Protection

1. Protection Fred Kuhns fredk@cse.wustl.edu Applied Research Laboratory, Department of Computer Science and Engineering, Washington University in St. Louis

2. Protection and Security • “Protect each secure entity from all unauthorized access”[1]. This is implemented in two parts: • Authentication: verify identity • Authorization: resource access rights • Additional concern when information is transferred over a network where unauthorized entities may have access. • Cryptography is used to protect sensitive information • Types of attack to gain access to computer system: • masquerading; guessing login and password; snooping for login and password (eavesdropping); alternate entrances. • Once on a system: • confinement and allocating rights; trojan horse; denial-of-service Nutt, Gary, Operating Systems, 3rd edition, Addison Wesley, 2004 CSE522– Advanced Operating Systems

3. Protection • Goal: provide mechanisms to ensure only authorized access to system resource are permitted, i.e. consistent with stated policies – Policy enforcement. • Improves system reliability by detecting and containing program errors (user of system) • Policies: • hard coded in system design • defined by user such as setting file permissions • dynamically set by system managers • defined by application developers • “Principle of least privilege” is a time tested principle used when designing systems. • Implies fine grained protection and an ability to modify access rights over time. • Use audit trails to log privileged operations • “Need to Know Principle” • Two different Resource access types: • instruction-level access • System-level access: high-level abstract entities (objects). CSE522– Advanced Operating Systems

4. Domains • Computer System is a collection of passive and active entities. • Passive entities: correspond to resources and other secure entities. Known as objects or protection objects. • identified by a unique name • represent hardware and software entities • accessed through a well defined interface • instances of abstract data types • Active entities: processes and threads acting on the behalf of users. • Access right: object, operation(s) ordered pair <object,ops>, for example <fileX,{read,write}> • Processes access objects according to its access rights: • Process only permitted to access objects for which it has an immediate need (need-to-know principle) • A process can also be considered an object and thus have access rights associated with it (just as any other object would have) • all objects in a system include both passive and active objects • A particular set of access rights held by a process at any point in time is known as its “Protection Domain” • subject := a process executing in a specific protection domain. • specify objects that may be accessed (authorized objects) • specify operations that may be performed on the authorized objects CSE522– Advanced Operating Systems

5. Protection Domains • Protection domain is a set of access rights • Domains may overlap • May want to permit a domain’s set of access rights to change dynamically • Process-Domain associations may be static or dynamic • if dynamic then must support domain switching • Defining domains: • per user domain; per process domain; per procedure domain Domain1 Domain2 <obj1,{write}> <obj1,{read,write}> <obj4,{read,write}> <obj2,{read,write}> Domain3 <obj1,{read}> <obj2,{execute}> <obj3,{read,write}> CSE522– Advanced Operating Systems

6. The Model • Protection system: composed of a set of objects and set of subjects, and a set of rules specifying the protection policy. • Protection state: defines the accessibility of objects by subjects • System guarantees protection state is checked for each access of an object O by a subject S. • Internal protection state can be changed only according to a set of rules that implement the external security policy. CSE522– Advanced Operating Systems

7. Using the access matrix • Protection state may be represented by an access matrix A. • It has one row for every subject and one column for each object • each access to A[S,O] is a set of access rights. Subject S requests operation x on object O. • The protection system authenticates S and generates the 3-tuple <S,x,O>. • Monitor for object O checks entry A[S,O]. if x A[S,O]then access is permitted otherwise it is denied. CSE522– Advanced Operating Systems

8. Access Matrix Domain1 Domain2 <obj1,{write}> <obj1,{read,write}> <obj4,{read,write}> <obj2,{read,write}> Domain3 <obj1,{read}> <obj2,{execute}> <obj3,{read,write}> CSE522– Advanced Operating Systems

9. Domain Switching • can switch from domain Si to Sj if and only if switch  access(i,j) CSE522– Advanced Operating Systems

10. Example Policy Rules to govern state changes • Copy right, denoted by an ‘*’, three variations: • Copy: copy right R* from access(i,j) to access(k,j). • Transfer: a right is copied from access(i,j) to access(k,j) then removed from access(i,j) • Limited copy: only the right R (not R*) is copied from access(i,j) to access(k,j). • Owner right: If access(i,j) includes the owner right then a process executing in domain Si may add or remove any right in any entry in column j. • Control right (applies only to domain objects): if access(i,j) includes a control right then a process executing in Si can modify row j. CSE522– Advanced Operating Systems

11. Access and Capability Lists • an access list is a large sparse matrix so implementations keep track of only the non-empty entries. • All nonempty entries in a column form a list associated with the corresponding object. This is the access list of the object. • for each object there is a list of <domain, rights> • All nonempty entries for a row with the corresponding domain, the is a capabilities list. • for each domain there is a list of <object, rights> • An object may be represented by its name or address, called a capability. A process can execute operation M on object Oj simply by passing the capability as a parameter. • capability is associated with domain and is not directly accessible by a process. • Can protect capabilities using HW tags, store in OS kernel or keep in user space but use cryptography to protect them. CSE522– Advanced Operating Systems