U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science Emery Berger University of Massachusetts, Amherst Operating Systems CMPSCI 377 Lecture 22: Protection & Security

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 2 Protection vs. Security Protection = controlling access to programs & data stored on computer system Internal problem Security = protecting system from external unauthorized access, malicious destruction, etc.

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 3 Protection Goals of Protection Protection Domains Access Matrix Implementation Revocation of Access Rights Capability-Based Systems Language-Based Protection

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 4 Protection Goal OS: collection of objects, hardware & software Objects have unique names Accessed through well-defined set of operations Goal of protection: Ensure each object accessed correctly & only by those processes that are allowed to do so

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 5 Protection Domains Access-right = Rights-set = subset of all valid operations that can be performed on the object Domain = set of access-rights

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 6 Domain Implementation UNIX Domain = user-id Domain switch accomplished via file system Each file has associated domain bit (setuid bit) When file executed and setuid = on, user-id set to owner of the file being executed When execution completes, user-id is reset

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 7 Domain Implementation MULTICS Precursor to UNIX, by MIT & GE “Ring” protection system, by Bob Graham

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 8 Multics: Rings Nested domain structure (“rings”) Let D i and D j be any two domain rings If j < I  D i  D j lower-level = more privileges each process maintains current ring number

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 9 Access Matrix Column = access-control list for one object Defines who can perform what operation Row = capability list Operations allowed on what objects, per-domain

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 10 Use of Access Matrix (Cont.) Design separates mechanism from policy Mechanism Operating system provides access-matrix + rules. Ensures that the matrix is only manipulated by authorized agents and that rules are strictly enforced Policy User dictates policy: who can access what object and in what mode

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 11 Dynamic Access Matrices Extend for dynamic protection: Operations to add, delete access rights transfer – switch from domain D i to D j owner of O i copy op from O i to O j control – D i can modify D j ’s access rights

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 12 Switching Domains Switching domains: add domains as objects!

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 13 Access Matrix with Copy Rights Asterisk denotes that access right can be copied within column

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 14 Access Matrix With Owner Rights Ownership: can add new rights, remove some rights

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 15 Control: Modifying Access Matrix Control: process executing in one domain can modify another domain Example: D2 changes D4

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 16 Implementation of Access Matrix Global table – Too large, no grouping Access list – per object Simple Capability List – list of objects + operations Object name = capability (think: special pointer) Check in capability list for access

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 17 Revocation of Access Rights Access-list scheme: Search for right to be revoked, delete Immediate, can be selective (just affect some users), can be partial (just some rights revoked)

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 18 Revocation of Access Rights Capabilities: more complicated Reacquisition: Try to reacquire after deletion Back-pointers: point from object to capabilities Expensive (used in MULTICS) Indirection: Capability points to entry in table Not selective Keys: One key per capability Check in global key table

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 19 Capability-Based Systems Hydra Fixed set of access rights known to and interpreted by the system Interpretation of user-defined rights performed solely by user's program System provides access protection for use of these rights Cambridge CAP System Data capability - provides standard read, write, execute of individual storage segments associated with objects Software capability – interpretation left to the subsystem, through its protected procedures

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 20 Language-Based Protection Specification of protection in programming language: Allows high-level description of policies for allocation and use of resources Example: Java Language implementation: Can provide software for protection enforcement when automatic hardware-supported checking is unavailable Interpret protection specifications to generate calls on whatever protection system is provided by the hardware and the operating system

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 21 Security The Security Problem Authentication Program Threats System Threats Threat Monitoring Encryption

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 22 The Security Problem Security must consider external environment of the system, and protect it from: unauthorized access malicious modification or destruction accidental introduction of inconsistency Easier to protect against accidental than malicious misuse

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 23 Authentication User identity most often established through passwords, can be considered a special case of either keys or capabilities. Passwords must be kept secret. Frequent change of passwords Use of “non-guessable” passwords Log all invalid access attempts

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 24 Program Threats (“Malware”) Trojan Horse Code segment that misuses its environment Exploits mechanisms for allowing programs written by users to be executed by other users Trap Door Specific user identifier or password that circumvents normal security procedures. Could be included in compiler

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 25 System Threats: Worms Worms – use spawn mechanism; standalone program Exploited UNIX networking features (remote access) and bugs in finger and sendmail programs Grappling hook program uploaded main worm program

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 26 System Threats: Viruses Viruses – fragment of code embedded in a legitimate program Mainly affect PCs, infected via Internet “Old days”: exchanging floppy disks containing an infection

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 27 The Morris Internet Worm (1988)

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 28 Threat Monitoring Check for suspicious patterns of activity i.e., several incorrect password attempts may signal password guessing Audit log Records time, user, & type of all accesses to object Useful for recovery from violation, developing better security measures Scan system periodically for security holes Done when the computer is relatively unused

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 29 Threat Monitoring (Cont.) Check for: Short or easy-to-guess passwords Unauthorized setuid programs Unauthorized programs in system directories Unexpected long-running processes Improper directory protections Improper protections on system data files Dangerous entries in the program search path (Trojan horse) Changes to system programs: monitor checksum values

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 30 Network Security Through Domain Separation Via Firewall

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 31 Encryption Encrypt clear text into cipher text, and vice versa Properties of good encryption technique: Relatively simple for authorized users to encrypt and decrypt data Encryption scheme depends not on secrecy of algorithm but on parameter of algorithm called encryption key Extremely difficult for an intruder to determine the encryption key Advanced Encryption Standard now standard (Rijndael)

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 32 Encryption (Cont.) Public-key encryption based on each user having two keys: public key – published key used to encrypt data private key – key known only to individual user used to decrypt data Encryption scheme is public, but still strong No reliance on security through obscurity Basis of these: Easy to multiply primes, but hard to factor this product

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 33 Java Security Model

U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 34 Summary Protection Protection Domains, Access Matrix, Revocation of Access Rights, Capability-Based Systems, Language-Based Protection Security Authentication, Program Threats, System Threats, Threat Monitoring, Encryption