Integrity Policies. CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger.

Size: px

Start display at page:

Download "Integrity Policies. CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger."

Claude Stevenson
6 years ago
Views:

1 CSE497b Introduction to Computer and Network Security - Spring Professor Jaeger Policies CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger

2 CSE497b Introduction to Computer and Network Security - Spring Professor Jaeger 2 Does the following access matrix protect the integrity of J s public key file O2? O 1 O 2 O 3 J R R W R W S 2 N R R W S 3 N R R W

3 What determines the integrity of a file or process? The inputs that an object depends on What does this dependency mean? File: integrity of data written into the file Depends on the integrity of the writers... Process: what the execution of the process depends on What concrete actions determine what a process depends on? Read/Execute Code Read/Execute Libraries Read/Write Data CSE497b Introduction to Computer and Network Security - Spring Professor Jaeger 3

4 Approximation A conservative view The integrity of objects (data and code) is determined by the integrity of its writers The integrity of a subjects (processes) is determined by the integrity of the objects it reads of Obj Object of Subj Subject CSE497b Introduction to Computer and Network Security - Spring Professor Jaeger 4

5 Biba Information Flow Works for Secrecy Try Too Very Secret High Mostly Secret? Pretty Secret Good? Solid Secret Low 5

6 Biba Levels High and Low System and users Other levels? 6

7 Example 7 SSH Daemon (sshd) fork openssh Listen *:22 Network Connection openssh (forked for request) Monitor Key Exchange Authentication User Network Data Time

8 8 Biba and SSH Does it work? sshd Requests Guard Remote Subject

9 Low Water Mark (LOMAC) Subject Level Highest integrity level initially Object Level Based on level of subjects that have written (lowest) Subject Level Changes as objects are read Minimum of object levels Highest Good Solid Remote Subject 9

10 10 Self-Revocation Problem Self-Revocation Problem Process starts with high integrity Open high integrity object o1 Read from low integrity object o2 LOMAC semantics reduce process s integrity to low No longer can write to o1 Inconsistent with UNIX Step 1: initial state ps Step 2: ps reads low file pipe grep ps pipe grep Step 3: demotion ps pipe grep Step 4: pipe write denied ps pipe grep

11 SSH and LOMAC 11 Does SSH work with LOMAC? sshd Good Solid Remote Subject

12 Privilege Separation Limit the amount of code that runs with privilege Decompose program Privileged component Unprivileged component Interface between the two Each component is designed to minimize the amount of code with privilege! Build secure application Postfix mail system SSH daemon Not too many others 12

13 Privilege Separated OpenSSH 13 Current version of OpenSSH

14 and Privilege Separated OpenSSH Should this improve integrity? Fewer commands Filter inputs Limit legal command orders Remove direct access to network input Does this enable Biba integrity? Are low integrity inputs made to privileged component? Are they upgraded? Does this enable LOMAC integrity? How do the inputs to the privileged component impact its integrity level? 14

15 Clark-Wilson Propose that high integrity programs can protect themselves from low integrity inputs! How are low integrity inputs processed? Upgrade: turn them into high integrity data Discard: drop them immediately How do we know that the high integrity program did this correctly? Need complete program assurance Still working on this... Discuss later in Linux and Virtual Machine Systems 15

16 Take Away has to do with dependence Harder to pin down than secrecy If dependence is based on reading is the dual of secrecy models Biba, LOMAC, Clark-Wilson Don t exactly correspond to real-world What do we do? Protect the integrity of high secrecy data and code 16

Advanced Systems Security: Integrity

Advanced Systems Security: Integrity Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security: