Towards Formal Evaluation of a High-Assurance Guard
|
|
|
- Arabella Jackson
- 6 years ago
- Views:
Transcription
1 Towards Formal Evaluation of a High-Assurance Guard Mark R. Heckman <mark.heckman@aesec.com> Roger R. Schell <roger.schell@aesec.com> Edwards E. Reed <ed.reed@aesec.com> 2012 Layered Assurance Workshop, Dec 3 4, Orlando, Florida 0
2 Transfer Guards Type of Cross Domain Solution Permits the movement of data between domains Blocks the data that shouldn t be released Key word scans, to block release of high data to low Creation of sanitized data out of sensitive data Antivirus scan for transfers from low integrity to high High Domain Downgrade Low Domain 1
3 Current Transfer Guards Built on low-assurance base operating system E.g., EAL 4+ (SELinux, Trusted Solaris) Can t limit range of trust Need separate system for each guard/domain Redundant systems: Guard server farms Susceptible to software supply-chain subversion Trusted distribution? System integrity? Secure recovery? Lack sound system composition method Require repetitive, total system recertification Due to changes to policy, HW/SW, configuration 2
4 High-assurance Transfer Guard Guard as application built on TCSEC Class A1 TCB A1 TCB base solves problems of Susceptibility to supply-chain subversion Resource redundancy due to range of trust Need sound composition method Permits divide and conquer formal evaluation Permits incremental (re)evaluation 3
5 Abstract Transfer Guard High Producer 1 Low Consumer 1 Downgrader 1 Guard 1 Guard 2 TCB Downgrader 2 High Producer 2 Low Consumer 2 Components: High producer of information Downgrader Low consumer of information TCB permits multiple downgrade ranges 4
6 Abstract Downgrader Possibly multiple, distinct policies Pipeline or other arrangement Downgrader Stage 1 Downgrader Stage 2 Downgrader Stage n TCB 5
7 Aesec Virtual Guard (AVG) Implementation of Abstract Transfer Guard Designed for high-assurance base GEMSOS Gemini MLS Operating System implements Bell-LaPadula access control Biba mandatory integrity Evaluated at TCSEC Class A1 AVG takes advantage of GEMSOS mechanisms Process isolation Multi-level subjects with restricted range Assured pipelines using GEMSOS MAC labels 6
8 AVG Architecture High Process Family Read : H:ic1 Write : H:ic1 High Assured Pipeline Read : H:ic1 Write : H:ic1,ic2 Release Process Read : H:ic1,ic2 Write : L:ic1,ic2 Low Assured Pipeline Read : L:ic1,ic2 Write : L:ic1,ic2,ic3 Low Process Family Read : L:ic1,ic2,ic3 Write :L:ic1,ic2,ic3 High Message Queue Label: H:ic1 Input Queue Manager High Message Buffer, Label: H:ic1,ic2 Low Message Buffer, Label: L:ic1,ic2 Output Queue Manager Low Message Queue Label: L:ic1,ic2,ic3 Input Message Handler NFS Daemon Trusted Guard Downgrade Function Output Message Handler NFS Daemon Label: H:ic1 GEMSOS Label: L: ic1,ic2,ic3 Network Clients Network Clients Legend: Labels use Secrecy Levels (H, L) and Integrity Categories (ic1, ic2, ic3) Network Clients Process Family Read Label Write Label Process Name Storage Object Name, Label
9 Assured Pipelines Sequences communication between processes Like a train, can t bypass a station Controls flow of data to/from downgrader Orders downgrader stages Implemented in AVG using Integrity categories 8
10 Assured Pipelines in AVG Biba Integrity: The Simple Integrity Axiom: no read from a lower integrity level (no read down) The * (star) Integrity Axiom: no write to a higher level of integrity (no write up) High Process Family Read : H:ic1 Write : H:ic1 High Assured Pipeline Read : H:ic1 Write : H:ic1,ic2 Release Process Read : H:ic1,ic2 Write : L:ic1,ic2 Low Assured Pipeline Read : L:ic1,ic2 Write : L:ic1,ic2,ic3 Low Process Family Read : L:ic1,ic2,ic3 Write :L:ic1,ic2,ic3 High Message Queue Label: H:ic1 Input Queue Manager Input Message Handler NFS Daemon ic1 < ic1,ic2 High Message Buffer, Label: H:ic1,ic2 Low Message Buffer, Label: L:ic1,ic2 Output Queue Manager ic1,ic2 < ic1,ic2,ic3 Low Message Queue Label: L:ic1,ic2,ic3 Output Message Handler NFS Daemon 9
11 Adding Downgrader Stages Use additional integrity categories One additional category per stage Sequence of non-bypassable stages Modular, but confined, security policies Stage 0 Pipeline 1 Pipeline N Stage N Read : ic1 Write : ic1 Read : ic1 Write : ic1,ic2 Read : ic1,,icn Write : ic1,,icn+1 Read : ic1,,icn+1 Write : ic1,,icn+1 10
12 Guard Identifiers Start with basic process separation Add unique integrity category for each guard Guard identifier ic1 is guard identifier in figure Assigned to every process and storage object High Message Queue Label: H:ic1 Input Queue Manager Read : H:ic1 Write : H:ic1,ic2 High Message Buffer, Label: H:ic1,ic2 Low Message Buffer, Label: L:ic1,ic2 Output Queue Manager Read : L:ic1,ic2 Write : L:ic1,ic2,ic3 Low Message Queue Label: L:ic1,ic2,ic3 11
13 Multiple Virtual Guards Each guard has unique guard identifier Biba Integrity policy protects guard Different integrity categories are non-comparable No flow between guards on same server Can have different secrecy levels and ranges Guard A Guard B Guard C GEMSOS 12
14 Performance Prototype runs on single 550 MHz IA32 CPU Did not use GEMSOS multiprocessing feature Single dirty word search downgrader Processing measured within server, independent of transfers 2500 msgs/sec 4KB message size Primarily CPU bound 13
15 Abstract Transfer Guard Proofs High Producer 1 Low Consumer 1 Downgrader 1 Guard 1 Guard 2 TCB Downgrader 2 High Producer 2 Low Consumer 2 Can Producer/downgrader/consumer be composed into a guard? Guards isolated? Downgrader evaluable separately from TCB? 14
16 Abstract Downgrader Proofs Does each stage correctly enforce its policy? Stages composable? Ordering and isolation properties Downgrader Stage 1 Downgrader Stage 2 Downgrader Stage n TCB 15
17 Composition Problem Interconnected components Each has known security properties What are security properties of system? Want to use arguments about components to make arguments for entire system Without having to reanalyze 16
18 Unconstrained vs. Constrained Constrained composition: Specific properties Specific interconnections Practical solutions exist E.g., TCB Partitions and TCB Subsets Unconstrained composition: Arbitrary properties Arbitrary interconnections No general solution known (or possible?) 17
19 Classifying Proof Obligations Infrastructure Guards isolated? Constrained composition Ordering and isolation properties of downgrader stages Can Producer/downgrader/consumer be composed into a guard? Downgrader evaluable separately from TCB? Non-infrastructure Unconstrained composition Does each stage correctly enforce downgrade policy? Can stages be composed into the downgrader? 18
20 Guard Isolation/Stage Ordering GEMSOS-enforced process isolation GEMSOS mandatory integrity used for Guard isolation: Guard identifier integrity categories Downgrader stage isolation and ordering Assured pipelines Implemented using integrity categories 19
21 Producer/Downgrader/Consumer Trusted Network Interpretation of TCSEC Virtual machine is example of network component Downgraders are virtual machines Due to guard identifiers Downgrader on TCB is NTCB partition Producer and consumer are also NTCB partitions Use TCB Partitions technique (TNI) to compose 20
22 Downgrader Separate from TCB Two policy-enforcing entities TCB policy Includes notion of multilevel subject Limits range of multilevel subject Isolates trusted subject Downgrader policy Defines what trusted subjects do within range 21
23 System Policy Specification Sketch Mandatory access control (MAC) Downgrader isolated by guard identifier (GI) Downgrader protected domain policy D High TCB High + GI Downgrader No read up; no write down (MAC) Write down (D) Low Low + GI 22
24 TCB Subsets (from TDI) Less-primitive subset (Downgrader) More primitive subset (TCB) Strict MAC policy Permits trusted subjects in less-primitive subset domain Tamperproof and mandatory system config. Guard identifier creates isolated protection domain Downgrader range Security properties of TCB unaffected by changes to the downgrader policy Hence, can use TCB Subsets technique 23
25 Balanced Assurance Less-primitive TCB subsets Constrained by underlying, general-purpose TCB Have correspondingly lower risk Do not require all Class A1 assurance techniques Downgrader is such a less-primitive TCB subset But, downgrader is trusted Does it have lower risk? Yes, because does only one thing downgrading TCB-enforced isolation prevents anything else 24
26 Downgrader Arguments Program verification needed But what is policy model? Multiple policies è Unconstrained composition AVG provides necessary support Verified programs requires code integrity A1 TCB specifically addresses subversion Composition of stages requires assured ordering Assured pipelines and guard identifier 25
27 Conclusions Can evaluate downgrader separately from TCB Permits divide and conquer formal evaluation Permits incremental (re)evaluation Supports multiple downgraders on same system Due to high-assurance base Separates constrained from unconstrained composition Increase confidence in overall evaluation correctness 26
28 Questions? Towards Formal Evaluation of a High-Assurance Guard Mark R. Heckman <mark.heckman@aesec.com> Roger R. Schell <roger.schell@aesec.com> Edwards E. Reed <ed.reed@aesec.com> 2012 Layered Assurance Workshop, Dec 3 4, Orlando, Florida 27
COMPOSING A HIGH-ASSURANCE INFRASTRUCTURE OUT OF TCB COMPONENTS
COMPOSING A HIGH-ASSURANCE INFRASTRUCTURE OUT OF TCB COMPONENTS Mark R. Heckman AESEC Global Services, Inc. mark.heckman@aesec.com Roger R. Schell AESEC Global Services, Inc. roger.schell@aesec.com Edwards
DESIGNING THE GEMSOS SECURITY KERNEL FOR SECURITY AND PERFORMANCE * Dr. Roger R. Schell Dr. Tien F. Tao Mark Heckman
DESIGNING THE GEMSOS SECURITY KERNEL FOR SECURITY AND PERFORMANCE * Dr. Roger R. Schell Dr. Tien F. Tao Mark Heckman Gemini Computers, Incorporated P. O. Box 222417 Carmel, California 93922 INTRODUCTION
MILS Multiple Independent Levels of Security. Carol Taylor & Jim Alves-Foss University of Idaho Moscow, Idaho
MILS Multiple Independent Levels of Security Carol Taylor & Jim Alves-Foss University of Idaho Moscow, Idaho United states December 8, 2005 Taylor, ACSAC Presentation 2 Outline Introduction and Motivation
Advanced Systems Security: Multics
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Advanced Systems Security: Integrity
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Chapter 6: Integrity Policies
Chapter 6: Integrity Policies Overview Requirements Biba s models Clark-Wilson model Slide #6-1 Overview Requirements Very different than confidentiality policies Biba s model Clark-Wilson model Slide
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
System design issues
System design issues Systems often have many goals: - Performance, reliability, availability, consistency, scalability, security, versatility, modularity/simplicity Designers face trade-offs: - Availability
Topics in Systems and Program Security
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Topics in Systems and
Discretionary Vs. Mandatory
Discretionary Vs. Mandatory Discretionary access controls (DAC) Privilege propagated from one subject to another Possession of an access right is sufficient to access the object Mandatory access controls
Toward Automated Information-Flow Integrity Verification for Security-Critical Applications
CSE 598A - Spring 2007 - Sandra Rueda Page 1 Toward Automated Information-Flow Integrity Verification for Security-Critical Applications Umesh Shankar, Trent Jaeger and Reiner Sailer Presented by Sandra
CSE Computer Security
CSE 543 - Computer Security Lecture 25 - Virtual machine security December 6, 2007 URL: http://www.cse.psu.edu/~tjaeger/cse543-f07/ 1 Implementation and Results Experimental Platform Exact specification
Advanced Systems Security: Principles
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Security Kernels C H A P T E R 6
C H A P T E R 6 Security Kernels 75 While the Multics project was winding down in the mid-1970s, a number of vendors and researchers gained confidence that a secure operating system could be constructed
Chapter 18: Evaluating Systems
Chapter 18: Evaluating Systems Goals Trusted Computer System Evaluation Criteria FIPS 140 Common Criteria SSE-CMM Slide #18-1 Overview Goals Why evaluate? Evaluation criteria TCSEC (aka Orange Book) FIPS
Advanced Systems Security: Integrity
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Integrity Policies. Murat Kantarcioglu
UT DALLAS Erik Jonsson School of Engineering & Computer Science Integrity Policies Murat Kantarcioglu Requirements of Policies for Commercial Applications [Lipner 1982] 1. Users will not write their own
Multilevel relations: Schema and multiple instances based on each access class. A multilevel relation consists of two parts:
The Jajodia & Sandhu model Jajodia & Sandhu (1991), a model for the application of mandatory policies in relational database systems. Based on the sec classifications introduced in BLP. It extends the
Last time. Security Policies and Models. Trusted Operating System Design. Bell La-Padula and Biba Security Models Information Flow Control
Last time Security Policies and Models Bell La-Padula and Biba Security Models Information Flow Control Trusted Operating System Design Design Elements Security Features 10-1 This time Trusted Operating
Advanced Systems Security: Principles
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Use of Formal Methods in Assessment of IA Properties
Use of Formal Methods in Assessment of IA Properties George W. Dinolt gwdinolt@nps.navy.mil 44 th Meeting of IFIP Working Group 10.4 Computer Science Department Naval Postgraduate School 833 Dyer Road
Trusted Computing Update
Trusted Computing Update Marshall D. Abrams, Ph.D. Michael V. Joyce The MITRE Corporation 7525 Colshire Drive McLean, VA 22102 703-883-6938 abrams@mitre.org This is the second paper of a series of three
Advanced Systems Security: Ordinary Operating Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Access Control. Discretionary Access Control
Access Control Discretionary Access Control 1 Outlines Access Control Discretionary Access Control (DAC) Mandatory Access Control (MAC) Role-Based Access Control (RBAC) 2 Access Control Access control
Topics in Systems and Program Security
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Topics in Systems and
The Evolution of Secure Operating Systems
The Evolution of Secure Operating Systems Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University 1 Operating Systems
CCM Lecture 12. Security Model 1: Bell-LaPadula Model
CCM 4350 Lecture 12 Security Model 1: Bell-LaPadula Model Why Security Models? When we have implemented a security policy, do we know that it will (and can) be enforced? E.g., if policies get too intricate,
DAC vs. MAC. Most people familiar with discretionary access control (DAC)
p. 1/1 DAC vs. MAC Most people familiar with discretionary access control (DAC) - Example: Unix user-group-other permission bits - Might set a fileprivate so only groupfriends can read it Discretionary
TECHNICAL NOTE. Operating System Security Advantages of GEMSOS Security Kernel Over Other Kernels March 29, 2017
TECHNICAL NOTE Operating System Security Advantages of GEMSOS Security Kernel Over Other Kernels Introduction This note describes the advantages of the GEMSOS security kernel over other operating system
Advanced Systems Security: Integrity
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Access control models and policies. Tuomas Aura T Information security technology
Access control models and policies Tuomas Aura T-110.4206 Information security technology 1. Access control 2. Discretionary AC 3. Mandatory AC 4. Other AC models Outline 2 ACCESS CONTROL 3 Access control
Verifiable Security Goals
C H A P T E R 5 Verifiable Security Goals 57 In this chapter, we examine access control models that satisfy the mandatory protection system of Definition 2.4 in Chapter 2. A mandatory protection system
Security Architecture
Security Architecture We ve been looking at how particular applications are secured We need to secure not just a few particular applications, but many applications, running on separate machines We need
Dion Model. Objects and their classification
Dion Model (1981) Proposed as a mandatory policy which protects the secrecy and integrity together. Combines the principles of the BLP and Biba models (strict consistency policy) No discretionary policy
L17: Assurance. Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806
L17: Assurance Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806 11/06/2015 CSCI 451 - Fall 2015 1 Acknowledgement Many slides are from or are revised
May 1: Integrity Models
May 1: Integrity Models Biba Clark-Wilson Comparison Trust models May 1, 2017 ECS 235B Spring Quarter 2017 Slide #1 Integrity Overview Requirements Very different than confidentiality policies Biba s models
CSE509: (Intro to) Systems Security
CSE509: (Intro to) Systems Security Fall 2012 Radu Sion Integrity Policies Hybrid Policies 2005-12 parts by Matt Bishop, used with permission Integrity Policies: Overview Requirements Very different than
CSE Computer Security
CSE 543 - Computer Security Lecture 11 - Access Control October 10, 2006 URL: http://www.cse.psu.edu/~tjaeger/cse543-f06/ Access Control System Protection Domain What can be accessed by a process Default
Module: Operating System Security. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Operating System Security Professor Trent Jaeger 1 OS Security So, you have built an operating system that enables user-space processes to
Asset Analysis -I. 1. Fundamental business processes 2.Critical ICT resources for these processes 3.The impact for the organization if
Asset Analysis Asset Analysis -I It discovers the assets that result in an impact (a loss for the organization) if successfully attacked It should discover which ICT resources an organization needs to
A SECURITY MODEL FOR MILITARY MESSAGE SYSTEMS
A SECURITY MODEL FOR MILITARY MESSAGE SYSTEMS Carl E. Landwehr Constance L. Heitmeyer John McLean Computer Science and Systems Branch Information Technology Division Naval Research Laboratory Washington,
High-Assurance Security/Safety on HPEC Systems: an Oxymoron?
High-Assurance Security/Safety on HPEC Systems: an Oxymoron? Bill Beckwith Objective Interface Systems, Inc. Phone: 703-295-6519 Email Address: bill.beckwith@ois.com W. Mark Vanfleet National Security
Security System and COntrol 1
Security System and COntrol 1 Security Management By: Joseph Ronald Canedo It is a Risky World Vulnerabilities Security objectives: Prevent attacks Detect attacks Recover from attacks Attacks: against
Advanced Systems Security: Principles
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Lecture 11 Lecture 11 Nov 5, 2014
Formal Verification/Methods Lecture 11 Lecture 11 Nov 5, 2014 Formal Verification Formal verification relies on Descriptions of the properties or requirements Descriptions of systems to be analyzed, and
CCM Lecture 14. Security Models 2: Biba, Chinese Wall, Clark Wilson
CCM 4350 Lecture 14 Security Models 2: Biba, Chinese Wall, Clark Wilson Introduction Bell-LaPadula model designed to capture a specific military security policy. At one time treated as the model of security.
CDSE Workshop. CDS Concepts and Definitions. Elaine M. Caddick Principal Cybersecurity Engineer 19 July 2016
CDSE Workshop CDS Concepts and Definitions Elaine M. Caddick Principal Cybersecurity Engineer 19 July 2016 Approved for Public Release; Distribution Unlimited. Case Number 16 2506 2016 The MITRE Corporation.
Asbestos Operating System
Asbestos Operating System Presented by Sherley Codio and Tom Dehart This Talk Recap on Information Flow Asbestos Overview Labels Special Rules Discretionary Contamination Declassification/Decontamination
Compositional Security Evaluation: The MILS approach
Compositional Security Evaluation: The MILS approach John Rushby and Rance DeLong Computer Science Laboratory SRI International Menlo Park CA USA Primary affiliation: LynuxWorks John Rushby, Rance DeLong,
CCM 4350 Week 22. Security Architecture and Engineering. Dr A. Lasebae School of Science and Technology CCM4350 1
CCM 4350 Week 22 Security Architecture and Engineering Dr A. Lasebae School of Science and Technology CCM4350 1 Security Evaluation CCM4350 2 Security Evaluation How do you get assurance that your computer
Access control models and policies
Access control models and policies Tuomas Aura T-110.4206 Information security technology Aalto University, autumn 2013 1. Access control 2. Discretionary AC 3. Mandatory AC 4. Other AC models Outline
Advanced Systems Security: Security Goals
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Access control models and policies
Access control models and policies Tuomas Aura T-110.4206 Information security technology Aalto University, autumn 2011 1. Access control 2. Discretionary AC 3. Mandatory AC 4. Other AC models Outline
CSCI 420: Mobile Application Security. Lecture 7. Prof. Adwait Nadkarni. Derived from slides by William Enck, Patrick McDaniel and Trent Jaeger
CSCI 420: Mobile Application Security Lecture 7 Prof. Adwait Nadkarni Derived from slides by William Enck, Patrick McDaniel and Trent Jaeger 1 cryptography < security Cryptography isn't the solution to
Access Control Part 3 CCM 4350
Access Control Part 3 CCM 4350 Today s Lecture Repetition of Structuring Access Control Fresh up notions of Partial Orders Again Example of Groups ordering for VSTa- Microkernel abilities as Motivation
Involved subjects in this presentation Security and safety in real-time embedded systems Architectural description, AADL Partitioned architectures
Introduction Problem: security and reliability Purpose: design and implementation of safe/secure systems Help system designers to describe their requirements Ensure safety and security policies enforcement
Creating a Practical Security Architecture Based on sel4
Creating a Practical Security Architecture Based on sel4 Xinming (Simon) Ou University of South Florida (many slides borrowed/adapted from my student Daniel Wang) 1 Questions for sel4 Community Is there
Intergrity Policies CS3SR3/SE3RA3. Ryszard Janicki. Outline Integrity Policies The Biba Integrity Model
Intergrity Policies CS3SR3/SE3RA3 Ryszard Janicki Acknowledgments: Material based on Computer Security: Art and Science by Matt Bishop (Chapter 6) Ryszard Janicki Intergrity Policies 1 / 13 Outline 1 2
Trusted DBMS Architecture. Trusted DBMS Architecture featuring Trusted OS
Trusted DBMS Architecture featuring Trusted OS KIM, Hyung Chan Security Research Group, New Wave Computing Lab. Dept. of Information and Communications, Gwangju Institue of Science and Technology (GIST)
Applying MILS to multicore avionics systems
Applying MILS to multicore avionics systems Eur Ing Paul Parkinson FIET Principal Systems Architect, A&D EuroMILS Workshop, Prague, 19 th January 2016 2016 Wind River. All Rights Reserved. Agenda A Brief
CIS433/533 - Introduction to Computer and Network Security. Access Control
CIS433/533 - Introduction to Computer and Network Security Access Control Professor Butler Winter 2011 Computer and Information Science Trusted Computing Base The trusted computing base is the infrastructure
Scheduling II. Today. Next Time. ! Proportional-share scheduling! Multilevel-feedback queue! Multiprocessor scheduling. !
Scheduling II Today! Proportional-share scheduling! Multilevel-feedback queue! Multiprocessor scheduling Next Time! Memory management Scheduling with multiple goals! What if you want both good turnaround
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 1 Operating System Quandary Q: What is the primary goal of
8.3 Mandatory Flow Control Models
8.3 Mandatory Flow Control Models Mingsen Xu Advanced Operating System 2011-10-26 Outline Mandatory Flow Control Models - Information Flow Control - Lattice Model - Multilevel Security Model - Bell-Lapadula
Advanced Systems Security: Securing Commercial Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Complex Access Control. Steven M. Bellovin September 10,
Complex Access Control Steven M. Bellovin September 10, 2013 1 Access Control Matrix List all proceses and files in a matrix Each row is a process ( subject ) Each column is a file ( object ) Each matrix
AADS+: AADL Simulation including the Behavioral Annex
AADS+: AADL Simulation including the Behavioral Annex Fifth IEEE International workshop UML and AADL 24th March 2010, Oxford, UK Roberto Varona Gómez Eugenio Villar {roberto, evillar}@teisa.unican.es University
Supporting Policies and Functions
Essay 13 Supporting Policies and Functions Marshall D. Abrams and Harold J. Podell The major policy objective, to protect information assets against specific harm, usually requires additional policies
Operating System Security. Access control for memory Access control for files, BLP model Access control in Linux file systems (read on your own)
Operating System Security Access control for memory Access control for files, BLP model Access control in Linux file systems (read on your own) Hw1 grades out this Friday Announcement Travel: out of town
Trusted OS Design CS461/ECE422
Trusted OS Design CS461/ECE422 1 Reading Material Section 5.4 of Security in Computing 2 Design Principles Security Features Kernelized Design Virtualization Overview 3 Design Principles Simplicity Less
Introduce the major evaluation criteria. TCSEC (Orange book) ITSEC Common Criteria
Introduce the major evaluation criteria. TCSEC (Orange book) ITSEC Common Criteria Evaluation: assessing whether a product has the security properties claimed for it. Certification: assessing whether a
Introduction to Computer Security
Introduction to Computer Security Instructor: Mahadevan Gomathisankaran mgomathi@unt.edu 1 Introduction So you can specify a well-thought-out policy and a concrete model now what? Now it s time for a system
Introduction to Assurance
Introduction to Assurance Overview Why assurance? Trust and assurance Life cycle and assurance April 1, 2015 Slide #1 Overview Trust Problems from lack of assurance Types of assurance Life cycle and assurance
Lecture 21. Isolation: virtual machines, sandboxes Covert channels. The pump Why assurance? Trust and assurance Life cycle and assurance
Lecture 21 Isolation: virtual machines, sandboxes Covert channels Detection Mitigation The pump Why assurance? Trust and assurance Life cycle and assurance May 17, 2013 ECS 235B Spring Quarter 2013 Slide
The Evolution of Secure Operating Systems
The Evolution of Secure Operating Systems Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University 1 Operating Systems
The MILS Partitioning Communication System + RT CORBA = Secure Communications for SBC Systems
The MILS Partitioning Communication System + RT CORBA = Secure Communications for SBC Systems Kevin Buesing Objective Interface Systems Field Applications Engineer kevin.buesing@ois.com Jeff Chilton Objective
Formal Verification. Lecture 10
Formal Verification Lecture 10 Formal Verification Formal verification relies on Descriptions of the properties or requirements of interest Descriptions of systems to be analyzed, and rely on underlying
Advanced Systems Security: Virtual Machine Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Issues of Operating Systems Security
ECAI 2007 - International Conference Second Edition Electronics, Computers and Artificial Intelligence 29 th 30 th June, 2007, Piteşti, ROMÂNIA Issues of Operating Systems Security Academy of Economic
A Small Interpreted Language
A Small Interpreted Language What would you need to build a small computing language based on mathematical principles? The language should be simple, Turing equivalent (i.e.: it can compute anything that
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
Multiple Independent Layers of Security (MILS) Network Subsystem Protection Profile (MNSPP) An Approach to High Assurance Networking Rationale
Multiple Independent Layers of Security (MILS) Subsystem Protection Profile (MNSPP) An Approach to High Assurance ing Rationale 1 2008 Wind River Systems, Inc. The MILS Subsystem (MNS) is A class of subsystem
Security Models Trusted Zones SPRING 2018: GANG WANG
Security Models Trusted Zones SPRING 2018: GANG WANG Access Control Slides credit to Ethan L. Miller and Scott A. Brandt Protection Domains Three protection domains Each lists objects with permitted operations
Labels and Information Flow
Labels and Information Flow Robert Soulé March 21, 2007 Problem Motivation and History The military cares about information flow Everyone can read Unclassified Few can read Top Secret Problem Motivation
Advanced Systems Security: Cloud Computing Security
Advanced Systems Security: Cloud Computing Security Trent Jaeger Penn State University Systems and Internet Infrastructure Security Laboratory (SIIS) 1 Cloudy Foundations Can customers move their services
Green Hills Software, Inc.
Green Hills Software, Inc. A Safe Tasking Approach to Ada95 Jim Gleason Engineering Manager Ada Products 5.0-1 Overview Multiple approaches to safe tasking with Ada95 No Tasking - SPARK Ada95 Restricted
Lecture 15 Designing Trusted Operating Systems
Lecture 15 Designing Trusted Operating Systems Thierry Sans 15-349: Introduction to Computer and Network Security Anatomy of an operating system Concept of Kernel Definition Component that provides an
CONSTRUCTING A HIGH ASSURANCE MAIL GUARD
CONSTRUCTING A HIGH ASSURANCE MAIL GUARD Richard E. Smith Secure Computing Corporation 2675 Long Lake Road Roseville, Minnesota 55113 Abstract This paper describes the mail guard constructed as part of
DoD STD Supersedes CSC-STD-00l-83, dtd l5 Aug 83 Library No. S225,7ll DEPARTMENT OF DEFENSE STANDARD DEPARTMENT OF DEFENSE TRUSTED COMPUTER
DoD 5200.28-STD Supersedes CSC-STD-00l-83, dtd l5 Aug 83 Library No. S225,7ll DEPARTMENT OF DEFENSE STANDARD DEPARTMENT OF DEFENSE TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA DECEMBER l985 December 26,
Introduce the major evaluation criteria. TCSEC (Orange book) ITSEC Common Criteria
Introduce the major evaluation criteria. TCSEC (Orange book) ITSEC Common Criteria Evaluation: assessing whether a product has the security properties claimed for it. Certification: assessing whether a
Database Systems: Design, Implementation, and Management Tenth Edition. Chapter 9 Database Design
Database Systems: Design, Implementation, and Management Tenth Edition Chapter 9 Database Design Objectives In this chapter, you will learn: That successful database design must reflect the information
Justifying Integrity Using a Virtual Machine Verifier
Justifying Integrity Using a Virtual Machine Verifier Joshua Schiffman, Thomas Moyer, Christopher Shal, Trent Jaeger, and Patrick McDaniel ACSAC 09 1 1 Cloudy Horizons Utility-based cloud computing is
Address spaces and memory management
Address spaces and memory management Review of processes Process = one or more threads in an address space Thread = stream of executing instructions Address space = memory space used by threads Address
Networks: Access Management
Networks: Access Management Class Notes # 3 Protocols and Layers (part 1) September 19, 2003 Functions A small set of functions form the basis of all protocols. Not all protocols have all functions; this
Operating Systems Design Fall 2010 Exam 1 Review. Paul Krzyzanowski
Operating Systems Design Fall 2010 Exam 1 Review Paul Krzyzanowski pxk@cs.rutgers.edu 1 Question 1 To a programmer, a system call looks just like a function call. Explain the difference in the underlying
Advanced Systems Security: Virtual Machine Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Programming Languages Third Edition
Programming Languages Third Edition Chapter 12 Formal Semantics Objectives Become familiar with a sample small language for the purpose of semantic specification Understand operational semantics Understand
Semantic Interconnection Models & Inscape. Unit Interconnection Model. Example Uses of Unit IM
Architecture and Design Intent Semantic Interconnection Models & Inscape Dewayne E Perry ENS 623A Office Hours: T/Th 11:00-12:00 perry @ ece.utexas.edu www.ece.utexas.edu/~perry/education/382v-s06/ Lecture
SELinux. Don Porter CSE 506
SELinux Don Porter CSE 506 MAC vs. DAC By default, Unix/Linux provides Discretionary Access Control The user (subject) has discretion to set security policies (or not) Example: I may chmod o+a the file
Securing Web Applications. Architecture Alternatives. Web Application Security Roadmap. Defense in Depth. Defense in Depth
V User Terminal Key Secure Storage Personal Computers AntiVirus Certificate Mgmt Authority :::::: Multiplexor Securing Web Applications Jennifer L. Bayuk jennifer@bayuk.com www.bayuk.com 1 Mainframe Wireless