Reference Monitors

Page 1

Security kernel- implementation of a reference monitor

Trusted computing base- kernel + other protection measures

Reference monitor- "an access control concept that refers to an abstract machine that mediates all access to objects by subjects"

Must be tamper proof/ resistant

Must always be invoked when access to an object is required

Must be small enough to be verifiable/ subject to analysis to ensure correctness

Security kernel- hardware/firmware/software elements of a TCB that implement the reference monitor

Mediates all access

Must be protected from modification

Must be verifiably correct

Usually held within bottom layers of a system

Trusted computing base

One or more components

Enforce unified policy over a product or system

Correct enforcement depends on components as well as input from admins

Placement

Can be placed anywhere in system

Hardware- dedicated registers for defining privileges

OS Kernel- e.g. VM hypervisor

Services layer- e.g. JVM/ .net

Application layer- firewalls

Lower is better- higher degree of security, simple structures to implement, reduced performance overheads, fewer layer below attack possibilities

However when low level access control decisions are far removed from applications

OS integrity

OS arbitrates access requests

Is itself a resource that must be accessed

This is a conflict- don't want users messing with the OS

Modes of operation- defines which actions are permitted in which module, e.g. system calls, I/O

Controlled invocation- allows us to execute privileged instructions safely, before returning to user code

Modes of operation

Distinguish between computations done on behalf of either the OS or user

Rings from kernel at centre, device drivers, applications

Status flag within CPU allows OS to operate in different modes

Controlled invocation

Mechanism to transfer between kernel mode and user mode

To do things such as memory allocation and halting the CPU

Interrupts- equivalent to software exception

Handled by interrupt handler which resolves issue and returns to orignal code

CPU will switch execution to location given in an interrupt descriptor table

Descriptors and Selectors

Descriptors hold info on objects like kernel structure locations

Held in descriptor tables

Indexed by selectors

CPU protects kernel by checking the current privilege level when a selector is loaded

Interrupt gates

Code segment register has 2 bits reserved for the current privilege level (CPL)

Descriptors that have a privilege level higher than where they point are called gates

Since these descriptors are created by the kernel they offer a secure means of entry into the centre (ring 0)

If you can run custom privilege level 0 code e.g. a comprimised driver- you can insert your own handler- a rootkit

Processes and threads

Process is important unit of control

Exists in its own address space

Communicates with other processes via the OS

Seperation for security

Thread- strand of execution within a process, common address space

Memory protection

Segmentation- divides data into logical units

Good for security

Challenging memory management

Not used much in modern OSs

Paging- divides memory into pages of equal size

Efficient memory management

Less good for access control

Extremely common in modern OSs

Memory address translation- all programs see system memory as a (virtual) continuous block of addresses, these are translated to physical addresses

Page tables- map linear address space to physical address space, processes separated by the page system

Paging

Page tables have valid/ invalid bit

Valid pages have page numbers allocated to currently executing process

Invalid pages are either non existent or are in the page table but belong to other processes

Memory access to invalid page results in segmentation/ page fault or bus error

Shared pages- pages that are valid but read only can be shared by multiple processes- e.g. kernel libraries

NX bit- newer intel processors add NX bit into page table to allow execute permissions, preventing execution of non program data