1. Chapter 17: Confinement Problem
Dr. Wayne Summers
Department of Computer Science
Columbus State University

2. The Confinement Problem
Confinement problem preventing a server from leaking information that the user of the service considers confidential
Server must ensure that resources accessed on behalf of the client only include resources that client is authorized to access
Server must ensure that it does not reveal client’s data to any other unauthorized entity
Covert channel – path of communications not designed for communication
Rule of transitive confinement – if confined process invokes a second process, the second process must be as confined as the caller

3. Isolation
Virtual machine – program that simulates the hardware of a computer system
Sandbox – environment in which the actions of the process are restricted according to a security policy

4. Covert Channels
Covert storage channel uses an attribute of the shared resource
Covert timing channel uses a temporal or ordering relationship among accesses to a shared resource
Noiseless covert channel – covert channel that uses a resource available to only the sender and receiver
Noisy covert channel – covert channel that uses a resource available to subjects in addition to the sender and receiver

5. Covert channels Requirements of covert storage channel
Sending and receiving processes have access to the same attribute of a shared object
Sending process is able to modify the attribute of the shared object
Receiving process is able to references the attribute of the shared object
Mechanism must exist for initiating both processes, and properly sequencing the respective accesses to the shared resource

6. Covert channels Requirements of covert timing channel
Sending and receiving processes have access to the same attribute of a shared object
Sending and receiving processes must have access to a time reference (e.g. clock, timer,…)
Sending process must be able to control the timing of the detection of a change in the attribute by the receiving process
Mechanism must exist for initiating both processes, and properly sequencing the respective accesses to the shared resource