Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
71
Definition 6. Objects Oi and Oj are identical at time t if they coincide
as words written in the same language.
For example, when represented as byte sequences, objects O1 = (O11,
O12, ..., O1m) and O2 = (O21, O22, ..., O2k) are the same if m = k and
O1i = O2i for all i from 1 to k (Oij-bytes).
To introduce the concept of identity of subjects, we will agree on the
existence of a procedure for sorting associated objects, which allows us to
talk about the possibility of pairwise comparison. In practice, there is always
an algorithm that provides the possibility of pairwise comparison and
depends on the specific architecture of the AS. For example, it is quite easy
to select and compare in pairs, for example, sections of active memory
corresponding to program code (differing in the absolute address of loading
into RAM) or the contents of valuable data arrays.
Definition 7. Subjects Si and Sj are identical at the moment of time,
and all objects associated with them are pairwise identical.
Corollary (of Definitions 6 and 7). Generated subjects are identical if
generating subjects and source objects are identical.
The correctness of this corollary follows from the identity of
functionally associated objects in the generating subjects, which are
responsible for the generation of a new subject, as well as from the identity
of the arguments (associated data objects) that correspond to the source
objects.
To divide the entire set of flows in the AS into subsets L, the existence
of an active component (subject) is necessary, which:
• would be activated when any flow occurs;
• would filter streams in accordance with their membership in sets
L or N.
Note that if Stream (Si, Оj)->Оm exists and Stream (Sk, Оm)->Оi
exists, then Stream ((Si, Sk), Оj)->Оi also exists, i.e. the relation “there is a
flow between objects” is transitive (relative to a pair of subjects). It is in this
sense that we will talk about the participation of the subject (Sk) in the flow
(if Om is the associated object of the subject, not identical to Si). Let us
introduce several definitions.
72
Definition 8. Call monitor (CM) is a subject that is activated when a
flow occurs from any subject to any object.
Two types of CM can be distinguished:
1. Indicative CM — establishing only the fact of access to the object.
CM is a subject that functions in such a way that when a flow occurs
from the associated object Om Si (Si(Om)) to the object Oj and back, there
is an object 0m0 associated with the MO (in this case we are talking about
associated data objects), identical to the From object or Si(Оm).
2. A meaningful CM fully participates in the flow from subject to
object (in the sense that information passes through its associated data
objects and there is an identical mapping of the object to some associated
CM object).
Now let’s formulate the concept of a security monitor (the concept of
a link monitor is also used in the literature). This concept is related to the
stream filtering problem mentioned above. Since the goal is to ensure the
safety of the AS, the target function of the monitor is filtering to ensure
safety (we note again that the division into N and L is specified a priori).
Definition 9. An object security monitor (OSM) is an access monitor
that allows a flow that belongs only to the legal access set L. In this case,
allowing a flow is understood as performing an operation on the object that
is the recipient of the flow, and prohibiting it as non-execution (i.e.,
immutability object — the recipient of the stream).
The object security monitor is actually a mechanism for implementing
security policy in the AS. Let us now turn to the main models of OSM
operation [1].
3.3. MAIN TYPES OF FORMAL SECURITY POLICIES
There are two types of security policies: discretionary and mandatory.
The basis of discretionary (discrete) security policy is discretionary
access control (DAC), which is determined by two properties:
1) all subjects and objects must be identified;
2) the subject’s access rights to the system object are determined on
the basis of some rule external to the system.
73
The advantages of a discretionary security policy include the relatively
simple implementation of appropriate protection mechanisms. This is due
to the fact that most of the currently widespread DCS ensure compliance
with the provisions of this particular security policy.
As an example of the implementation of a discretionary security policy
in an AS, one can cite an access matrix, the rows of which correspond to the
subjects of the system, and the columns to objects; matrix elements
characterize access rights. The disadvantages include the static nature of the
model. This means that this security policy does not take into account the
dynamics of changes in the state of the digital network and does not impose
restrictions on the state of the system.
In addition, when using a discretionary security policy, the question
arises of determining the rules for distributing access rights and analyzing
their impact on the security of the DCS. In the general case, when using this
security policy, the SMO, which, when authorizing a subject's access to an
object, is guided by a certain set of rules, faces an algorithmically insoluble
task: to check whether its actions will lead to a security violation or not.
At the same time, there are DCS models that implement discretionary
security policies and provide security verification algorithms.
One way or another, the access matrix is not the mechanism that would
allow the implementation of a clear and precise information security system
in the data center. This motivates the search for other, more advanced
security policies.
The basis of the mandatory (authoritative) security policy is
Mandatory Access Control (MAC), which implies that:
• all subjects and objects of the system must be uniquely identified;
• a linearly ordered set of security labels is specified;
• each system object is assigned a security label that determines the
value of the information it contains — its security level in the DCS;
• each subject of the system is assigned a security label that determines
the level of trust in him in the DCS — the maximum value of the security
label of objects to which the subject has access. A subject’s security label is
called its access level.
74
The main goal of a mandatory security policy is to prevent information
leakage from objects with a high level of access to objects with a low level
of access, i.e., to counter the emergence of top-down information channels
in the DCS.
Most often, the mandatory security policy is described in terms,
concepts and definitions of the properties of the Bell — LaPaluda model,
which will be discussed below. Within the framework of this model, an
important statement is proved, indicating the fundamental difference
between systems that implement mandatory protection and systems with
discretionary protection: if the initial state of the system is safe and all
transitions of the system from state to state do not violate the restrictions
formulated by the security policy, then any state of the system is safe.
In addition, compared to digital security systems built on the basis of
a discretionary security policy, systems implementing a mandatory policy
are characterized by a higher degree of reliability. This is due to the fact that
the SMO of such a system must monitor not only the rules of access of
system subjects to objects, but also the state of the DCS itself. Thus, leakage
channels in systems of this type are not directly incorporated into it (which
we observe in the provisions of the previous security policy), but can only
appear during the practical implementation of the system due to developer
errors. In addition to this, the rules of the mandatory security policy are
clearer and easier to understand by developers and users of the DCS, which
is also a factor that has a positive effect on the level of system security. On
the other hand, the implementation of systems with a security policy of this
type is quite complex and requires significant computing system resources.
3.4. DEVELOPMENT AND IMPLEMENTATION
OF FORMAL SECURITY POLICIES
It seems obvious that when changing the objects functionally
associated with the subject of the security policy implementation (SPI)
(Fig. 3.3.), the properties of the SPI itself, which consist in filtering flows,
may also change, and, as a consequence, flows belonging to the set N may
arise. In this regard, let us introduce the concept of correctness of subjects [1].
75
Fig. 3.3. Possible ways of violating the security policy
Definition 10. A pair of subjects Si and Sj are called not influencing
each other (or correct relative to each other) if at any moment of time there
is no flow (changing the state of the object) between the associated object
of the subject Si(Osi) and Sj(Osj), and Osj is not an associated object of Si,
and Osi is not an associated object of Sj.
Let us give some explanations to the definition: “change in the state of
an object” is interpreted in this definition as the non-identity of objects at
the appropriate moments in time, but it is emphasized that the operation of
changing an object is localized in a subject with which this object is not
associated. The meaning of the concept of correctness can be explained with
an example: programs existing in a single RAM space should not have the
functionality to change a “foreign” code vector and the state of variables.
Generally speaking, a more rigid definition can be formulated.
Definition 11. A pair of subjects Si and Sj are said to have absolutely
no influence on each other (or absolutely correct relative to each other) if,
under the conditions of Definition 10, the sets of associated objects of the
specified subjects do not intersect.
Absolute correctness is easily achievable in the case of a virtual
address space.
The definition of absolute correctness allows us to formulate sufficient
conditions for guaranteed implementation of only legal access.
76
Statement 1 (a sufficient condition for guaranteed implementation of
the security policy in AS 1).
The object security monitor allows the generation of threads only from
the set L if all subjects existing in the system are absolutely correct with
respect to it and each other.
Proof. The condition of absolute correctness (of definition 11) assumes
the immutability of functionally associated OSM objects (since there are no
threads that change associated OSM objects). On the other hand, such flows
can appear when associated objects belonging to other subjects of the digital
network change (the properties of the subject will change, including
(possibly) the generation of flows to the OSM). The condition of correctness
of subjects relative to each other makes this impossible (by definition of
absolute correctness). This, in turn, means that the OSM implements only
flows from the subset L. The statement is proven.
However, the formulated statement imposes very strict and difficult to
fulfill conditions on the properties of subjects in the DCS. In addition, it is
impossible to guarantee the correctness of any entity activated in the DCS
with respect to the OSM. In this regard, it is logical to limit the set of
generated subjects that are a priori correct with respect to OSM. In this
regard, we will introduce the definition of a subject creation monitor (by
analogy with the access monitor) and a subject security monitor.
Definition 12. Subject generation monitor (SGM) is a subject that is
activated during any generation of subjects.
By analogy with the transition from CM to OSM, we will introduce
the concept of a security monitor for subjects.
Definition 13. Subject Security Monitor (SSM) is a subject that
allows the generation of subjects only for a fixed subset of pairs of activating
subjects and generating objects.
The impact of the SSM identifies a subset of allowed E in the entire
set of subjects S. Note also that if the subject of the SSM is included in the
subset of subjects at time t, then the first argument of the Create operation
can only be a subject included in the set of subjects, and the argument is an
object, generally speaking, anyone.
77
Let us now formulate a number of basic definitions that will be widely
used in the future.
Definition 14. An AS is called closed in the generation of subjects if
it has an SSM that allows the generation of only a fixed finite subset of
subjects for any source objects considered for a fixed decomposition of the
AS into subjects and objects.
When considering the implementation of secure environments, the
term “closed software environment” will be used, which is essentially
equivalent to the above definition.
However, the closedness of the AS in generating subjects is not
enough to describe the properties of the system in terms of security, since it
is necessary to ensure the correctness of the subjects generated by the SSM
relative to itself and the OSM. The mechanism of a closed software
environment reduces the set of possible subjects to a certain set of fixed
power, but at the same time allows the existence of incorrect subjects
included in the closed environment.
Let us formulate a definition of the isolation of a DCS.
Definition 15. A set of subjects of an AS is called isolated (absolutely
isolated) if an SSM operates in it and the subjects from the generated set are
correct (absolutely correct) relative to each other and the SSM.
Consequence. Any subset of subjects of an isolated (absolutely
isolated AS), including SSM, also constitutes an isolated (absolutely
isolated) environment.
Consequence. The addition of an isolated (absolutely isolated) DCS
with a subject that is correct (absolutely correct) relative to any of those
included in the isolated (absolutely isolated) environment leaves it isolated
(absolutely isolated).
It is now possible to reformulate the sufficient condition for
guaranteed execution of a security policy as follows.
Statement 2 (a sufficient condition for guaranteed implementation of
the security policy in DCS 2).
If in an absolutely isolated DCS there is an OSM and the generated
subjects are absolutely correct with respect to the OSM, and the SSM is
78
absolutely correct with respect to the OSM, then only the access described
in the DRP is implemented in such a DSS. Proof. From the definition of
absolute isolation it follows that there is only a finite set of subjects in the
CSS, which, in turn, are correct with respect to the SSM (by Definition 16
and its corollary).
Further, according to the condition of the statement (the correctness of
the OSM with respect to any of the generated subjects and the SSM),
associated objects can only be changed by the OSM itself, therefore, only
flows belonging to the set L are implemented in the DCS. The statement is
proven.
It is easy to see that this statement is more constructive with respect to
the previous sufficient condition for guaranteed security, since previously
the correctness of the OSM was required with respect to an arbitrary subject,
which is practically impossible. In this case, the set of subjects is limited
due to the use of the SSM mechanism and it is possible to verify the pairwise
correctness of the generated subjects.
When considering the technical implementation of isolation of
subjects in a DCS, the term “isolated software environment” (ISE) will be
used, which describes the mechanism for implementing isolation for a
specific software and hardware implementation of a DCS and with a
corresponding decomposition into subjects and objects.
When considering the operation of generating a subject, a very
important problem arises related to the fact that in real digital digital
systems, identically named objects can have different states in space (for
example, be placed in different directories) or in time.
Let us assume that the state of the object Om is recorded at some point
in time t. We will denote the state of the object Om at time t as Om[t].
Definition 16. The operation of generating a subject Create
(Sk, Om)-> Si is called generation with control of object immutability if
for any moment of time t > to, at which the operation of generating an object
Create is activated, the generation of a subject Si is possible only if the
objects Om[to] and Оm[t].
79
Consequence. Under the conditions of Definition 16, the generated
subjects Si[t1]H and Si[t2] are identical if t1 > to and t2 > to. When t1 = t2
the same subject is generated.
When generating subjects with control of the immutability of an object
in the AS, flows from subjects to source objects participating in the
generation of subjects are allowed, with a change in their state.
Statement 3 (basic ISE theorem).
If at the moment of time to in an isolated DCS there is only the
generation of subjects with control of the immutability of the object and
there are flows from any subject to any object that do not contradict the
condition of correctness (absolute correctness) of subjects, then at any
moment of time t > to the DCS also remains isolated (absolutely isolated).
Proof. According to the condition of the statement in the DCS, the
existence of threads that change the state of objects that are not associated
at this point in time with any subject is possible. If an object with a changed
state is not a source for generating a subject, then the set of subjects of the
isolated environment is non-expandable, otherwise (the modified object is a
source for generating a subject), according to the conditions of the statement
(creating a subject with control), generating a subject is impossible.
Consequently, the power of a set of subjects cannot exceed that which was
fixed before the state of any object changed. According to the corollary of
Definition 16 (about the closedness of the set of subjects in an information
system with the power of the set of subjects not increasing), we obtain that
the set of subjects of the DCS is isolated. The statement has been proven.
It is possible to formulate a methodology for designing guaranteed
secure DCS. The essence of this methodology is that when designing
protective mechanisms of a DCS, it is necessary to rely on the set of
sufficient conditions given above (statements 1–3) that must be
implemented for subjects, which guarantees the protective properties
defined during the implementation of OSM in the DCS (i.e. guaranteed
implementation of the security policy specified by the OSM).
The considered concept of an isolated software environment is an
extension of foreign approaches to the implementation of the security
kernel [1].
80
A security core is a special component of a security mechanism that
occupies a position external to other mechanisms and is designed to solve
the problems of the overall organization of information security and control
the operation of other components of security mechanisms. According to
this purpose, special requirements are imposed on the core, and special
approaches are formulated for its creation. Generally speaking, the idea of
centralizing some of the most critical information security procedures, and
especially procedures for managing security mechanisms, is not new: this
idea is already more than two decades old. True, initially the security kernel
was presented as a certain set of programs that performed special protection
functions and was organized especially carefully. Therefore, the concept of
the security core has evolved both in terms of expanding the functions
performed and in terms of the completeness of approaches to its
construction. The security core is considered as the central component of
the protection system and directly performs a number of important
protection functions, such as control, registration, destruction, alarm, etc.
The essence of these functions in the most general form is as follows.
Control means a systematic check of the condition and performance of all
information security tools and mechanisms available in the automated
system. Registration in modern information security systems is understood
as a set of tools and methods designed for regular collection, recording,
processing and issuing information about the functioning of security
mechanisms, including maintaining logs of access to protected data and
programs. Destruction in security systems means the timely destruction of
all those data and programs that are no longer needed for the further
operation of the system, but the preservation of which may cause
unauthorized acquisition of information or facilitate such acquisition. This
clearly shows the importance of this function. Alarm means solving a
number of problems: warning users about the need to comply with
protective measures, informing the security service about a failure or
violation or attempted violation of security, etc.
Typically, the security kernel operating model is depicted as the
following diagram, shown in Fig. 3.4 [1].
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]