Reference Monitors & OS Security Flashcards
what is the security kernel (rmb that CO guy from 2018)
He’s a fast runner, he plays soccer maybe, and he creates the referee,
Hardware, firmware and
software elements of a TCB
that implement the reference
monitor concept.
TCB (trusted computer base)
The totality of protection mechanisms within a computer system – including hardware, firmware, and software – the combination of which is responsible for enforcing a security policy.
What are the requirements of reference monitors. RM is implemented by kernel (colonel) so it represents SAF. That leads to total vehicular control.
Function Requirement: Complete meditation
Security Requirement: Tamper Proof
Assurance Requirement: Verifiable
I mean this is kinda intuitive also
Complete mediation
The reference validation mechanism must
always be invoked.
Tamper-proof
The reference validation mechanism must
be tamper-proof.
Verifiable
The reference validation mechanism must
be small enough to be analysed and
tested
placing RM hardware
access control mechanisms in microprocessors
placing RM OS kernel
hypervisor, i.e. a virtual machine that
emulates the host computer it is running on. Referee with sunglasses.
placing RM Services layer
access control in database systems, Java Virtual Machine, .NET Common Language Runtime, or CORBA middleware architecture.
Referee sips an 8 bit coffee shaped like a computer
placing RM Operating system
access control in Unix and Windows 2000
placing RM Application
security checks in the application code to address application specific requirements
AllFather Speaks: Orphan Kills Heimdallr
Application, services, operatingsystem, kernel (wear killer sunglasses/vizors), hardware
Operating System Integrity
Assume that your O/S prevents unauthorized access to resources (as long as it works as intended)
Ey say more about tamper proof requirement
• To bypass protection, an attacker may try to disable the security controls by
modifying the O/S.
• An integrity problem: the O/S is not only the arbitrator of access requests, it
is itself an object of access control.
• Users must not be able to modify the operating system.
don’t fuck with the boy,ogre. the boy controls weapons but the boy is a weapon
What are the 2 competing requirements in OS integrity, and what are the concepts used to achieve these goals
Users should be able to use (invoke) the O/S. Solved by status information
Users should not be able to misuse the O/S/ Solved by controlled invocation or restricted privilege.
What is the status flag
To protect itself, an O/S must be able to distinguish computations ‘on behalf’ of
the O/S from computations ‘on behalf’ of a user.
Status flag allows system to work in different modes
the computer lady from little britain goes up to the entrance to a different party. the butler asks, are you for yourself or bill gatees.
Intel 80x86: two status bits and four modes
Unix distinguishes between user and superuser (root)
For example, to stop users from writing directly to memory and corrupting the logical file structure, the OS grants write access to memory locations only if the processor is in supervisor mode.
If a user wants to write to memory (requires supervisor mode) then the system has to switch between nodes. How is this done
Changing the status bit to supervisor mode would give all supervisor privileges to the user
Controlled invocation: Invocation of a function that executes privileged instructions to provide a limited, well defined functionality, and then
return to user mode.
So the computer lady, me in a dress, looks my ben ten watch. see it glow 0 in a faint green glow in the night sky. the air is humid. Option 1, I turn the watch to 1. I hear the click of the watch, bill gates’ silhouette appears on it and I turn into it. I am in supervisor mode now.
Option 2, I bring out my phone, with confidence and ego i call bill gates and he gives me the functionality to write to memory (enter the orange ball).
why is there a need for security mechanisms at the core
Security mechanisms in a given layer can be compromised from a layer
below.
To evaluate security, you must check that security mechanisms cannot
be bypassed.
The more complex a system, the more difficult this check becomes. At
the core of a system you may find simple structures which are amenable
to thorough analysis.
tldr: you create a very skinny man with a body shape like an apple core. his heart’s poking out, it’s quite terrifying, like the seed in the apple core. he’s in charge of the base layer of the system
what are the benefits for putting security mechanisms at the core
Putting security mechanisms into the core of the system can reduce performance overheads caused by security
Processor performance depends on the right choice and efficient implementation of a generic set of operations that is most useful to the majority of users. The same holds for security mechanisms
Some sources assume that TCBs and security kernels must enforce multi-level security policies.
The skinny man with the core body has a sniper. see him somehow carry the weight of the barret. his eyes are bloodshot. he takes aim at UAVs flying overhead and shoots them. the people living above cheer.
he does not smile.
RAM. Also sum up security characteristics of different types of memory.
reads and writes memory, no guarantee of confidentiality
There’s a goat-person with hooves. he has those weird goat eyes. you can both see and fuck with the goat person, like push him over.
The goat person is making what it thinks are heart eyes at edward cullen. edward cullen can’t be fucked with obviously. But he can be seen and whoops he sparkles and he’s got bill gates in his hands
Edward Cullen is distracted, checking out lil huddy. lil huddy keeps getting attacked by kpop tiktok bot stans.
Lil huddy is playing with a worm in between his fingers. the worm holds the secret to all existence, and has a wise face.
the worm drops, it shits. audit log
ROM (read only memory)
Provides integrity but not confidentiality, the ROM may store part of the OSq
EPROM (erasable and programmable read only memory)
could store parts of the OS or crypto keys; high tech attacks can soften this
WROM
Memory contents are frozen once and for all, by blowing a fuse placed on the write line, WROM could hold crypto keys or audit logs
Volatile memory
Volatile memory loses its contents when power is switched off.
• Memory contents still present after a short power
loss.
• Can be reconstructed by special electronic techniques if power has been switched off for some time.
• To counter such attacks, memory has to be overwritten repeatedly with suitable bit patterns.
When you reboot derek, he still remembers some things. You can hack into him to try to reconstruct his old memories a while after he dies (his ghost), but erm, q hard. To solve this, derek repeatedly has his memory changed when alive.
Non-volatile (permanent) Memory
Non-volatile (permanent) memory keeps its content when power is switched off; if attacker can directly access memory bypassing the CPU, cryptographic or physical measures are needed to protect sensitive data. • E.g., a light sensor in a tamper resistant module may detect an attempted manipulation and trigger the deletion of the data kept in the module.
Jianyu remembers all things when he sleeps, shiva waking sleep something. If you try to peek inside, he self detonates.
what is confidential
you can’t see my shit
what is integrity
you can’t fuck with my shit.
integrity, cant fuck w me
confi, cena y’cant see me
What is IPC
A process has its own address space and
communicates with other processes only
through O/S primitives (Inter-Process
Communication).
Logical separation of processes as a basis for security.
A context switch between processes can be an expensive operation.
is the context switch expensive
yes
what is a process
A program in execution, consisting of executable code, data, and the execution context, e.g. the contents of certain CPU registers.
what is a thread
Strands of execution within a process. Threads share an address space to avoid the overheads of a full context switch, but they also avoid potential security controls
Processes and threads are important units of control for the OS, and for security. They are the :
subjects of access control
how does the CPU deal with interruptions of executions created by errors
through exceptions, interrupts, and traps. Bill gates shaves his head and wears a tie why?
what is a trap.
special input to the CPU that includes an address (interrupt vector) in an interrupt vector table giving the location of the program (interrupt handler) that deals with the condition specified in the trap.
satya nadella in a dress serves a list of IV bags in a table to bill gates. he raises an eyebrow. One of the IV bags is bloodied and has a torn off human hand on it.
Bill gates pushes a small copy of himself onto a stack then gives a nod to the hand. the hand moves the watch of some fake bill gates to remove the supervisor bit. then it returns control of the world to the User. bill gates continues doing his own thing.
What does the OS have to do
- Separate user space from OS space,
- Logically separate users,
- Restrict the memory objects a process can access
at the Microsoft garden party, bill gates has a whole bar to himself that he doesn’t let people enter. he then tells me that I can go to this bar table but not this other bar table. i can’t go there, erm, there’s a forcefield. I look at my ben ten watch. I don’t do anything yet. I also feels my hot hair (sunny day) and look at the row of wigs in the classroom/bar over there that I can’t access cos I don’t have position. I tear my hair off.
What is the logical separation of users
- File management
2. Memory management
Segmentation Security
Segmentation divides memory into logical units of variable lengths.
• A division into logical units is a good basis for enforcing a security policy.
• Units of variable length make memory
management more difficult.
Paging Security
Paging divides memory into pages of equal length.
• Fixed length units allow efficient memory
management.
• Page faults may create a covert channel
Why is paging not a good basis for access control
Paging is not a good basis for access control as pages are not logical units.
One page may contain objects requiring different protection.
When a process accesses a logical object stored on more than
one page, a page fault occurs whenever a new page is requested.
A covert channel exists if page faults are observable.
Covert Channel
Consider a password scheme where the password entered is compared character by character with the reference password stored in memory.
Access is denied the moment an incorrect match is found.
If a password is stored across a page boundary, then observing a page fault indicates that the piece of the password on the first page has been guessed correctly.
If the attacker can control where the password is stored on the page, password guessing becomes easy
