Chapter 10 Secure Capability Systems

1. Chapter 10Secure Capability Systems

2. Chapter Overview • Capability System Fundamentals • Capability Security • Challenges in Secure Capability Systems • Capabilities and The *-Property • Capabilities and Confinement • Capabilities and Policy Changes • Building Secure Capability Systems • Enforcing the *-Property • Enforcing Confinement • Revoking Capabilities

3. CapabilitySystemFundamentals • A capability is a reference to an object and a set of operations that the capability entitles the holder, first formalized by Dennis and van Horn. • An important difference between capability and access control list systems is the process’s ability to name objects. • ACL : check any objects and subjects in list • Capability : only name objects for which they have a capability • A fundamental requirement of a capability system is that processes not be able to modify or forge capabilities.

4. CapabilitySecurity Enabling permissions to be more easily transferred from one process to another • Advantages (1) least privilege, and (2) protected subsystems • First, capability systems can assign a distinct set of capabilities to each process, so it is possible to do based on tis specific purpose. • Second, capability systems enable processes to copy their capabilities for other processes(like a house key), so a protected subsystem may perform operations on behalf of clients without the need to be assigned the permissions of all clients. • It solves confused deputy problem that provides unauthorized access

5. Challenges in Secure Capability Systems • First, we describe how capability systems satisfy the secure operating system requirements of mediation and tamperproofing. • Second, Tamperproofing requires that the truted computing base, including the reference monitor and protection state itself, cannot be modified by untrusted processes like an ordinary system. • The flexibility that processes have to distribute capabilities in capability systems conflicts with the desire to prove that particular security goals are truly enforced, so ensuring that security goals are verifiable is problematic in capability systems. • Care must be taken to ensure that the *-property • Capability systems require addition mechanism to ensure that each protections state is safe, enforcing the system security goals • Changes in security requirements require that capability systems revoke all newly unauthorized capabilities.

6. Challenges in Secure Capability Systems • Capabilities and The *-Property Capability doesn’t care about information flow. Some process A can have capability in high secrecy READ and low secrecy WRITE at the same time. • Capabilities and Confinement The violations of the *-property implies that capability systems fail to enforce process confinements, that is there can be unauthorized communication channel. • Capabilities and Policy Changes Revocation problem; capabilities are difficult to revoke. → This analogy means that we should decide to change the security goals that we want to enforce in a capability system.

7. Building Secure Capability Systems

8. Building Secure Capability Systems Process 3 Redell’s revoker capability approach: When the revoker capability is revoked all the capabilities that were based on it are also revoked Object Cap Revoker Cap by Process 1 Revoker Cap by Process 2 Cap Cap Process 1 Process 2

9. Summary • Capability systems have conceptual advantages in enforcing security because they can be used to define protection domains specific to a particular execution of a program easily and they enable permissions to be distributed with preventing the confused deputy problem • However, capability systems also have some inherent security problems brought about by the discretionary nature of capability management.