Security

Security

1. Catergories

   • Data integrity
     • Back up
     • Process shouldn't overwrite memory of another process
   • Protection against user errors
     • Separating users and processes
   • Protection against malicious users
     • Explotiing waknesses
     • Trade off between use of user and level of protection
     • E.G. Buffer overflows in the kernel

2. Problem identifying users

   • Common scheme to use passwords
     • Easy to use
     • Guessable, exposure problems, storage

3. Protection Mechanisms

   • Access to shared resources must be controlled
   • Two aims
     • Protection against user's mistakes
     • Increase in reliability
   • Principles
     • Separate policy (what) from mechanism (how)
     • Users should only get enough privilege as necessary to get a job done
   • Standard method
     • Each user has separate domain of protection
       • Each user is uid associated
       • Need trusted way of making system privileges available(changing pssswd)
       • Disadvantage: target for breakins

4. Access Matrix

   • Abstract view of protections
   • Row for each domain and column for object (files, printers, sockets)
   • Entry indicates accès rights
     • D1 can access F1, no access to F2
   • Unsuitable for implementation because matrix too large

5. Implementation Issues

   • Access List for objects (column)
     • Contains rights for certain users
       • No entry = no rights for a user for that particular object
       • Default: everyone has read/execute permissions
   • Capability lists for domains (rows)
     • Contains rights for each domain (for each user)
     • Capabilities allow for greater flexibility
       • Auxiliary rights
         • Process can pass process to others'
       • Rights amplifications (changing passwords)
         • Cannot be passed on - secure mechanism for temp privileges

6. Unix access rights

   • Coarser than access lists
     • For each file, have three categories of possible users
       • Owner, group and all others
       • Owner can grant permissions using bits

7. OS bound to have errors

   • Security holes give full control to attacker
   • OS not suitable as part of "trusted computing basis"
     • Code which is assumed to be secure to guarantee security
     • Research into removing OS from TCB
       • Need to introduced additional HW for security
         • Parts of HW untouched (TPM/ TZ)

8. Trusted platform model

   • Provides cryptographic operations
     • Physical chip that hasn't been tampered with
   • Secure storage
     • If device taken apart, information not easily extracted
       • Has public-private key pairs - master needed to gain access
         • Limits tries to access - avoid brute force

9. Trust Zone

   • Present in mobile phones/tablets
   • Have normal process and secure processor with it's own HW
     • Almost duplicate processor layout
       • Secure world and secure world