Security

1
Security

• Chapter 9

9.1 The security environment 9.2 Basics of
cryptography 9.3 User authentication 9.4
Attacks from inside the system 9.5 Attacks from
outside the system 9.6 Protection mechanisms
9.7 Trusted systems
2
The Security EnvironmentThreats

• Security goals and threats

3
Basics of Cryptography

• Relationship between the plaintext and the
  ciphertext

4
Secret-Key Cryptography

• Monoalphabetic substitution
• each letter replaced by different letter
• Given the encryption key,
• easy to find decryption key
• Secret-key crypto called symmetric-key crypto

5
Public-Key Cryptography

• All users pick a public key/private key pair
• publish the public key
• private key not published
• Public key is the encryption key
• private key is the decryption key

6
RSA Encryption
To find a key pair e, d 1. Choose two large
prime numbers, P and Q (each greater than 10100),
and form N P x Q Z (P1) x (Q1) 2. For d
choose any number that is relatively prime with Z
(that is, such that d has no common factors with
Z). We illustrate the computations involved
using small integer values for P and Q P
13, Q 17 gt N 221, Z 192 d 5 3. To
find e solve the equation e x d 1 mod Z That
is, e x d is the smallest element divisible by d
in the series Z1, 2Z1, 3Z1, ... . e x d
1 mod 192 1, 193, 385, ... 385 is
divisible by d e 385/5 77
7
RSA Encryption (contd.)
To encrypt text using the RSA method, the
plaintext is divided into equal blocks of length
k bits where 2k lt N (that is, such that the
numerical value of a block is always less than N
in practical applications, k is usually in the
range 512 to 1024). k 7, since 27 128 The
function for encrypting a single block of
plaintext M is (N P X Q 13X17 221), e
77, d 5 E'(e,N,M) Me mod N for a message
M, the ciphertext is M77 mod 221 The function for
decrypting a block of encrypted text c to produce
the original plaintext block is D'(d,N,c) cd
mod N The two parameters e,N can be regarded as a
key for the encryption function, and similarly
d,N represent a key for the decryption function.
So we can write Ke lte,Ngt and Kd ltd,Ngt, and
we get the encryption function E(Ke, M) MK
(the notation here indicating that the encrypted
message can be decrypted only by the holder of
the private key Kd) and D(Kd, MK ) M.
lte,Ngt - public key, d private key for a
station
8
Application of RSA

• Lets say a person in Atlanta wants to send a
  message M to a person in Buffalo
• Atlanta encrypts message using Buffalos public
  key B ? E(M,B)
• Only Buffalo can read it using it private key b
  E(b, E(M,B)) ? M
• In other words for any public/private key pair
  determined as previously shown, the encrypting
  function holds two properties
• E(p, E(M,P)) ? M
• E(P, E(M,p)) ? M

9
How can you authenticate sender?

• In real life you will use signatures we will
  look at concept of digital signatures next.
• Instead of sending just a simple message, Atlanta
  will send a signed message signed by Atlantas
  private key
• E(B,E(M,a))
• Buffalo will first decrypt using its private key
  and use Atlantas public key to decrypt the
  signed message
• E(b, E(B,E(M,a)) ? E(M,a)
• E(A,E(M,a)) ? M

10
Digital Signatures

• Strong digital signatures are essential
  requirements of a secure system. These are needed
  to verify that a document is
• Authentic source
• Not forged not fake
• Non-repudiable The signer cannot credibly deny
  that the document was signed by them.

11
Digest Functions

• Are functions generated to serve a signatures.
  Also called secure hash functions.
• It is message dependent.
• Only the Digest is encrypted using the private
  key.

12
Alices bank account certificate
13
Digital signatures with public keys
14
Low-cost signatures with a shared secret key
15
One-Way Functions

• Function such that given formula for f(x)
• easy to evaluate y f(x)
• But given y
• computationally infeasible to find x

16
Digital Signatures
(b)

• Computing a signature block
• What the receiver gets

17
Buffer Overflow

• (a) Situation when main program is running
• (b) After program A called
• (c) Buffer overflow shown in gray

18
Covert Channels (1)
Encapsulated server can still leak to
collaborator via covert channels
Client, server and collaborator processes
19
Covert Channels (2)

• A covert channel using file locking

20
Covert Channels (3)

• Pictures appear the same
• Picture on right has text of 5 Shakespeare plays
• encrypted, inserted into low order bits of color
  values

Hamlet, Macbeth, Julius Caesar Merchant of
Venice, King Lear
Zebras
21
Generic Security Attacks

• Typical attacks
• Request memory, disk space, tapes and just read
• Try illegal system calls
• Start a login and hit DEL, RUBOUT, or BREAK
• Try modifying complex OS structures
• Try to do specified DO NOTs
• Convince a system programmer to add a trap door
• Beg admin's secy to help a poor user who forgot
  password

22
Famous Security Flaws
(a)
(b)
(c)

• The TENEX password problem

23
Design Principles for Security

• System design should be public
• Default should be n access
• Check for current authority
• Give each process least privilege possible
• Protection mechanism should be
• simple
• uniform
• in lowest layers of system
• Scheme should be psychologically acceptable

And keep it simple
24
Network Security

• External threat
• code transmitted to target machine
• code executed there, doing damage
• Goals of virus writer
• quickly spreading virus
• difficult to detect
• hard to get rid of
• Virus program can reproduce itself
• attach its code to another program
• additionally, do harm

25
Virus Damage Scenarios

• Blackmail
• Denial of service as long as virus runs
• Permanently damage hardware
• Target a competitor's computer
• do harm
• espionage
• Intra-corporate dirty tricks
• sabotage another corporate officer's files

26
How Viruses Work (1)

• Virus written in assembly language
• Inserted into another program
• use tool called a dropper
• Virus dormant until program executed
• then infects other programs
• eventually executes its payload

27
How Viruses Work (2)

• Recursive procedure that finds executable files
  on a UNIX system
• Virus could
• infect them all

28
How Viruses Work (3)

• An executable program
• With a virus at the front
• With the virus at the end
• With a virus spread over free space within
  program

29
How Viruses Work (4)

• After virus has captured interrupt, trap vectors
• After OS has retaken printer interrupt vector
• After virus has noticed loss of printer interrupt
  vector and recaptured it

30
How Viruses Spread

• Virus placed where likely to be copied
• When copied
• infects programs on hard drive, floppy
• may try to spread over LAN
• Attach to innocent looking email
• when it runs, use mailing list to replicate

31
Antivirus and Anti-Antivirus Techniques

• (a) A program
• (b) Infected program
• (c) Compressed infected program
• (d) Encrypted virus
• (e) Compressed virus with encrypted compression
  code

32
Antivirus and Anti-Antivirus Techniques

• Examples of a polymorphic virus
• All of these examples do the same thing

33
Antivirus and Anti-Antivirus Techniques

• Integrity checkers
• Behavioral checkers
• Virus avoidance
• good OS
• install only shrink-wrapped software
• use antivirus software
• do not click on attachments to email
• frequent backups
• Recovery from virus attack
• halt computer, reboot from safe disk, run
  antivirus

34
The Internet Worm

• Consisted of two programs
• bootstrap to upload worm
• the worm itself
• Worm first hid its existence
• Next replicated itself on new machines

35
Mobile Code (1) Sandboxing

• (a) Memory divided into 1-MB sandboxes
• (b) One way of checking an instruction for
  validity

36
Mobile Code (2)

• Applets can be interpreted by a Web browser

37
Mobile Code (3)

• How code signing works

38
Java Security (1)

• A type safe language
• compiler rejects attempts to misuse variable
• Checks include
• Attempts to forge pointers
• Violation of access restrictions on private class
  members
• Misuse of variables by type
• Generation of stack over/underflows
• Illegal conversion of variables to another type

39
Java Security (2)

• Examples of specified protection with JDK 1.2

40
Protection Mechanisms Protection Domains (1)

• Examples of three protection domains

41
Protection Domains (2)

• A protection matrix

42
Protection Domains (3)

• A protection matrix with domains as objects

43
Access Control Lists (1)

• Use of access control lists of manage file access

44
Access Control Lists (2)

• Two access control lists

45
Capabilities (1)

• Each process has a capability list

46
Capabilities (2)

• Cryptographically-protected capability
• Generic Rights
• Copy capability
• Copy object
• Remove capability
• Destroy object

Server Object Rights f(Objects, Rights, Check)
47
Trusted SystemsTrusted Computing Base

• A reference monitor

48
Formal Models of Secure Systems

• (a) An authorized state
• (b) An unauthorized state

49
Multilevel Security (1)

• The Bell-La Padula multilevel security model

50
Multilevel Security (2)

• The Biba Model
• Principles to guarantee integrity of data
• Simple integrity principle
• process can write only objects at its security
  level or lower
• The integrity property
• process can read only objects at its security
  level or higher

51
Orange Book Security (1)

• Symbol X means new requirements
• Symbol -gt requirements from next lower category
  apply here also

52
Orange Book Security (2)