Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
11
CHAPTER 1. STRUCTURE OF INFORMATION
SECURITY THEORY
1.1. BASIC CONCEPTS OF INFORMATION
SECURITY THEORY
In order to define these concepts, we will use mathematical logic. Let
A be a finite alphabet, A is a set of words of finite length in the alphabet A.
From A, with the help of certain rules, a subset L of correct words is
isolated, which is called language. If L1 is a language for describing one
information, L2 another, then we can talk about a language I that unites L1
and L2, describing both information. Then L1 and L2 are sublanguages of L.
We will assume that any information is presented in the form of a word
in some language. In addition, we can assume that the state of any device in
a computer system is described quite fully by a word in some language.
Then it is possible to identify words and states of devices and mechanisms
of a computer system or an arbitrary electronic data processing system
(EDS). These assumptions allow the entire analysis to be conducted in terms
of a certain language.
Definition: An object relative to the language L is an arbitrary finite
set of the language L.
Example 1: let the text in the file be divided into paragraphs so that
any paragraph is also a word of the language L and, therefore, is also an
object. Thus, one object can be part of another.
Example 2: computer printer is an object. There is some (rather
complex) language that describes the printer and its states at an arbitrary
point in time. The set of valid descriptions of printer states is a finite subset
of words in that language. It is this finite set that defines the printer as an
object.
In other words, an object is a passive entity (any named component of
a computer system) used to store or retrieve information. The object can be
records, blocks, bytes, words, pages, segments, files, bits, directories,
terminals, nodes, networks, etc.
12
In the information we highlight descriptions of data transformations.
Information transformation maps a word that describes the original data into
another word. The description of data transformation is also a word.
Examples of objects that describe data transformations are computer
programs.
Each information transformation can:
a) be stored;
b) act.
In case a) we are talking about storing a description of the
transformation in some object (file). In this case, the transformation is no
different from other data. In case b), the program description interacts with
other resources of the computer system — memory, processor,
communications, etc.
Definition: The system resources allocated to a transformation activity
are called a domain.
However, in order to transform one data into another, in addition to
the domain, it is necessary to give this transformation a special status in the
system, in which system resources carry out the transformation. We will call
this status “management”.
Definition: A transformation to which control is transferred is called a
process.
This implies that the transformation is carried out in some system in
which it is clear what it means to transfer control.
Definition: An object that describes a transformation, to which a
domain is allocated and control is transferred, is called a subject.
That is, a subject can be defined as an active entity (any named
component of a computer system) that can initiate requests for resources and
use them to perform any computing tasks. Subjects typically refer to a user,
a process, or a device.
On the one hand, the basic concept of identifying subjects and objects
in a system is easy to describe, but on the other hand, in practical
implementation it turns out to be not a trivial task to determine what is a
subject and what is an object. For example, in the OS, processes are, of
13
course, subjects, while files and their associated directories are objects. But
when subjects receive signals to perform any tasks from other subjects, the
question arises: to consider them as subjects or as objects.
During execution, subjects perform some operations. As a result, there
is an interaction between subjects and objects.
Definition: Access is the interaction between subjects and objects, the
result of which is the transfer of information between them.
There are two basic operations that transfer information between
subjects and objects: read, write. The read operation is understood as an
operation whose result is the transfer of information from an object to a
subject. The write operation is understood as an operation, the result of
which is the transfer of information from an object to a subject [1–7].
In conclusion, we can add an axiom: all information security issues are
described by subjects’ access to objects.
1.2. VALUE OF INFORMATION [5]
To protect information, we need to expend effort and money, and to
do this we need to know what losses we could incur. It is clear that in
monetary terms the costs of protection should not exceed possible losses.
To solve these problems, auxiliary structures are introduced into the
information — the value of information. Let’s look at examples.
1. Additive model. Let the information be presented in the form of a
finite set of elements and it is necessary to estimate the total cost in monetary
units from the component estimates. The assessment is based on expert
assessments of the components, and if the monetary assessments are
objective, then the sum gives the required value. However, the quantitative
assessment of components is not always objective, even with qualified
expertise. This is due to the heterogeneity of the components as a whole.
Therefore, they make a single hierarchical relative scale (a linear order that
allows you to compare individual components by value relative to each
other). A single scale means equal prices for all components that have the
same ordinal rating.
14
Example: 01, ..., 0n — objects, scale 1 < ... < 5. Experts rated (2, 1,
3, ..., 4) — a vector of relative values of objects. If there is a price for at least
one object, for example C1 = 100 rubles, then the score of one point is
calculated:
С
1
/ = 50 rub.,
where is the number of assessment points for the first object, and the
price of each subsequent object is calculated: C2 = 50 rub., C3 = 150 rub.,
etc. The sum gives the value of all the information. If the price of
information is known a priori, then relative estimates on an ordinal scale
make it possible to calculate the prices of the components.
2. Ordinal scale of values. It is not always possible and necessary to
give a monetary value to information. For example, valuing personal
information, political information, or military information is not always
reasonable in monetary terms. However, the approach of comparing the
value of individual information elements to each other still makes sense.
Example: When assessing information in government agencies, an
ordinal scale of values is used. All objects (documents) of a government
agency are classified by the secrecy level. The classifications themselves
form an ordinal scale: unclassified < for official use < secret < top secret
(U < FOU < S < TS) or among the Americans: unclassified < confidential <
secret < top secret (U < Conf < S < TS). A higher class has a higher value,
and therefore the requirements for protecting it from unauthorized access
are higher.
1.3. ANALYSIS OF INFORMATION SECURITY THREATS
Information from an information security point of view has the
following categories:
• confidentiality — a guarantee that specific information is available
only to the circle of people for whom it is intended; violation of this category
is called theft or disclosure of information;
15
• integrity — a guarantee that the information now exists in its original
form, that is, no unauthorized changes were made during its storage or
transmission; violation of this category is called falsification of a message;
• authenticity — a guarantee that the source of information is exactly
the person declared as its author; violation of this category is also called
falsification, but by the author of the message;
• appealability — a rather complex category, but often used in
e-commerce — a guarantee that, if necessary, it will be possible to prove
that the author of the message is the declared person and cannot be anyone
else; The difference between this category and the previous one is that when
the author is replaced, someone else tries to claim that he is the author of the
message, and when appealability is violated, the author himself tries to
“disown” his words, which he once signed.
Other categories apply to information systems:
• reliability — a guarantee that the system behaves in normal and
abnormal modes as planned;
• accuracy — guarantee of accurate and complete execution of all
commands;
• access control — ensuring that different groups of people have
different access to information objects, and these access restrictions are
constantly observed;
• controllability — a guarantee that a full check of any component of
the software package can be carried out at any time;
• identification control — guarantee that the client currently connected
to the system is exactly who he claims to be;
• resistance to intentional failures — a guarantee that if errors are
intentionally introduced within the limits of pre-agreed norms, the system
will behave as agreed in advance.
A threat is usually understood as a potential event, action, process or
phenomenon that could lead to damage to someone’s interests.
The researchers proposed to distinguish three different types of threats.
Namely, it was noted that the most common threats to computing systems
16
can be considered as related to the disclosure, integrity or failure of
computing system services.
Confidentiality threat. This means that information becomes known
to someone who should not know it. In computer security terms, this threat
occurs whenever access is gained to some sensitive information stored in a
computer system or transmitted from one system to another. The term “leak”
is sometimes used in connection with the threat of disclosure.
In the Information Security Standard’s guidance, Americans say there
are only two ways privacy can be violated:
1) loss of control over the security system;
2) channels of information leakage.
If the security system ceases to function adequately, then, naturally,
the trajectories of the computing process can pass through a state where
prohibited access is carried out. Leakage channels characterize a situation
where either the designers failed to warn, or the system fails to consider such
access as prohibited. Loss of control of the security system can be realized
through operational measures, and administrative and personnel security
methods play a significant role here. Loss of control over protection can
occur in a critical situation, which can be created spontaneously or
artificially. Therefore, one of the main dangers for a security system is the
lack of error tolerance.
Loss of control can occur by breaching the security of the security
system itself. This can only be countered by creating a secure domain for
the security system.
Leakage channels provide a wide range of possibilities. The main class
of leakage channels is into memory channels (i.e., channels that are formed
by using access to common system objects).
Integrity threat. Information integrity violations are the illegal
destruction or modification of information.
Traditionally, integrity protection falls under the category of
organizational measures. The main source of integrity threats are fires and
natural disasters. Accidental and intentional critical situations in the system,
17
viruses, Trojan horses, random errors, etc. can also lead to destruction and
modification.
But authorized changes are not excluded, i.e. those made by certain
persons for a justified purpose (such a change is a periodic planned
correction of a certain database).
For some time, the conventional wisdom was that governments
focused on disclosure and businesses focused on integrity. But both of these
parties could be more or less bound by each of the two threats depending on
the application.
Threat of service failure. Occurs whenever, as a result of deliberate
actions taken by another user, access to some resource of the computing
system is deliberately blocked. That is, if one user requests access to a
service and another does something to prevent that access, we say that a
service failure has occurred. In reality, the blocking may be permanent, such
that the requested resource is never received, or it may only cause the
requested resource to be delayed long enough for it to become useless. In
such cases they say that the resource is exhausted.
In addition to the main types of threats listed, there are others, which
are usually classified according to a number of characteristics [5].
1. By the nature of occurrence.
1.1. Natural threats (independent of humans: natural disasters,
magnetic storms, radioactive radiation, etc.).
1.2. Artificial threats (caused by human activity: the introduction of
agents among the system personnel; bribery, blackmail, etc. of personnel or
individual users; unauthorized copying of secret data; disclosure, transfer or
loss of passwords, encryption keys, identification cards, passes, etc.).
2. According to the degree of intentionality of the manifestation.
2.1. Threats of accidental action and/or threats caused by errors or
negligence of personnel (manifestation of errors in AS software and
hardware; incompetent use, configuration or illegal disabling of protective
equipment by security personnel; unintentional damage to equipment,
deletion, distortion of files with important information or programs,
including system ones, etc.);
18
2.2. Threats of intentional action (threats of an attacker to steal
information).
3. According to the position of the threat source.
3.1. Threats whose source is located outside the controlled zone of the
territory (premises) where the AS is located (interception of collateral
electromagnetic, acoustic and other radiation from devices and
communication lines, remote photo and video shooting).
3.2. Threats, the source of which is located within the controlled zone
of the territory (premises) in which the AS is located (theft of industrial
waste (printouts, records, written off storage media, etc.; shutdown or failure
of subsystems for ensuring the functioning of computer systems (power
supply, cooling and ventilation, communication lines, etc.); the use of
listening devices).
3.3. Threats whose source has access to AS peripheral devices
(terminals).
3.4. Threats whose source is located in the AS (design of system
architecture and data processing technology, development of application
programs that pose a danger to system performance and information
security; incorrect use of AS resources).
4. According to the degree of dependence on the activity of the central
nervous system.
4.1. Threats that can manifest themselves regardless of the activity of
the DCS (breaking cryptographic information protection ciphers; theft of
magnetic disks, tapes, memory chips, storage devices and computer
systems).
4.2. Threats that can only appear during automated data processing
(for example, threats of execution and spread of software viruses).
5. According to the degree of impact on the AS.
5.1. Passive threats that, when implemented, do not change anything
in the structure and content of the AS (for example, the threat of copying
secret data).
5.2. Active threats that, when exposed, make changes to the structure
and content of the system (for example, the introduction of “bookmarks”
19
and “viruses”; changing the operating modes of devices or programs, a
strike, sabotage of personnel, setting up powerful active radio interference
at the operating frequencies of system devices, etc.).
6. By stages of user or program access to AS resources.
6.1. Threats that may appear at the stage of access to AS resources (for
example, threats of unauthorized access to AS).
6.2. Threats that may appear after permission to access AS resources
(for example, threats of unauthorized or incorrect use of AS resources).
7. By the method of accessing AS resources.
7.1. Threats aimed at using a direct standard path to access AS
resources (illegal acquisition of passwords and other access control details;
unauthorized use of user terminals with unique physical characteristics).
7.2. Threats aimed at using a hidden non-standard path to access AS
resources (login to the system by bypassing security measures (loading a
foreign operating system from removable magnetic media, etc.); access to
AS resources by using undocumented OS capabilities).
8. At the current location of information stored and processed in the AS.
8.1. Threats to access information on external storage devices (for
example, the threat of unauthorized copying of sensitive information from a
hard drive).
8.2. Threats to access information in RAM (reading residual
information from RAM; threat of access to the system area of RAM from
application programs).
8.3. Threats of access to information circulating in communication
lines (illegal connection to communication lines with the aim of replacing a
legitimate user by physically disconnecting him after logging into the
system and successful authentication, followed by entering misinformation
and imposing false messages; interception of the entire data flow for the
purpose of further analysis is not real time).
8.4. Threats of access to information displayed on the terminal or
printed on a printer (for example, the threat of recording the displayed
information on a hidden video camera) [5].
20
Regardless of the specific types of threats or their problem-oriented
classification, the AS satisfies the needs of those operating it if the three
main threats (confidentiality, integrity and availability) are eliminated.
1.4. STRUCTURE OF INFORMATION SECURITY THEORY
Basic levels of information protection
When considering AS protection issues, a four-level gradation of
access to information stored, processed and protected by AS is usually used.
This allows us to systematize and generalize the entire range of protection
methods related to information security. We list the main levels of
information protection:
• level of storage media;
• level of means of interaction with the carrier;
• level of information presentation;
• level of information content.
These levels were introduced for the following reasons: firstly, for ease
of manipulation, information is most often recorded on some material
medium, which can be paper, a CD disk or something like that. Secondly, if
the method of presenting information is such that it cannot be directly
perceived by a person, there is a need to convert information into a method
of presentation accessible to humans.
Protection of magnetic storage media
The problem of protecting computer storage media (CSM) in the AS
is solved mainly through organizational and regulatory measures that make
it impossible or significantly limit the access of attackers to the CSM and
documentary materials of the AS. One of the most reliable approaches to
protecting CSM is its physical protection. At the same time, the protection
of CSM has specifics determined by their implementation and organization.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]