Operating System Security (Synthesis Lectures on Information Security, Privacy, and Trust)

✍ Scribed by Trent Jaeger

• Year: 2008
• Tongue: English
• Leaves: 236
• Edition: 1
• Category: Library

✦ Synopsis

Operating systems provide the fundamental mechanisms for securing computer processing. Since the 1960s, operating systems designers have explored how to build "secure" operating systems - operating systems whose mechanisms protect the system against a motivated adversary. Recently, the importance of ensuring such security has become a mainstream issue for all operating systems. In this book, we examine past research that outlines the requirements for a secure operating system and research that implements example systems that aim for such requirements. For system designs that aimed to satisfy these requirements, we see that the complexity of software systems often results in implementation challenges that we are still exploring to this day. However, if a system design does not aim for achieving the secure operating system requirements, then its security features fail to protect the system in a myriad of ways. We also study systems that have been retrofit with secure operating system features after an initial deployment. In all cases, the conflict between function on one hand and security on the other leads to difficult choices and the potential for unwise compromises. From this book, we hope that systems designers and implementors will learn the requirements for operating systems that effectively enforce security and will better understand how to manage the balance between function and security. Table of Contents: Introduction / Access Control Fundamentals / Multics / Security in Ordinary Operating Systems / Verifiable Security Goals / Security Kernels / Securing Commercial Operating Systems / Case Study: Solaris Trusted Extensions / Case Study: Building a Secure Operating System for Linux / Secure Capability Systems / Secure Virtual Machine Systems / System Assurance

✦ Table of Contents

Contents......Page 3
Preface......Page 9
Introduction......Page 19
Secure Operating Systems......Page 21
Security Goals......Page 22
Trust Model......Page 23
Threat Model......Page 24
Summary......Page 25
Lampson's Access Matrix......Page 27
Mandatory Protection Systems......Page 29
Reference Monitor......Page 31
Secure Operating System Definition......Page 34
Assessment Criteria......Page 37
Summary......Page 39
Multics History......Page 41
Multics Fundamentals......Page 42
Multics Security Fundamentals......Page 43
Multics Protection System Models......Page 46
Multics Protection System......Page 48
Multics Reference Monitor......Page 49
Multics Security......Page 51
Multics Vulnerability Analysis......Page 54
Summary......Page 55
UNIX History......Page 57
Windows History......Page 58
UNIX Protection System......Page 59
UNIX Authorization......Page 61
UNIX Security Analysis......Page 63
UNIX Vulnerabilities......Page 65
Windows Protection System......Page 67
Windows Authorization......Page 69
Windows Security Analysis......Page 71
Windows Vulnerabilities......Page 73
Summary......Page 74
Information Flow......Page 75
Information Flow Secrecy Models......Page 77
Denning's Lattice Model......Page 78
Bell-LaPadula Model......Page 80
Information Flow Integrity Models......Page 82
Biba Integrity Model......Page 83
Low-Water Mark Integrity......Page 85
Clark-Wilson Integrity......Page 86
The Challenge of Trusted Processes......Page 87
Channel Types......Page 88
Noninterference......Page 90
Summary......Page 91
Security Kernels......Page 93
The Security Kernel......Page 94
Secure Communications Processor......Page 95
Scomp Architecture......Page 96
Scomp Hardware......Page 97
Scomp Trusted Operating Program......Page 100
Scomp Kernel Interface Package......Page 101
Scomp Evaluation......Page 102
Gemini Secure Operating System......Page 104
Summary......Page 107
Retrofitting Security into a Commercial OS......Page 109
Commercial Era......Page 111
Microkernel Era......Page 113
IX......Page 115
Domain and Type Enforcement......Page 116
Recent UNIX Systems......Page 118
Summary......Page 119
Case Study: Solaris Trusted Extensions......Page 121
Trusted Extensions Access Control......Page 122
Solaris Compatibility......Page 123
Trusted Extensions Mediation......Page 124
Process Rights Management (Privileges)......Page 126
Privilege Bracketing and Relinquishing......Page 127
Controlling Privilege Escalation......Page 129
RBAC Authorizations......Page 130
Converting the Superuser to a Role......Page 132
Trusted Extensions Networking......Page 133
Trusted Extensions Multilevel Services......Page 134
Trusted Extensions Administration......Page 136
Summary......Page 137
Case Study: Building a Secure Operating System for Linux......Page 138
LSM History......Page 139
LSM Implementation......Page 141
SELinux Reference Monitor......Page 144
SELinux Protection State......Page 147
SELinux Labeling State......Page 150
SELinux Transition State......Page 151
SELinux Administration......Page 153
SELinux Trusted Programs......Page 154
SELinux Security Evaluation......Page 155
Summary......Page 157
Capability System Fundamentals......Page 159
Capability Security......Page 160
Challenges in Secure Capability Systems......Page 161
Capabilities and Confinement......Page 162
Capabilities and Policy Changes......Page 163
Enforcing the -Property......Page 164
Enforcing Confinement......Page 165
Revoking Capabilities......Page 167
Summary......Page 168
Secure Virtual Machine Systems......Page 170
Separation Kernels......Page 173
VAX VMM Security Kernel......Page 175
VAX VMM Design......Page 176
VAX VMM Evaluation......Page 178
VAX VMM Result......Page 180
Security in Other Virtual Machine Systems......Page 181
Summary......Page 184
System Assurance......Page 186
Orange Book......Page 188
Common Criteria......Page 191
Common Criteria Concepts......Page 192
Common Criteria In Action......Page 194
Bibliography......Page 196
Biographies......Page 197
Index......Page 223