Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
61
3) calculation of risks and determination of a scheme for reducing
them to an acceptable value.
All other parts of the system, as well as its customer, rely on the fact
that the TCB correctly implements the specified security policy, even if
individual modules or subsystems of the system are developed by highly
skilled attackers in order to interfere with the functioning of the TCB and
violate the security policy it supports.
The minimum set of components that make up a trusted computing
environment provides the following functionality:
• interaction with DСS hardware;
• memory protection;
• file I/O functions;
• process management.
Addition and modernization of existing DCS components taking into
account security requirements can lead to complication of maintenance and
documentation processes. On the other hand, the implementation of all of
the listed functionality within a centralized trusted computing environment
in full can cause an increase in the size of the TCB and, as a result,
complicate the proof of the correctness of the implementation of the security
policy. Thus, operations with files can be implemented in the TCB to a
certain limited extent, sufficient to support the security policy, and extended
I/O in this case is implemented in that part of the DCS that is located outside
the TCB. In addition, the need to implement security-related functions in
many DCS components implemented in different DCS modules leads to the
fact that security functions are distributed throughout the DCS, causing a
similar problem.
The following stages of development of a secure DCS are defined:
1) determination of security policy;
2) designing a DCS model;
3) development of the DCS code;
4) providing guarantees of compliance of the implementation of the
given policy.
62
CHAPTER 3. FORMAL SECURITY POLICIES1
3.1. THE CONCEPT OF FORMAL SECURITY POLICY [2]
Considering issues of information security in computer systems, we
can talk about the presence of some “desirable” states of these systems.
These desired states (described in terms of a model of the computer system
itself, for example in terms of a subject-object model) describe the
“security” of the system. The concept of “security” is not fundamentally
different from any other properties of a technical system, for example,
“reliable operation”, and is external to the system, given a priori. A
peculiarity of the concept of “security” is its close connection with the
concepts of “attacker” (as a designation of an external reason for removing
the system from the state of “security”) or “threat” (a concept that
depersonalizes the reason for removing the system from the protected state
due to the actions of an attacker).
When considering the concept of “attacker,” the object of his influence
is almost always identified — the part of the system associated with certain
actions of the attacker (“object of attack”). Therefore, there are three
components associated with a system security breach:
1) “attacker” — a source of violation of the “security” property
external to the system;
2) “object of attack” — a part belonging to the system that is affected
by the attacker;
3) “channel of influence” — a medium for the transfer of malicious
influence.
An integral characteristic that describes the properties of the protected
system is the security policy — a qualitative (or qualitative-quantitative)
description of the security properties, expressed in terms that describe the
system. The security policy description may include or take into account the
properties of the attacker and the attack target.
1
All figures in this chapter are taken from « Защита информации в цифровых системах
связи».
63
The security policy description includes:
1. Many possible operations on objects.
2. For each “subject-object” pair (Si,Оj) — the assignment of a set of
allowed operations, which is a subset of the entire set of possible operations.
Operations are usually associated with the target function of the protected
system (i.e., with a category that describes the purpose of the system and the
tasks being solved), for example, the operations “creating an object”,
“deleting an object”, “transferring information from an arbitrary object to a
predefined one — reading”, etc.
Two axioms of secure computer systems (DCS) can be formulated:
Axiom 1. In a protected AS there is always an active component
(subject) that controls the operations of subjects over objects. This
component is actually responsible for implementing some security policy.
Axiom 2. To perform operations on objects in a protected data center,
additional information (and the presence of an object containing it) is
required about permitted and prohibited operations of subjects with objects.
In this case, we operate with the qualitative concepts of “control”,
“permitted and prohibited operation”, these concepts will be disclosed and
illustrated below.
There is an additional axiom.
Axiom 3. All information security issues are described by subject
access to objects.
It is important to note that a security policy generally describes a nonstationary state of security. The protected system can be changed and
supplemented with new components (subjects, objects, operations of
subjects on objects). Obviously, the security policy must be maintained over
time; therefore, security management procedures must be added to the
process of studying the properties of the protected system.
On the other hand, the non-stationarity of the protected DCS, as well
as issues of implementing security policy in specific designs of the protected
system (for example, programming the controlling subject in commands of
a specific computer processor) predetermine the need to consider the
problem of guaranteeing a given security policy.
64
As a result, we can say that computer security solves three classes of
interrelated problems:
1) formulation and study of security policies;
2) implementation of security policies;
3) guaranteeing a given security policy.
A typical life cycle of an AS consists of the following stages:
1. Design of AS and design of security policy.
2. Security modeling and analysis of the correctness of the security
system, including establishing the adequacy of the security policy and the
target function of the system.
3. Implementation of industrial safety and mechanisms for its
guarantee, as well as procedures and mechanisms for safety management.
4. Operation of a secure system.
Let us consider in detail the approaches to solving the problems.
3.2. CONCEPT OF ACCESS AND SECURITY MONITOR
In the theory of computer security, a model of an arbitrary AS is almost
always considered in the form of a finite set of elements. This set can be
divided into two subsets: a set of objects and a set of subjects. This division
is based on the property of the element “being active” or “receiving control”
(the terms “using resources” or “using computing power” are also used). It
historically developed on the basis of a computer system model belonging
to von Neumann, according to which a sequence of executable instructions
(a program corresponding to the concept of “subject”) is located in a single
environment with data (corresponding to the concept of “object”).
Models associated with the implementation of security policy (SP) do
not take into account the ability of subjects to change the AS, which can
lead to a change in its properties and, as an extreme case, to the complete
inapplicability of a particular model to the description of the “subjectobject” relationship in the changed DCS.
This fact is not a flaw in the security policy. The reliability of the
mechanisms for implementing the security policy is considered a priori,
65
since otherwise formalization and analysis of the models are impossible.
However, the issue of security policy guarantees is key both in theory and
in practice. Considering the active role of subjects in the central social
network, it is necessary to mention a number of their most important
properties, on which the model presented below is based.
Firstly, it should be noted that the human user perceives objects and
receives information about the state of the central nervous system through
the subjects that he controls and which display information in a humanperceivable form.
Secondly, threats to the components of the digital network (the digital
network is considered in the model of flows or states that come from
subjects as an active component that generates flows and changes the state
of objects in the digital network).
Thirdly, subjects can influence each other through objects they change
that are associated with other subjects, ultimately giving rise to subjects (or
system states) in the system that pose a threat to the security of information
or to the performance of the system itself.
We will consider the division of the DCS into subjects and objects a
priori. We will also assume that there is an a priori error-free criterion for
distinguishing subjects and objects in the DCS (based on the property of
activity). In addition, we assume in the conditions of all statements that the
decomposition of the DCS into subjects and objects is fixed.
Let us emphasize the difference between the concept of a subject of a
computer system and a human user with the following definition.
User is a person (individual) authenticated by some information and
controlling the subject of a computer system through computer controls. The
user of the DCS is, therefore, an external factor that controls the state of the
subjects. In this regard, we will further consider the user control action to be
such that the properties of the subjects formulated in the definitions below
do not depend on it (i.e., the properties of the subjects are not changeable by
external control). The meaning of this condition is the assumption of the fact
that the user who controls the program cannot change its properties through
66
the controls (the condition is not true for systems such as compilers,
development tools, debuggers, etc.).
We will also assume that at any discrete moment in time the set of
subjects of the AC is not empty (otherwise the corresponding moments of
time are excluded from consideration and segments with non-zero
cardinality of the set of subjects are considered).
Axiom 4. Subjects in an AS can be generated only by the active
component (subjects) from objects.
We specify the mechanism for generating new subjects with the
following definition.
Definition 1. An object Oi is called a source for a subject Sm if there
is a subject Sj, as a result of whose influence on the object Oi a subject Sm
appears in the computer system.
The subject Sj, generating a new subject from the object Oi, in turn, is
called the activating subject for the subject Sm, Sm will be called the
generated object.
Let’s introduce the notation: Create (Sj, Oi) > Sk — object Sk is
generated from object Oi under the activating influence of subject Sj. Let’s
call Create the operation of generating subjects (Fig. 3.1).
Fig. 3.1. Generations of the subject and the concept of flow
67
The Create operation specifies the mapping of the Cartesian product
of sets of subjects and objects onto the union of a set of subjects by an empty
set. Note also that discrete time operates in the AS and, in fact, a new subject
Sk is generated at the moment of time t + 1 relative to the moment t at which
the influence of the generating subject on the source object occurred.
It is obvious that the operation of generating subjects depends both on
the properties of the activating subject and on the content of the source
object.
We believe that if Create (Sj, Oi)-> NULL (the NULL construction
further denotes an empty set), then the generation of a new subject from the
object Oi under the activating influence of Sj is impossible. Thus, in almost
all operating environments there is the concept of an executable file — an
object that can be a source for generating a subject. For example, for MS
DOS, the edit.com file is the source object for generating the text editor
program subject, and the generating subject is, as a rule, the shell command
interpreter (source object ~ command.com). From the von Neumann
architecture it also follows that any subject is associated (or associated) with
some object (objects) that reflects its state, for example, for an active
program (subject), the associated object will be the contents of a section of
RAM with the executable code of this program.
Definition 2. An object Oi at time t is associated with a subject Sm if
the state of the object Oi influenced the state of the subject at the next
moment in time (i.e., the subject Sm uses the information contained in the
object Oi).
Let us introduce the notation “the set of objects {Оm}t is associated
with the subject Si at time t”: Si({Оm}t).
In this case, the definition is not fully formally strict, since the state of
the subject is described by an ordered set of objects associated with it, and
the associated object is distinguished according to the principle of
influencing the state of the subject, i.e., a certain recursion can be traced in
the definition. On the other hand, recursive definitions of various objects
(for example, a tree) are known. Time dependence makes it possible to
unambiguously identify associated objects if at the initial moment the
68
associated object can be uniquely determined (as a rule, this is a vector of
executable code and the initial states of a number of program variables).
In the general case, a subject implements some mapping from a set of
associated objects at the moment of time t to a set of associated objects at
the moment of time t + l. In this regard, we can distinguish associated
objects, the change of which changes the type of display of the associated
objects (objects that, as a rule, contain program code are functionally
associated), and associated data objects (which are an argument to the
operation, but do not change the type of display). Further, associated objects
are understood as functionally associated objects; in other cases,
clarifications are made.
Corollary (of Definition 2). At the moment of generation of the subject
Sm from the object Oi, it is an associated object for the subject Sm.
It should be noted that the source object can be associated with the
activating subject, then the generation is autonomous (i.e., independent of
the properties of other subjects and objects). If the source object is
unassociated (external) for the activating subject, then the generation is not
autonomous and depends on the properties of the source object.
The subject’s property of “being active” is also realized in the ability
to perform actions on objects. It should be noted that the passive status of
an object necessarily requires the existence of information flows from object
to object (otherwise it is impossible to talk about changing objects), and this
flow is initiated by the subject.
Definition 3. The flow of information between the object Om and the
object Oj is an arbitrary operation on the object Oj, implemented in the
subject Si and depending on Om.
Note that both Oj and Om can be associated objects, as well as “empty”
objects (NULL).
Designations: Stream (Si, Оm)-> Oj — flow of information from
object Оm to object Oj. In this case, we will select the source (Om) and the
recipient (receiver) of the flow (Oj). The definition emphasizes that the flow
of information is considered not between the subject and the object, but
between objects, for example, an object and associated objects of the subject
69
or between two objects, and the active role of the subject is expressed in the
implementation of this flow (this means that the operation of generation
(edema) is localized in subject and is reflected by the state of its functionally
associated objects). Note that the Stream operation can create a new object
or destroy it. Fig. 3.2 schematically shows different types of flows.
Fig. 3.2. Examples of flows in AS
Next, for brevity, we will talk about flow, implying the introduced
concept of information flow.
The concept of objects associated with a subject, as can be easily seen
from the following, is not an artificial construction. It is possible to speak
correctly about information flows only between identical entities, i.e.
objects. In addition, the associated objects display the current state of the
subject. The Stream and Create mappings describe, from the point of view
of division into subjects and objects, all events (changes in subjects and
objects) occurring in the DCS.
70
It also follows from this definition that a thread is always initiated
(spawned) by a subject.
Definition 4. The access of a subject Si to an object Oj will be called
the generation of a flow of information between some object (for example,
the objects Si(Om) associated with the subject) and the object Oj.
Let us select the entire set of flows P for a fixed decomposition of the
AS into subjects and objects at all times (the entire set of flows is a union of
flows over all moments of discrete time) and arbitrarily divide it into two
disjoint subsets: N and L, P = N U L.
Let us denote: N — a subset of flows characterizing unauthorized
access; L is a subset of flows characterizing legal access.
Let us give some explanations for the separation of the sets L and N.
The concept of “safety” also implies the presence of a certain state of
“danger” — undesirable states of any system (in this case, a digital
network). We will consider pair categories of the type “dangerous — safe”
to be a priori specified for the DCS and described by the security policy, and
the result of applying the security policy to the DCS is division into a set of
“dangerous” flows N and a set of “safe” L. Division into L and N can be
described as integrity property (flows from N violate the integrity of the
DCS) or confidentiality property (flows from N violate the confidentiality
of the DCS), or any other arbitrary property.
Definition 5. Rules for restricting access of subjects to objects are
formally described flows belonging to the subset L.
In the proposed subject-oriented model, known models of security
policies are not refined (the security policy describes only the criteria for
partitioning into sets L and N), but the conditions for the correct existence
of DCS elements that ensure the implementation of a particular security
policy are formulated. Since the criterion for partitioning into sets L and N
is not associated with the following statements (only the presence of a
subject that implements flow filtering is postulated), we can talk about the
invariance of the subject-oriented model with respect to any security policy
adopted in the DCS (which does not contradict the conditions of the
statements).
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]