Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
221
the satellite orbits, can determine the user’s location with an accuracy of up
to a meter. The high reliability of authentication is determined by the fact
that satellite orbits are subject to fluctuations, which are quite difficult to
predict. In addition, the coordinates are constantly changing, which negates
their interception. In this case, there is an opinion that an elegant,
geographically distributed attack on computer systems is only possible for
programmers of the Rocket and Space Forces.
GPS equipment is simple and reliable to use and relatively
inexpensive. This allows it to be used in cases where an authorized remote
user must be in the desired location.
Summarizing the capabilities of authentication tools, it can be
classified according to the level of information security into three
categories:
1) static authentication;
2) strong authentication;
3) permanent authentication.
The first category provides protection only against unauthorized
access in systems where an attacker cannot read authentication information
during a work session. An example of a static authentication tool is
traditional persistent passwords. Their effectiveness mainly depends on the
difficulty of guessing passwords and, in fact, on how well they are protected.
To compromise static authentication, an attacker can spy on, guess, or
intercept authentication data, etc.
Strong authentication uses dynamic authentication data that changes
with each session. Implementations of strong authentication are systems that
use one-time passwords and electronic signatures. Strong authentication
provides protection against attacks where an attacker can intercept
authentication information and use it in subsequent sessions.
However, strong authentication does not provide protection against
active attacks, during which a masquerading attacker can quickly (during
the authentication session) intercept, modify and insert information into the
transmitted data stream.
222
Persistent authentication ensures that each block of data transmitted is
identified, preventing unauthorized modification or insertion. An example
of the implementation of this category of authentication is the use of
algorithms for generating electronic signatures for each bit of transmitted
information [3].
6.4.2. Access control [15]
After identification and authentication have been completed, it is
necessary to establish the powers (set of rights) of the subject for subsequent
control of the authorized use of computing resources available in the AS.
This process is called access control (logical control).
Typically, a subject’s authority is represented by a list of resources
available to the user and the rights to access each resource in the list.
Computing resources can be programs, information, logical devices,
memory, CPU time, priority, etc.
The following access control methods can be distinguished:
1) access control based on lists;
2) use of a matrix for establishing powers;
3) access control by privacy levels and categories;
4) password-based access control.
Let’s take a closer look at the given access control methods.
1. When restricting access according to lists, the following
correspondences are specified:
• for each user — a list of resources and access rights to them;
• for each resource — a list of users and their access rights to this
resource.
Lists allow you to set rights down to the user. It is not difficult to add
rights or explicitly deny access here. Lists are used in most operating
systems and DBMSs.
2. The use of an authority establishment matrix implies the use of an
access matrix (authority table). In the specified matrix, the rows are the
identifiers of subjects who have access to the AS, and the columns are the
223
objects (information resources) of the AS. Each element of the matrix can
contain the name and size of the resource provided, an access right (read,
write, etc.), a link to another information structure that specifies access
rights, a link to a program that manages access rights, etc.
This method provides a more unified and convenient approach, since
all information about permissions is stored in the form of a single table, and
not in the form of different types of lists. The disadvantages of the matrix
are its possible bulkiness and non-optimality (most cells are empty).
3. Access restrictions by privacy levels and categories are that AS
resources are divided in accordance with privacy levels or categories.
When distinguishing by level of secrecy, several levels are
distinguished, for example: general access, confidential, secret, top secret.
The permissions of each user are set in accordance with the maximum
privacy level to which he is admitted. The user has access to all data that has
a level of secrecy no higher than he has.
When distinguishing by categories, the rank of the category
corresponding to the user is set and controlled. Accordingly, all AS
resources are decomposed by level of importance, and a certain level
corresponds to a certain rank of personnel (such as manager, administrator,
user).
4. Password differentiation obviously represents the use of methods
for subjects to access objects using a password. All methods of password
protection are used. Obviously, the constant use of passwords creates
inconvenience for users and time delays. Therefore, these methods are used
in exceptional situations.
In practice, they usually combine various access control methods. For
example, the first three methods are strengthened with password protection.
In GOST R 50739-95 “Computer facilities. Protection from
unauthorized access to information” and the documents of the State
Technical Commission define two types (principles) of access control:
• discrete access control;
• mandatory access control.
224
Discrete access control is the delimitation of access between named
subjects and named objects. An entity with a certain access right can transfer
this right to any other entity. This type is organized based on the methods of
delimitation by lists or using a matrix.
Mandatory access control is the delimitation of access of subjects to
objects, based on the information contained in the objects, characterized by
a confidentiality label, and the official permission (admission) of subjects to
access information of this level of confidentiality. Otherwise, to implement
mandatory access control, each subject and each object is assigned
classification labels that reflect their place in the corresponding hierarchy.
Using these labels, subjects and objects must be assigned classification
levels, which are combinations of hierarchical classification level and
hierarchical categories. These labels should serve as the basis for the
mandatory principle of access control. It is clear that methods of restricting
access by security levels and categories are examples of mandatory access
control.
Role-based access control
With a large number of users, traditional access control subsystems
become extremely difficult to administer. The number of connections in
them is proportional to the product of the number of users and the number
of objects. Object-oriented solutions are needed that can reduce this
complexity.
Such a solution is role-based access control (RAC). Its essence is that
intermediate entities — roles — appear between users and their privileges.
For each user, several roles can be active at the same time, each of which
gives him certain rights (Fig. 6.7).
Role-based access is neutral with respect to specific types of rights and
how they are verified; it can be considered as an object-oriented framework
that facilitates administration, since it allows you to make the access control
subsystem manageable for an arbitrarily large number of users, primarily by
establishing connections between roles similar to inheritance in object-
225
oriented systems. In addition, there should be significantly fewer roles than
users. As a result, the number of administered connections becomes
proportional to the sum (and not the product) of the number of users and
objects, which is no longer possible to reduce in order of magnitude.
Пользователь 1
Пользователь 2
Пользователь N
Роль 1
Право доступа 1
Право доступа 2
Роль К
Право доступа М
……
……
……
Fig. 6.7. Users, objects and roles
Role-based access has been developing for more than 10 years (the
idea of roles itself, of course, is much older) both at the level of operating
systems and within the framework of DBMSs and other information
services. In particular, there are implementations of role-based access for
Web servers.
In 2001, the US National Institute of Standards and Technology
proposed a draft standard for role-based access control, the main provisions
of which are given below.
Role-based access control operates on the following basic concepts:
• user (human, intelligent autonomous agent, etc.);
• user session;
• role (usually defined according to the organizational structure);
• object (an entity to which access is limited; for example, an OS file
or a DBMS table);
• operation (depends on the object: for OS files — reading, writing,
executing, etc.; for DBMS tables — inserting, deleting, etc.);
• access right (permission to perform certain operations on certain
objects).
226
Roles are assigned to users and access rights, and can be considered
to refer to the many-to-many relationship between users and rights. Many
users can be assigned to a role; one user can be assigned to several roles.
During a user session, a subset of the roles to which the user is assigned is
activated, resulting in the user becoming the owner of the combination of
rights assigned to the active roles. A user can open multiple sessions at the
same time.
A partial order relationship called inheritance can be defined between
roles. If the role r2 is the successor of r1, then all rights of r1 are assigned to
r2, and all users of r2 are assigned to r1. Inheritance of roles corresponds to
inheritance of classes in object-oriented programming, only access rights
correspond to methods of classes, and users correspond to objects
(instances) of classes.
The inheritance relationship is hierarchical, with access rights and
users extending toward each other across hierarchy levels. In general,
inheritance is multiple, that is, one role can have several predecessors (and,
naturally, several heirs, whom we will also call successors).
One can imagine the formation of a hierarchy of roles, starting with a
minimum of rights (and a maximum of users) assigned to the “employee”
role, with a gradual clarification of the composition of users and the addition
of rights (roles “system administrator”, “accountant”, etc.), up to the
“manager” role (which, however, does not mean that the manager is granted
unlimited rights, like other roles; in accordance with the principle of
minimizing privileges, it is advisable for this role to be allowed only what is
necessary to perform official duties).
There are many principles of information security, in particular
separation of duties, and in two forms: static and dynamic.
Static separation of duties places restrictions on how users can be
assigned to roles. In the simplest case, membership in a certain role prevents
the user from being assigned to a specific set of other roles. In general, this
constraint is specified as a role set-number pair (where the set consists of at
least two roles and the number must be greater than 1), so that no user can
be assigned to the specified number of roles (or more) from a given set. For
227
example, there may be five accounting roles, but the security policy allows
membership in no more than two such roles (here 3).
In the presence of role inheritance, the restriction takes on a slightly
more complex form, but the essence remains simple: when checking role
membership, you need to take into account the assignment of users to
successor roles.
Dynamic separation of duties differs from static separation of duties
only in that it considers the roles that are simultaneously active (perhaps in
different sessions) for a given user, and not those to which the user is
statically assigned. For example, one user can play the role of both a cashier
and a controller, but not at the same time; to become a controller, he must
first close the cash register. This implements the so-called temporary trust
limitation, which is an aspect of privilege minimization.
The draft standard under consideration contains specifications of three
categories of functions necessary for administering the throttle control
system:
1. Administrative functions (creation and maintenance of roles and
other role access attributes): create/delete a role/user, assign a user/right to
a role or liquidate an existing association, create/delete an inheritance
relationship between existing roles, create a new role and make it an heir/
predecessor of an existing role, create/delete constraints for static/dynamic
separation of duties.
2. Auxiliary functions (servicing user sessions): open a user session
with the activation of an implied set of roles; activate a new role, deactivate
a role; check the legality of access.
3. Information functions (obtaining information about the current
configuration taking into account the inheritance relationship). Here a
division is made into mandatory and optional functions. The first is to obtain
a list of users assigned to a role and a list of roles to which a user is assigned.
All other functions are classified as optional. This is obtaining
information about the rights assigned to a role, about the rights of a given
user (which he has as a member of multiple roles), about the roles and rights
active at the moment of the session, about the operations that the role/user
228
is authorized to perform on a given object, about static/dynamic division of
responsibilities.
6.4.3. Registration and audit [15]
Registration (or logging) is an accountability mechanism of the IS
system, recording all security-related events, such as: entry and exit of
access subjects, launch and termination of programs, issuance of printed
documents, attempts to access protected resources, changes in the powers of
access subjects and the status of objects access, etc.
The effectiveness of the IS system is fundamentally increased if
registration is supplemented with an audit — analysis of the recorded
information. This allows you to quickly identify violations, weaknesses in
the security system, analyze system patterns, evaluate user performance, etc.
The implementation of the registration and audit mechanism pursues
the following goals:
1) ensuring accountability of users and administrators;
2) ensuring the possibility of reconstructing the sequence of events;
3) detection of attempts to violate information security;
4) providing information to identify and analyze problems.
In addition, the registration and audit mechanism is a psychological
means of reminding potential violators of the inevitability of retribution for
misconduct and oversights.
Practical means of recording and auditing may include the
following:
• various system utilities and application programs,
• registration (system or audit) log.
The first tool is usually an addition to monitoring performed by the
system administrator. An integrated approach to logging and auditing is
provided by using a log book.
A log is a chronologically ordered collection of records of the results
of activities of system subjects, sufficient to restore, review and analyze the
sequence of actions surrounding or leading to the execution of operations,
229
procedures or events in a transaction in order to control the final result. A
typical log entry includes:
• record type;
• date;
• time;
• terminal;
• user;
• event;
• result.
The logbook process consists of four steps:
1. Collection and storage.
2. Protection.
3. Integration.
4. Analysis.
At the first stage, the data to be collected and stored, the period for
cleaning and archiving the log, the degree of centralization of management,
the place and means of storing the log, the possibility of registering
encrypted information, etc. are determined.
The recorded data must be protected primarily from unauthorized
modification and possibly disclosure. Additional security requirements are
determined by the concentration of information about the entire AS,
multiple AS segments with different access levels, different areas of
administrative responsibility, etc.
The integration stage is necessary to combine and harmonize the
formats of recorded data from different systems. Some systems do not have
mechanisms for monitoring and recording data. It may be necessary to
develop programs for additional data control and programs for transforming
data into a single format.
The most important step is the analysis of registration information.
There are several known methods for analyzing information in order to
identify UA.
Statistical methods. Here, the average statistical parameters of the
functioning of the subsystems (historical traffic profile) are accumulated
230
and compared with the current ones. The presence of certain deviations may
signal the possibility of certain threats. For example, this is how they
identify: server failures due to an avalanche of requests, a quickly spreading
computer virus, an intruder masquerading as a legal user but behaving
differently (“masquerade”), etc.
Heuristic methods. In this case, the logical rules of the decision support
system encode known UA scenarios, characteristics of the observed system
that signal violations, or action patterns that collectively lead to UA. It is
clear that these methods identify only known threats defined in the
The second section of the work is devoted to the information security
audit (see below).
6.4.4. Cryptography
In this paragraph, cryptographic security services will be considered,
more precisely, basic information that helps to form a general idea of
computer cryptography and its place in the general architecture of
information systems.
Cryptography is required to implement at least three security services:
• encryption;
• integrity control;
• authentication (this service was discussed earlier).
Encryption
Encryption is the most powerful means of ensuring confidentiality. In
many respects, it occupies a central place among software and hardware
security regulators, being the basis for the implementation of many of them,
and at the same time the last (and sometimes the only) line of defense. For
example, for laptop computers, only encryption can ensure data
confidentiality even in the event of theft.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]