Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
91
the other hand, even monitoring of the BIOS itself can occur “under the
supervision” of some additional equipment and not show its changes.
Similar effects can occur when processing a file. The purpose of organizing
the real data reading mode is to identically display the reading parameters
on the associated object of the reading subject (flow from the associated
object of the Control centre subject to the associated object of the reading
subject) and identically map the read object (in accordance with the
parameters passed to the reading subject) to the associated data objects of
the Control centre subject.
Let us now explain the concept of a qualitative Control centre from the
point of view of the mathematical properties of the Control centre function.
Suppose that there is some object F and some algorithm H that transforms
object F into some object M, which is represented by a word of the same
language, but of shorter length. This algorithm is such that with a random
equally probable selection of two objects F1 and F2 from the set of possible
ones, the corresponding objects MI = H(F1) and M2 = H(F2) are different
with a high probability. Then the data integrity check is constructed as
follows: we consider the object F, using the well-known algorithm H we
construct K = H(F) and compare M, previously calculated as M = H(F), with
K. If there is a match, we consider the object unchanged. Algorithm H is
usually called a hash function, or less often a checksum, and the number M
is a hash value.
The quality of the Control centre is determined in this case by fulfilling
the following conditions:
1. Given a known object M = H(F), finding another object G, not
identical to F, such that M = H(G) is a task with a complexity no less than
the given Th.
2. Object M must not be changeable.
3. The length of the object M must provide a conditional probability
P(H(Fi) = H(F2)/Fi (not identical to F2) no more than a given P [1].
Let us explain the meaning of these conditions. Let the attacker’s
program change the object F (static distortion). Then, generally speaking,
the hash value M for a given object will change. If an attacker has access to
92
an object M for modification (there is a corresponding thread), then he can,
using the well-known algorithm H, calculate a new hash value for the
modified object and replace the original one with it.
Let the hash value be unavailable, then you can try to construct the
modified object so that its hash value does not change; this is possible in
principle, since the mapping specified by the hashing algorithm H is not
bijective (ambiguous) [1].
Thus, provided that the hash value is unavailable for change and the
source object is available for change, the complexity of violating the ISE
with the CC of source objects (i.e., the ability to generate a subject from a
source object that is not identical to the original object) coincides with Tn.
In a single attempt to initiate a subject from a randomly selected source
object with equal probability, the probability of violating the ISE
(successfully generating a subject) does not exceed Ph. So, the “quality” of
the ISE is determined by the properties of the hash function H, namely: the
values of Tn and Pn.
Let us summarize the above reasoning in the method of “safe loading”,
or step control. It consists in gradually establishing the immutability of the
components of the software and hardware environment:
1. First, the immutability of the ROM programs is checked; if the
outcome is positive, the boot sector and operating system drivers (by sector)
are read through the integrity-checked ROM programs, and their
immutability is also checked; in addition, the integrity of the object that
determines the activation sequence of the components is checked.
2. Through the reading functions of the verified OS, the process of
controlling the generation of processes is initiated (implementation of the
SSM).
3. Initiating the process of access control to objects completes the
design of a guaranteed secure AS.
Considering the issues of software and hardware implementation of
the ISE, it is necessary to note that the power of many subjects in a certain
segment of the AS (allocated on the basis of belonging to one computer)
increases from the moment the power is turned on until the user processes
93
start. Initially, subjects of the hardware-software level (ROM programs) are
activated, then these subjects generate from source objects of this level
(these are, as a rule, sectors of external storage media) subjects of the
operating environment level.
Subjects of the operating environment level, as already noted, are also
divided into two sublevels: the lower level — subjects — primary loaders
of the OS (working with sector-level information) and the upper level —
subjects-drivers (generated by subjects — primary loaders from sector
objects) working with “file” level objects (sequences of sectors). At the
stage of transition from loader subjects to driver subjects, there is a transition
to another decomposition of AS into objects (from sectors to files). This
hierarchy operates in any currently known AS and naturally predetermines
the architecture within which the ISE is formed and operates.
For example, the hardware architecture of a personal computer such
as an IBM PC specifies the following stages of activation of various AS
subjects. When the PC is powered on, the OP is tested, the interrupt vector
table is initialized, and BIOS extensions are searched. If available, control
is transferred to them. After the BIOS extensions have been processed, the
first sector of the floppy disk or hard drive is read into memory and control
is transferred to it (bootloader code is generated), then the bootloader code
reads the operating system drivers, then the configuration files are
interpreted, the command interpreter is loaded and the autorun file is
executed.
When implementing an information system, it should be assigned the
function of monitoring program launches and monitoring integrity.
When describing the ISE design methodology, the problem of
monitoring real data was mentioned. This problem is that integritycontrolled information may be represented differently at different levels.
An entity embedded in the system can influence the process of reading
and writing data at the file level (or at the sector level) and present some
other data to the control system instead of real existing data. This
mechanism has been repeatedly implemented in STELS viruses. However,
the statement is true.
94
Statement 7 (sufficient condition for reading real data).
If the entity serving the data reading process (i.e., the specified entity
is initiated by the data requesting entity and participates in the flow)
contained only the functions of identical data mapping to the associated data
objects of any entity initiating the read flow, and the integrity of the source
object for that entity fixed, then if it is subsequently immutable, reading
using the generated subject will be reading real data.
Proof. The correctness of the statement follows from the definition of
the identity of the subject and from the condition of the statement, which
guarantees the immutability of the source object.
Here, too, it is necessary to make a reservation about the probabilistic
nature of establishing immutability and say that reading real data is possible
with a probability determined by the CC algorithm.
The stepwise control method does not contradict statements 4 and 5
and provides for dividing the activation sequence of ZL components into
subsequences with the same level of information presentation.
The implementation of the stepwise integrity control method must
satisfy the conditions of Statement 4.
Let us describe the practical implementation of the formulated
methods.
It was said above that the subject of monitoring the immutability of
objects included in the AS activation procedures and objects describing the
sequence of component activation must be active already at the stage of
operation of the hardware-software level subjects, but its source object
technically cannot be checked for immutability. In this regard, we
emphasize a very important fact for any implementation of ISE.
Axiom 5. ISE generation is considered under the conditions of the
unchanged configuration of those AS subjects that are activated before the
start of the procedures for monitoring the integrity of objects Oz and the
sequence ZL. The immutability of these subjects is ensured by methods and
means external to the AS itself. When analyzing or synthesizing protective
mechanisms, the properties of these subjects are a priori given.
95
When solving practical issues of generating ISE, three independent
directions can be distinguished.
The first of them is associated with the use of entities external to the
AS (as a rule, located on external media), the integrity of which is
guaranteed by storage methods or periodic monitoring. The
predetermination of the activation of subjects localized on external media is
ensured by the properties of the subjects at the hardware-software level (for
example, it is possible to set a PC hardware configuration in which the
operating system will be loaded from the floppy disk).
The second direction is associated with the localization of information
systems within a territorially limited workplace (usually a PC) and uses
hardware support to set a predetermined sequence of activation of subjects.
This direction, as a rule, also includes hardware support for user
authentication.
The third direction is related to the implementation of the method of
trusted loading of the operating environment using the mechanisms already
available in it for implementing and guaranteeing security.
It should be noted that at different intervals of AS activity, subjects
can be controlled by different users, for whom the set of allowed subjects E
is different; in this regard, we will talk about the set Ei for the AS user i.
We will also assume that before establishing a one-to-one
correspondence between the set Ei and user i, an authentication procedure
takes place.
All methods of implementing ISE will be briefly discussed below.
Speaking about the first of them, it should be noted that within its framework
the ISE configuration can be considered in two versions:
• when localizing all source objects for generating information systems
within one or more external media;
• when localizing some source objects on external media, and some in
the external memory of the workstation.
The second configuration is characterized by the potential for breaking
isolation, which consists in the fact that the activation of subjects from
source objects that do not belong to an external medium can be carried out
96
outside the framework of the ISE. As an example, we can consider a
situation where programs are launched within an operating environment
loaded from a floppy disk. On the other hand, launching these programs is
also possible when loading the OS from another medium (in particular, from
workstation media), and it is also possible to activate those modules that are
located on a floppy disk.
Consequently, the main task when using an external medium to
generate ISE is to ensure that it is impossible to activate any subject from
the source object of the external media outside the framework of the
sequence of activation of ISE components fixed for this medium.
The earliest described method of designing an ISE within the
framework of the approach using external media was called the “invisible
floppy disk”. This method consists in the fact that all objects belonging to
the set Oz and objects describing the sequence ZL are placed on external
media from which the operating system can be loaded (usually a floppy
disk). The immutability of objects is ensured by physical write protection of
the media.
In addition, the use of special technology does not allow the use of
objects (including the execution of programs) without loading the OS from
this particular floppy disk. In practice, such a floppy disk looks quite nontrivial: when placed in a PC disk drive, it looks like unformatted (otherwise
empty). After loading from such an “empty” floppy disk, the user
immediately “immerses” in the given program and works with it, including
accessing data on the hard drive and launching programs from local nonremovable media of the workplace with preliminary control of the
immutability of the corresponding source objects (executable files).
The proposed method eliminates the use of a manufactured floppy disk
without booting from it. By supplementing the operating environment
loaded from such a floppy disk with integrity checking programs, you can
achieve compliance with all requirements for the isolation of the software
and hardware environment.
97
As follows from Statement 5, one of the most important conditions for
maintaining ISE is the impossibility of changing the sequence of component
activation.
In this case, the integrity of objects containing the component
activation sequence is guaranteed by physically prohibiting writing to the
floppy disk.
An important problem is the inability to interrupt the component
activation process. In a number of operating environments, there are
standard capabilities for this, given to provide protection against user errors
that formed an incorrect sequence for activating OS components. In this
regard, measures must be taken to guarantee the passivity of the controls
during the execution of the ZL sequence (for example, hardware locking of
the keyboard from the moment the modified BOOT is activated until the end
of the activation of the subjects of the Sz set).
The described method was later implemented in external media such
as CD-ROM, which made it possible to significantly (by two orders of
magnitude) increase the information capacity of the media and load
developed operating environments such as OS/2 from it. However, the onetime recording significantly reduces the flexibility of constructing an
information system using this method.
The inconvenience of using a boot floppy disk and its rapid wear led
to the emergence of the following method of designing an information
system.
Let’s abandon consideration of the boot floppy disk and consider a PC
with loading the OS from a local storage device (hard drive) and an
additional hardware device for isolating the environment.
Let’s consider two stages — the ISE installation stage and the ISE
operation stage. Let us assume the existence of N users, each ith of which is
characterized by some personal information Ki, unknown to other users and
stored on some material medium (for example, a sensory memory device
such as Touch Memory). There is also a system administrator with an ISE
who knows all Ki and single-handedly carries out the installation phase.
Users (Ki owners) participate only in the operation phase.
98
The ISE installation process consists of the following steps:
1. A hardware module is installed in the PC, which includes a device
and ROM programs of this device (hardware-software level entities) that
implement:
• service operations of the authenticating media of the user Ci (at least
reading it);
• authentication of the user with the number inc entered by him Ki;
1 — reading a data array containing a set of source objects (executable
modules) Fil, Fi2, ..., Fim available to user i, making up Oz, as well as an
object containing ZL;
• calculation of information Mil, Mi2, ... Mim, which fixes the
integrity of source objects Fil, ..., Fim of each source object (information
Mij must satisfy the requirements of hash values and, possibly, depend on
Ki), Mij = H(Ki, Fj);
• blocking control devices and preventing the operating environment
from loading from external media.
2. The administrator defines for user i a set of subjects that can
potentially be activated Ei, Ei = {Pil, ..., Pimi}, i = 1, ..., N. Create (Pik,
Fj)->Pij, mi — the number of tasks allowed to run for the user i.
3. The administrator generates (and stores on the media) or reads from
the media for the user i his Ki and calculates the values for subsequent
integrity monitoring Мijr = Н(Кi, Fjr), where Н is the CC function (hash
function).
4. The administrator performs steps 2 and 3 for all N users.
5. The administrator installs the SSM with the source object Fips in
the AS and records its integrity. The module is installed taking into account
the conditions of statement 5.
6. The administrator records the integrity of the object containing the ZL.
The operation process consists of the following steps.
1. Turning on the power and activating the hardware module:
a) identification of user i by Ki. If successful, step b) is executed, if
unsuccessful, the PC is blocked;
99
b) checking the integrity of all ROMs installed in the PC. If the
outcome is positive, step c) is performed, if unsuccessful, the PC is blocked;
c) reading operating environment files sector by sector and checking
their integrity;
d) reading as a Fips file (using the operating environment functions)
and checking its integrity. An option might be to read Fips by sector;
e) activation of the Rips control process. Create(Sx, Fips)->Fips.
Activation of OSM;
f) launching the selected task of the user i (may not be executed).
2. Work in the ISE.
The launch of each Ps process is accompanied by checks:
a) whether Ps belongs to the set allowed for i (Ei), if yes, then step b
is performed), otherwise the launch is ignored;
b) does G = H(Ki, Fs) coincide with M = H(Ki, Fs) calculated by the
administrator;
c) if the outcome is positive b) the task is launched, otherwise the
launch is ignored.
It is easy to see that the conditions for isolation of the environment are
met. In addition, in this case, a step control mechanism is implemented to
ensure reading of real data.
When the ISE implementation is added to the ISE and the conditions
presented above are met for the subjects included in the ISE, the generated
software environment will be guaranteed to be protected within the
framework of the security policy implemented in the ISE.
Using Statement 4 about the same states of the AS after activation of
subjects tested for immutability in an unchanged sequence, we can describe
the method of trusted loading of components of the operating environment
(briefly “trusted loading method”).
Let the order of loading OS components be predetermined (by loading
OS components we mean the activation of various OS subjects from the
corresponding source objects of different hierarchy levels). We will call the
OS boot procedure trusted if:
100
• the immutability of the OS components (objects) participating in the
loading (in other words, objects belonging to the set Oz) has been
established, and the immutability is established before the generation of the
first subject from ZL;
• the immutability of objects that determine the activation sequence of
OS components has been established (taking into account several levels of
hierarchy), immutability is ensured for a given time interval; the state of the
specified objects cannot be changed by anyone except the predefined user
(users) AC (this condition corresponds to the immutability of the ZL
sequence).
It is easy to see that the trusted loading procedure ensures the same
state of the AS after the loading is completed (according to Statement 4).
The main technical problem when implementing trusted boot is access
to objects of the highest level of the OS hierarchy (files) before loading the
kernel of a given OS (we will further call the bootable OS user). However,
if it is possible to generate an ISE for some other OS (hereinafter we will
call it the base one), we can propose an iterative implementation of trusted
loading using the resources of the specified OS.
Let’s consider the implementation of a trusted OS boot based on ISE
generation for one of the operating environments of a computer system.
Let’s assume that there is a base operating system for which full-fledged
ISE generation is possible. Let the computer system also have operating
systems Os1, Os2, ..., OSn. The task is to launch the OSj operating
environment in a trusted manner. Let the base operating system have some
conditionally called “gateway software” between the base operating system
and OSj. The functions of the gateway software are to provide access to the
OSj operating system file system (i.e., R-level objects).
Let user i have physical access to a set of technical means
(workstation) of the network (computer) Tm on which the OSj operating
system is installed. When using the Tm kit by user i:
1. User i is authenticated (using his individual information).
2. The user’s rights to use the hardware component of the Tm kit are
checked.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]