or name space: each process/procedure operates in a domain 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

File Protection Mechanisms All-or-none protection Group protection Single permissions (password protection for files) 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly) User Authentication Passwords Brute force Probable passwords Dictionary Social engineering 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly) Passwords Password selection criteria Non-alphabetic (mixed) Long Avoid actual names Change regularly Don’t write it down Don’t tell any one One-time passwords 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Designing Trusted Operating Systems An OS is trusted if we have confidence that it provides the four services in a consistent and effective way Memory protection File protection General object access control User authentication 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Trusted vs. Secure Systems Either-or Graded Property of presenter Property of receiver Asserted based on product characteristics Judged based on evidence & analysis Absolute Relative A goal A characteristic 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly) Security Policies I Military security policy Top secret, Secret, Confidential, Restricted, Un classified Compartment: contains information associated with a project Combination <rank, compartments> is called a class or classification of information A person seeking access to information must be cleared 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly) Security Policies II Dominance: For subject s and object o, s 0 if and only if rank s  rank o and compartments s  compartments o We say, o dominates s. 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)

Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly) Security Policies III A subject can read an object only if: The clearance level of the subject is at least as high as the clearance level of the information The subject has a need to know about all compartments for which the information is classified 10/14/2018 Acc661 Aud of Adv Acctg Systems, Spring 2003 (Gangolly)