1. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science Emery Berger University of Massachusetts, Amherst Operating Systems CMPSCI 377 Lecture 22: Protection & Security Brian Levine

2. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 2 Protection vs. Security Policy = the set of allowable states of a system. Security = protecting the confidentiality, integrity, and availability of a system according to the rules set out by a specific policy. Protection = mechanisms used to control access to valued resources: e.g., programs & data stored on computer system. Usually accompanied by detection and response mechanisms! Book is poorly written in this regard “security is a measure of confidence that the integrity of a system and its data will be preserved. Security assurance is a much broader topic than is protection”. Assurance = degree of confidence that a particular system meets its security requirements based on specific evidence.

3. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 3 Protection Goals of Protection Protection Domains Access Matrix Implementation Revocation of Access Rights Capability-Based Systems Language-Based Protection

4. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 4 Goals of Security Some is secure if either The cost of attacking the system is more than the value of protected resources; You attack $100 of gold with a $120 attack dog. Cost can equal the computer or network resources required to attack the system Or, The time it takes to attack the system is a duration of time longer than the resource remain valuable. You don’t need to protect the time and place of a secret event after the event takes place. Time can be the processing time to compute the correct result (e.g., guessing a password)

5. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 5 Protection Goal Let’s say we have a valuable resource like an O.S. collection of objects, hardware & software Objects have unique names Accessed through well-defined set of operations Goal of protection: Ensure each object accessed correctly & only by authorized processes according to some policy. A policy is a statement of what states (and operations) are allowed (i.e., secure/authorized), and what are not allowed (i.e., nonsecure/unauthorized) for a specific system.

6. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 6 Protection Domains Access-right = Rights-set = subset of all valid operations that can be performed on the object (i.e., the policy!) Domain = set of access-rights

7. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 7 Domain Implementation Example 1: UNIX Domain is implemented as the “user-id” Files are an example of an object (we’ll see others, like laser printers and email servers) Sometimes, the OS will do domain switching to execute some task accomplished via file system Each file has associated domain bit (setuid bit) When file executed and setuid=on, user-id set to owner of the file being executed When execution completes, user-id is reset “ps” is a setuid program, as is “lpr”.

8. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 8 Domain Implementation (II) Example 2: MULTICS Precursor to UNIX, by MIT & GE “Ring” protection system by Bob Graham

9. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 9 Multics: Rings Nested domain structure (“rings”) Let D i and D j be any two domain rings If j < I  D i  D j lower-level = more privileges each process maintains current ring number

10. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 10 Access Matrix Column = access-control list for one object, F i Defines who can perform what operation on the object Row = capability list Operations allowed on what objects, per-domain

11. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 11 Use of Access Matrix (Contd.) Mechanism: something that enforces policy. Design separates mechanism from policy Mechanism Operating system provides access-matrix + rules. Ensures that the matrix is manipulated only by authorized agents and that rules are strictly enforced Policy User dictates policy: who can access what object and in what mode

12. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 12 Dynamic Access Matrices Extend for dynamic protection: Operations to add, delete access rights transfer – switch from domain D i to D j owner of O i copy op from O i to O j control – D i can modify D j ’s access rights

13. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 13 Switching Domains Switching domains: add domains as objects!

14. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 14 Access Matrix with Copy Rights Asterisk denotes that access right can be copied within column

15. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 15 Access Matrix With Owner Rights Ownership: can add new rights, remove some rights

16. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 16 Control: Modifying Access Matrix Control: process executing in one domain can modify another domain Example: D2 changes D4

17. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 17 Implementation of Access Matrix Global table – Too large, no grouping Access list – per object Simple Capability List – list of objects + operations Object name = capability (think: special pointer) Check in capability list for access

18. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 18 Revocation of Access Rights Access-list scheme: Search for right to be revoked, delete Immediate, can be selective (just affect some users), can be partial (just some rights revoked)

19. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 19 Revocation of Access Rights Capabilities: more complicated Reacquisition: Try to reacquire after deletion Back-pointers: point from object to capabilities Expensive (used in MULTICS) Indirection: Capability points to entry in table Not selective Keys: One key per capability Check in global key table

20. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 20 Capability-Based Systems Hydra Fixed set of access rights known to and interpreted by the system Interpretation of user-defined rights performed solely by user's program System provides access protection for use of these rights Cambridge CAP System Data capability - provides standard read, write, execute of individual storage segments associated with objects Software capability – interpretation left to the subsystem, through its protected procedures

21. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 21 Language-Based Protection Specification of protection in programming language: Allows high-level description of policies for allocation and use of resources Example: Java Language implementation: Can provide software for protection enforcement when automatic hardware-supported checking is unavailable Interpret protection specifications to generate calls on whatever protection system is provided by the hardware and the operating system

22. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 22 Security The Security Problem Authentication Program Threats System Threats Threat Monitoring Encryption

23. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 23 Security Security must address the external environment of the system and protect it from: Confidentiality: ensuring objects are available only to authorized peers E.g., no unauthorized read access Integrity: ensuring objects have not been maliciously or accidentally modified. No introduction of inconsistency. Availability: ensuring objects are available without delay and operate correctly (to authorized peers) No malicious destruction of resources (i.e., objects) Easier to protect against accidental than malicious misuse.

24. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 24 Authentication Authentication of the corroboration of an identity (i,e., of a domain). User identity is most often established through passwords. can be considered a special case of either keys or capabilities. Passwords must be kept secret. Good practices: Frequent change of passwords Use of “non-guessable” passwords Log all invalid access attempts

25. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 25 Encryption Cryptography is a set of mathematical functions with a set of nice properties. A common mechanism for enforcing policies. Crypto will encrypt clear text into cipher text, and vice versa Properties of good encryption technique: Encryption scheme depends not on secrecy of algorithm but on parameter of algorithm called encryption key Extremely difficult for an intruder to determine the encryption key If we keep the algorithm secret, we have to change it each time someone leaves our group.

26. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 26 Encryption (Cont.) Advanced Encryption Standard (AES) now government standard (replaced DES algorithm). Symmetric key algorithm: one shared shared by a pair of users used for both encryption and decryption. Asymmetric or public/private-key algorithms are based on each user having two keys: public key – published key used to decrypt data enciphered by the private key. private key – key known only to individual user, used to decrypt data enciphered by the public key. If I send you some data that is decryptable only with my public key, then you believe that I must have sent it Authentication and integrity! Basis of these algorithms: Easy to multiply primes, but hard to factor this product About 1000 times slower processing than symmetric key algs.

27. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 27 Program Threats (“Malware”) Trojan Horse Code segment that misuses its environment. One program that covertly runs another malicious program Trap/Back Door Specific user identifier or password that circumvents normal security procedures. (e.g., “joshua” in War Games 1982 if you are old like me.) Could be included in compiler http://www.acm.org/classics/sep95/ http://www.acm.org/classics/sep95/ Ken Thompson’s Turing Award lecture

28. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 28 More malware: Worms Worms – use spawn mechanism; standalone program that is self-perpetuating. The lay press often calls them “viruses”. Exploited UNIX networking features (remote access) and bugs in fingerd and sendmail programs Nowadays, often propagate through design flaws in mail readers Mailer opens mail, executes javascript, forwards the mail to all entries of the address book

29. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 29 System Threats: Viruses Viruses – fragment of code embedded in a legitimate program Mainly affect PCs, infected via Internet “Old days”: exchanging floppy disks containing an infection. In general, they require action by the user to perpetuate themselves (downloading a web file). In contrast: Worms propogate themselves: once they reach their target, they attempt to reach other targets.

30. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 30 The Morris Internet Worm (1988)

31. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 31 Threat Monitoring Check for suspicious patterns of activity i.e., several incorrect password attempts may signal password guessing Audit log Records time, user, & type of all accesses to object Useful for recovery from violation, developing better security measures Scan system periodically for security holes Done when the computer is relatively unused

32. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 32 Threat Monitoring (Cont.) Check for: Short or easy-to-guess passwords Unauthorized setuid programs Unauthorized programs in system directories Unexpected long-running processes Improper directory protections Improper protections on system data files Dangerous entries in the program search path (Trojan horse) Changes to system programs: monitor checksum values

33. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 33 Network Security Through Domain Separation Via Firewall

34. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 34 What’s wrong with this picture? IDS=intrusion detection system

35. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 35 Java Security Model

36. U NIVERSITY OF M ASSACHUSETTS, A MHERST Department of Computer Science 36 Summary Protection Protection Domains, Access Matrix, Revocation of Access Rights, Capability-Based Systems, Language-Based Protection Security Authentication, Program Threats, System Threats, Threat Monitoring, Encryption