Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
141
degrees of criticality that have a similar hierarchical structure. An entity can
demand a service from a computing system by requesting access to system
objects. A subject is said to be denied service if its request is registered but
not satisfied within the corresponding MWT (maximum wait time).
Let’s look at the rules that describe this model.
1. No Denial Up (NDU) rule: No lower priority entities are allowed to
deny service to higher priority entities. But some higher priority entities
(such as the administrator) must be given the ability to deny service to lower
priority entities if the former so desires.
2. Rule NDU(C) is a generalization of NDU: lower-priority entities
must not interfere with higher-priority entities’ requests for services through
objects in a particular set C. Services provided to entities in C must never
become obsolete.
The main advantage of these rules is the introduction of the concept of
priority. Disadvantage: These rules make sense for systems with multiple
priorities.
4.4.2. Millen model — resource allocation model
The model is based on the idea that in order to complete the desired
task, subjects need certain temporal and spatial resource requirements.
Failure occurs only if the allocation of space and time for some process does
not meet the appropriate requirements.
Let us introduce some notation:
P — set of active processes;
R — set of passive resources;
C — some fixed limit (denotes the maximum number of units for all
types of resources);
Ap — distribution vector — the number of resource units allocated for
process p in a certain state;
CPU — a resource used to generate information about whether a
process is running or frozen. If Ap(CPU) = 1, then running(p) is true; if
Ap(CPU) = 0, then asleep(p);
142
SQp — vector of spatial requirements — the number of units of each
resource allocated by process p to perform the required task in a certain
state;
T(p) — a function showing when the clock for the process last
changed, in order to reflect real time;
T
Qp — a vector of time requirements — the amount of time required
for each resource of the process p to perform work.
Next, we present the eight rules necessary to describe the model:
1. The sum of units of allocated resources for all processes from P
must be less than the system boundary C, i.e. S Ap C.
2. Running processes must have zero space requirements, i.e. If
running(p) then SQp = 0.
3. In a certain state, the process is current and remains current in the
next state, i.e. If running(p) and running(p)1 then A
p
1
= Ap.
4. The process clock changes only with a change in CPU, i.e. if Ap
(CPU)1 = Ap (CPU), then T(p)1 = T(p).
5. The process clock is changed only to reflect the increase in time, i.e.
if Ap (CPU)1 Ap (CPU) then T(p)1 > T(p).
6. Spatial requirements are established for frozen processes, i.e. if
asleep(p) then SQ
p
1
= SQp + Ap – A
p
1
.
7. Time requirements for frozen processes are not established, i.e. if
asleep(p) then ТQ
p
1
= ТQp.
8. Transitions, as a result of which the process stops, redistribute only
CPU resources, i.e. If running(p) and asleep (p)1 then А
р
1
= Ар – CPU.
143
CHAPTER 5. BASIC CRITERIA FOR THE SECURITY
OF DCS. SECURITY CLASSES
5.1. TCSEC COMPUTER SYSTEMS SECURITY
ASSESSMENT STANDARD (“ORANGE BOOK”)
The Trusted Computer System Evaluation Criteria (TCSEC) [8],
informally called the “Orange Book” (after the color of the cover of the
original publication), was developed and published by the US Department
of Defense in 1983 to define security requirements for hardware, software
and special software and information support of computer systems, the
development of methodology and technology for analyzing the degree of
support for security policy in computer systems, mainly for military
purposes.
The Orange Book explains the concept of a secure system that
controls, through appropriate means, access to information so that only
properly authorized individuals or processes acting on their behalf have the
right to read, write, create, and delete information. It is obvious, however,
that absolutely safe systems do not exist, that this is an abstraction. Any
system can be “hacked” if you have sufficiently large material and time
resources. It makes sense to evaluate only the degree of trust that is
reasonable to place in a particular system.
General structure of TCSEC requirements
The Orange Book proposes three categories of security requirements:
security policy, auditing and correctness, within which six basic security
requirements are formulated. The first four requirements are aimed directly
at ensuring information security, and the last two are aimed at the quality of
security measures. Let’s look at these requirements in more detail.
144
Security policy
Requirement 1. Security policy. The system must support a precisely
defined security policy. The ability of subjects to access objects must be
determined based on their identification and a set of access control rules.
Where necessary, a mandatory access control policy should be used to
effectively differentiate access to information of different confidentiality
levels.
Requirement 2. Labels. Objects must have security labels associated
with them, which are used as input for access control procedures. To
implement mandatory access control, the system must provide the ability to
assign each object a label or a set of attributes that determine the degree of
confidentiality (secrecy classification) of the object and access modes to this
object.
Accountability
Requirement 3: Identification and authentication. All subjects must
have unique identifiers. Access control should be carried out based on the
results of identifying the subject and object of access, confirming the
authenticity of their identifiers (authentication) and access control rules.
Data used for identification and authentication must be protected from
unauthorized access, modification and destruction and must be associated
with all active security-critical components of the computer system.
Requirement 4. Registration and accounting. To determine the degree
of responsibility of users for actions in the system, all events occurring in it
that are significant from a security point of view must be monitored and
recorded in a secure protocol (i.e., there must be a computer system object,
streams from and to which are accessible only to the subject of
administration). The registration system should analyze the overall flow of
events and select from it only those events that have an impact on security
in order to reduce the volume of the protocol and increase the efficiency of
145
its analysis. The event log must be reliably protected from unauthorized
access, modification and destruction.
Guarantees (correctness)
Requirement 5. Monitoring the correct functioning of protective
equipment. Protection means must contain independent hardware and/or
software components that ensure the functionality of the protection
functions. This means that all security controls that provide security policy,
attribute and label management, identification and authentication, logging,
and accounting must be subject to controls that verify that they are
functioning correctly. The basic principle of correctness control is that
controls should be completely independent of security controls.
Requirement 6: Continuity of protection. All security measures
(including those implementing this requirement) must be protected from
unauthorized intervention and/or shutdown, and this protection must be
constant and continuous in any mode of operation of the security system and
the computer system as a whole. This requirement applies to the entire life
cycle of the computer system. In addition, its implementation is one of the
key axioms used to formally prove the security of a system.
Security classes of computer systems TCSEC
The Orange Book provides four groups of criteria that correspond to
varying degrees of security: from minimal (group D) to formally proven
(group A). Each group includes one or more classes. Groups D and A
contain one class each (classes D and A, respectively), group C contains
classes C1, C2, and group B contains three classes — B1, B2, B3,
characterized by different sets of security requirements. The level of
protection increases from group D to group A, and within the group — with
increasing class number. Thus, we have only six safety classes — C1, C2,
B1, B2, B3, A1. Strengthening the requirements is carried out with a gradual
shift in emphasis from provisions that determine the presence of certain
146
security mechanisms in the system, to provisions that provide a high level
of guarantees that the system operates in accordance with the requirements
of the security policy.
In order for a system to be assigned to a certain class as a result of the
certification procedure, its security policy and warranty must satisfy the
requirements below. Since, when moving to each next class, requirements
are only added, we will write out only those new ones that are inherent in a
given class, grouping the requirements in accordance with the previous
presentation.
Group D. Minimum protection.
Class D. Minimum protection. Class D is reserved for those systems
that were submitted for certification (assessment), but for some reason did
not pass it.
Group C. Discretionary protection.
Group C is characterized by the presence of discretionary access
control and audit of the actions of subjects.
Class C1. Systems based on discretionary access control. The TCB
(trusted computing base) of systems corresponding to this security class
satisfies certain minimum requirements for the secure separation of users
and data. It defines some forms of access control on an individual basis, i.e.
the user must be able to protect his information from being accidentally read
or destroyed. Users can process data individually or on behalf of a group of
users.
Security policy. A trusted computing foundation must control named
user access to named objects. The control mechanism (owner/group/other
rights, access control lists) should allow users to specify the sharing of files
between individuals and/or groups.
Accountability. The user must identify himself before performing any
actions controlled by the trusted computing base. Some kind of security
mechanism, such as passwords, must be used for authentication.
Authentication information must be protected from unauthorized access.
Guarantees. A reliable computing base must maintain an area for its
own execution, protected from external influences (particularly from
147
changes in instructions and/or data) and from attempts to monitor the
progress of work. Resources controlled by the base may constitute a certain
subset of all subjects and objects of the system. Security mechanisms must
be tested to ensure that their behavior is consistent with system
documentation. Testing should confirm that there is no obvious way for an
unauthorized user to bypass or destroy the security controls of the trusted
computing base.
Documentation:
1. User’s Guide to Security Tools: a separate piece of documentation
(chapter, volume) should describe the security mechanisms provided by a
reliable computing base and their interaction with each other, and contain
recommendations for their use.
2. Security Features Administrator’s Guide: the guide should provide
information about the features and privileges that the system administrator
controls through security controls.
3. Test documentation: the system developer must submit a document
containing the test plan, test execution procedures, and test results to the
expert committee.
4. Architectural description: the vendor’s approach to security and
how that approach will be used to implement a trusted computing
framework must be described. If the database consists of several modules,
the interface between them must be described.
Class C2. Systems built on the basis of controlled discretionary access
control.
Systems certified to this class must meet all the requirements set out
in class C1. However, class C2 systems support a more subtle policy of
discretionary access control than class C1, making the user individually
responsible for their actions after the authentication procedure in the system,
as well as auditing events related to system security.
Security policy. In addition to C1, access rights must be granular to the
user. The control mechanism should limit the propagation of access
rights — only an authorized user (for example, the owner of an object) can
grant access rights to other users. All facilities must be subject to access
148
control. When you allocate a stored object from a pool of trusted computing
resources, you must remove all traces of previous use.
Accountability. In addition to C1, each user of the system must be
uniquely identified. Each logged action must be associated with a specific
user.
A trusted computing base must create, maintain, and protect a log of
log information related to access to objects controlled by the base. It should
be possible to record the following events:
1) use of an identification and authentication mechanism;
2) entering objects into the user’s address space (for example, opening
a file, launching a program);
3) deleting objects;
4) actions of system operators, system administrators, security
administrators;
5) other events affecting information security.
Each registration record must include the following fields:
• date and time of the event;
• user ID;
• event type;
• the result of an action (success or failure).
For identification/authentication events, the device ID (e.g. terminal)
is also logged. For actions on objects, object names are registered. The
system administrator can select a set of logged events for each user.
Guarantees. In addition to C1, a trusted computing base must isolate
protected resources to the extent dictated by access control and
accountability requirements. Testing should confirm that there are no
obvious deficiencies in the resource isolation and registration information
protection mechanisms.
Documentation. The Security Administrator’s Guide, in addition to
C1, should describe the procedures for processing log information and
managing files with such information, as well as the structure of records for
each type of logged event.
149
Group B. Mandatory access control.
The main requirements of this group are mandatory (authoritative)
access control using security labels, the implementation of some formal
security policy model, and the availability of specifications for TCB
functions. In systems of this group, a link monitor (or OSM) should be
gradually implemented to the B3 class, which should control all access of
subjects to system objects.
Class B1. Class B1 systems must meet the requirements of class C2.
In addition, the following additional requirements must be met.
Security policy. A trusted computing foundation must manage the
security labels associated with each subject and stored object. Labels are the
basis for the operation of the enforcement access control mechanism. When
importing untagged information, the appropriate privacy level should be
requested from the authorized user, and all such actions should be logged.
Labels must adequately reflect the privacy levels of subjects and
objects. When exporting information, labels must be converted into an
accurate and unambiguous external representation that accompanies the
data. Each input/output device (including a communication channel) must
be treated as single-level or multi-level. All changes to the treatment and
associated security levels must be logged.
A secure computing foundation must enforce enforcement of access
control for all subjects to all stored objects. Subjects and objects must be
assigned security labels, which are a combination of ordered security levels
as well as categories. Tags are the basis of enforced access control. A secure
computing base must support at least two levels of secrecy. A subject can
read an object if its (the subject’s) security label dominates the object’s
security label, that is, the subject’s security level is not less than the object’s
security level and all categories of the object are included in the subject’s
security label. A subject can write to an object if the object’s security label
dominates the subject’s security label. A trusted computing base must
control identity and authentication information. When new subjects (for
example, processes) are created, their security labels should not dominate
the label of the user who created them.
150
Accountability. In addition to C2, the trusted computing base must
support user security labels, print operations, and associated external
representations of security labels must be logged. During operations with
objects, in addition to names, their security labels are registered. The set of
recorded events may vary depending on the security level of the objects.
Guarantees. In addition to C2, a reliable computing base must provide
mutual isolation of processes by separating their address spaces. A team of
specialists who fully understand a particular implementation of a trusted
computing framework should subject the architecture description, source
code, and object code to rigorous analysis and testing. The goal should be
to identify all architectural and implementation defects that allow an entity
to read, modify, delete information, or cause the database to become unable
to serve requests from other entities without proper authorization. All
identified deficiencies must be corrected or neutralized, after which the
database is retested to ensure that there are no old or new deficiencies. There
must be an informal or formal security policy model supported by a trusted
computing base. The model must comply with the basic premises of the
security policy throughout the entire life cycle of the system.
Documentation. The security controls administrator’s guide, in
addition to C2, should describe security-related operator and administrator
functions, including actions to change user characteristics.
Recommendations should be provided on how to interact with each other
and how to safely generate new versions of a reliable computing base.
An informal or formal description of the security policy model
enforced by the trusted computing base should be provided. It is necessary
to have arguments in favor of the sufficiency of the chosen model for
implementing the security policy. The defense mechanisms of the base and
their place in the model should be described.
Class B2. Structured protection. All requirements of protection class
B1 are met. In addition, in class B2 systems, TCB is based on a clearly
defined and well-documented formal security policy model, which requires
that mandatory and discretionary access control systems be extended to all
subjects and objects of the computer system. The TCB must be clearly
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]