Basics

  • Task OS security: Protect data and processes
  • What is a secure OS?
    • Provide security mechanisms
    • Ensure that security goals are enforced
    • ‌Access enforcement satisfies the reference monitor concept (otherwise, not secure systems exist)
    • Usually, refers to security kernel
  • Goals:
    • Make it hard for an adversary from system software perspective
    • Make it harder to distribute bad code
    • Make it harder to turn good code bad
  • Security goals:
    • Secrecy (focus on read operations)
    • Integrity (focus on write operations)
    • Availability (focus on consumption of resources)
    • Focus: Secrecy + Integrity (availability still affects them)
  • Important: Trade-off function and security

Motivation

  • Current OS security
    • Conventional OS security methods are insufficient
    • Conventional mechanisms enforce protection (see Access Matrix)
    • Adversary gets user access rights
  • Conditions for vulnerability:
    • Flaw in code
    • Accessible to adversary
    • Capability of adversary to exploit flaw
  • Example:
    • Flaw: Buffer overflow
    • Accessible: User input is read into buffer
    • Capability of exploitation: Adversary injects malicious code
  • Attacks:
    • Adversary-controlled code (e.g., virus, trojan horse)
    • Confused deputy attack (privileged program is tricked into misusing its authority, e.g., privilege escalation, SQL Injection, TOCTTOU)
    • Return-oriented attack (e.g., Return-to-libc)
  • Problem:
    • Adversary has a lot ways to inject malicious code
    • Intrusion detection is hard
  • Defenses:
    • Run approved code (e.g., integrity)
    • Sandbox code
    • System integrity protection (i.e., protect against malicious root user)
  • Responsible for security:
    • Programmers
    • OS Distributors
    • Administrators
    • Users
    • Service Providers
    • Content Providers

Definitions

  • Process secrecy
    • Do not communicate with unauthorized parties
  • Process integrity
    • Behavior as specified
    • Code not changed
    • Do not depend on adversary’s input
  • Trusted Computing Base
    • Set of components which is considered trustworthy
    • If a vulnerability in the TCB occurs, the security of the complete system is in danger
    • Contains security policy
  • Protection
    • Keeps secrecy and integrity for benign processes
    • Results in safety (errors from non-malicious entities)
    • Protection is incapable of defending against an active/determined adversary
  • Security
    • Keep secrecy and integrity for potentially malicious processes
    • Process should not communicate with unauthorized parties
    • Ensure Security Goals (CIA)