Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
81
Fig. 3.4 “protection database” means an object containing information
about flows of set L (whitelist protection — permissions for flows) or N
(blacklist protection — prohibition for flows).
Fig. 3.4. Classic security kernel model
To take into account the influence of subjects in the DCS, it is
necessary to consider an expanded scheme of interaction between elements
of the system of implementation and guaranteeing food security.
Figure 3.5 emphasizes the role of the subject security monitor when
generating subjects from objects. The interaction of subjects and objects
when generating threads is clarified by the introduction of objects associated
with the subject. The design of the op-amp in the diagram denotes a control
object, i.e., an object containing information about the allowed values of the
Stream display (about the elements of the set L or N) and Create (the
elements of the set E). A control object can be associated (associated data
object) with both the OSM and the SSM.
Let’s move on to a description of practical methods for constructing
an ISE. The purpose of considering practical approaches is to illustrate the
thesis that sufficient conditions for guaranteed security can be practically
met in real AS.
82
Fig. 3.5. Security kernel with subject generation control in mind
Based on Statement 3 (the basic theorem of the ISE), formulated and
proven in the previous part, we will describe the method of subject-object
interaction within the framework of the ISE for a more specific architecture
of the AS.
From statement 3 it follows that to create a guaranteed protected AS
(in the sense of implementing a given security policy) it is necessary:
1. Make sure that the subjects closed in the ISE are pairwise correct
(or make sure that any subject is correct in relation to the OSM and SSM).
2. Design and implement software (or software and hardware) SSM
so that:
• for any subject and any object, the generation of subjects was
controlled (that is, so that the implementation of the SSM corresponds to its
definition);
• the generation of any subject occurred with control of the
immutability of the source object.
83
3. Implement OSM within the framework of an a priori formulated
security policy.
It should be noted that the above statements are true only when the
described and implemented security policy does not violate their conditions
(verification of this fact depends on the security model and is a separate,
very important task).
In addition, you need to pay attention to the following. The control
object, which is the associated SSM object (usually the associated data
object), plays a decisive role in the design of the information system. If it is
possible to change the state of a control object, it is potentially possible to
“unlock” the software environment, i.e., add to the set of allowed subjects
additional ones that implement malicious functions. On the other hand, the
security management process implies the possibility of changing the control
object (more details in Part 3). The ability to change the control object
(implementation of the Stream stream (control subject, ‘associated object’
objects of the control subject) -> control object) must be present for selected
subjects (possibly with an additional condition for activating this subject by
the selected user (users)).
An important role in the design of information systems is played by
the property of the digital network, which consists in the gradual activation
of subjects from objects of different levels of information presentation. Let’s
look at the Table 3.1 hierarchy of levels when loading the operating system.
In the table, the term “sector” is highlighted to denote the
representation of a hardware-software level object. It denotes a continuous
sequence of storage elements (bytes) on a physical medium, characterized
by location.
The term “file” denotes an abstract object built using a list structure of
“sector” objects. Objects of the “file” and “sector” types are selected solely
on the basis of the typical architecture of DCS objects.
In the general case, we can talk about a recursive structure of objects
of a certain level that contains objects of the previous level. At the zero level,
the primary object (the elementary structure of the lower level) in Table 3.1
corresponds to the term “sector”.
84
Table 3.1
Hierarchy of levels when loading the OS
Level
Subject
Localization
Presentation
of information
Through what
functions
are threads
implemented?
0
Subject of hardware-
software level
ROM
sectors
via ROM firmware
1
Primary level subject
OS
bootloader
sectors
via Bios or
primary bootloader
2
Downloads
OS drivers
sectors
via Bios or
primary bootloader
3
Secondary loader level
entity (driver)
OS kernel
files
via drivers
4
OS level subject
Applications
files
via the OS kernel
Taking into account the hierarchical structure of the representation of
objects, we can say that in the initial stages of activation of the central
nervous system, the decomposition into subjects and objects changes
dynamically. Consequently, the main theorem of ISE can be applied only at
certain time intervals, when the level of representation of objects is constant
and the decomposition is fixed. It can be argued that the ISE, which operates
from the moment of activation until the end of the operation of the central
nervous system, cannot be formed at the initial moment of activation of the
central nervous system.
Let the DCS allocate a finite number of levels of object representation
U = {0, ..., R}, R is the maximum level of object representation.
From the point of view of fulfilling the conditions of Statement 3, it
would make sense to talk about some “stationary” state of the DCS, when
only objects of level R participate in the mappings Stream and Create. Then
85
the implementation of the SSM can be significantly simplified (in the sense
that all arguments-objects of the Create operation have the same level). It is
necessary to pay attention to the fact that such a requirement can, on the one
hand, impose restrictive conditions on the properties of application software
(the impossibility of initiating flows that include objects of a level less than
R by application programs), and on the other hand, be a consequence of
design decisions for the implementation of a subject localized in the
operating system kernel (an example is Windows NT 4.0, which prohibits
operations below the “file” level by application-level entities).
The practical implementation of all operating systems allows us to
distinguish two phases of their work: activation of subjects with an increase
in the level of object representation (loading phase or initial phase) and a
stationary state phase (when the level of object representation does not
increase). Of course, it is necessary to make a reservation regarding the
possibility of implementing threads to lower-level objects (operating
systems such as DOS, in which it is possible to operate with any lower-level
object (sector) from application-level programs).
Then the practical implementation of the ISE can consist of two stages:
the predetermined execution of the initial phase, which includes the moment
of activation of the SSM (and OSM), and work in the stationary phase in the
ISE mode (possibly with control of the immutability of source objects).
Let us introduce the concept of the sequence of activation of DCS
components. The meaning of the concepts introduced and the statements
formulated below is the need to bring the subjects of the DCS to the same
state after the activation of the primary subject of the hardware-software
level, or, in other words, to set a predetermined sequence of activation of
the subjects of the DCS.
Let us denote: ZL is a sequence of pairs (i, j)t (t = 0, 1, 2, …, 1-l are
moments of time) of length 1, such that Create (Si,Оj)[1]->Sm[t +1].
We also denote: Sz — the set of all subjects included in the sequence
ZL; Oz is the set of all objects included in the sequence ZL.
For multi-threaded systems, several (possibly dependent on each
other) sequences ZL and, accordingly, sets Sz and Oz can be considered.
86
Definition 17. The state of the AS at time t is an ordered set of states
of subjects.
Statement 4 (condition for the same state of the AC).
The state of the AS at times txl and tx2 (txl and tx2 are calculated for
two segments of AS activity from the zero moment of activation of the AS
to1 and to2 — for example, turning on the power supply to the hardware) is
the same if:
1) txl = tx2;
2) the subjects Si[tol] and Si[to2] are identical;
3) all objects from the set Oz are unchanged;
4) the sequence ZL is unchanged.
Proof (based on the principle of mathematical induction).
The truth of the statement at t = 1 follows from the definition of the
identity of subjects.
Let the statement be true for t = k < l.
Then at the moment of time k + 1 only identical subjects can be
generated, since the activating subjects are identical (by the induction
assumption) and by the condition of the statement the elements of the set Oz
are unchanged. The length of 1 sequence ZL is determined by:
1. Based on the impossibility of managing subjects belonging to the
set Sz on the part of the user (otherwise the sequence of activation of
subjects can be changed).
2. Based on the availability to control the immutability of all objects
from the set Oz.
3. Based on the non-increasing level of information presentation (in
this case, it is meant that there is a moment in time tx such that for any
t > tx, the object-argument Oj of the operation Stream(Si, Oj) belongs to the
same level of presentation).
It should be noted that the ZL sequence is localized in a certain object
or set of objects (for example, for DOS, the sequence of activation of
subjects is predetermined by the contents of the AUTOEXEC.BAT and
CONFIG.SYS files) and the immutability of the ZL sequence is identical to
the immutability of the specified objects; for Windows NT, the sequence of
87
activation of components is determined by the content corresponding
registry keys.
Suppose that in the sequence ZL it is possible to select zi such that for
any Zk, k > i, the Create and Stream mappings use only objects of level R.
In other words, from time moment i the stationary phase of the AS operation
begins.
Under these conditions, as well as with pairwise correctness of
subjects and the action of SSM with control of the immutability of source
objects at the level R from time moment m > k, it is true.
Statement 5 (sufficient condition for ISE under stepwise loading).
Provided that ZL is immutable and objects from Oz to AS are
immutable, an isolated software environment operates from the moment the
immutability of ZL and Oz is established.
Proof. It should be noted that all conditions of statement 5 correspond
to statement 4. The clarifications concern the structure of the sequence ZL.
According to Statement 4, from time tо to time t = l, an isolated
(within) Sz software environment operates.
To prove a statement, you need to make sure that:
• SSM at time t = m is guaranteed to be activated;
• at any moment t > m the software environment is isolated.
The first follows from Statement 4 (at t = 1, the state of the software
environment will always be the same, therefore, the SSM subject will
always be activated). The second follows from the definition of SSM and
the conditions of the theorem.
From time t = 0 to time 1, the software environment is isolated, from
time t > m, the software environment is also isolated, therefore, the DSS is
isolated for any t > 0. The statement is proven.
Using statements 3, 4 and 5, we will consider the process of practical
design of a secure fragment of a digital network.
Initially, it is necessary to ensure that the conditions of correctness or
absolute correctness are met for the subjects participating in the generation
of the ISE. These subjects can mainly be localized at the level of the
computer hardware and software components (ROM programs, operating
88
environment loaders), i.e., work at a level close to interaction with the DCS
equipment, or at the level of the operating environment. Proving the
correctness of hardware-software-level entities is significantly different
from the corresponding proofs for application-level entities. In this regard,
we will highlight the verification of the conditions for the correctness of
subjects in two steps. Step 1 is the proof of the correctness of subjects at the
software and hardware level. The concept of a module denotes the
implementation of a source object, and the totality of a subject generated
from a source object and the entire set of objects associated with this subject
throughout the entire existence of the subject is usually called a process (or
task).
Next, it is necessary to determine the composition of the software of
the basic computing environment, i.e., determine the specific operating
environment, additional service software (for example, software shells or
telecommunications tools) and software to support additional equipment
(printer control programs, etc.). After this comes the most time-consuming
stage (Step 2), at which it is necessary to ensure that the subjects of the
described basic set of software tools are correct. It is important to note the
following.
The DCS software should not contain a whole class of capabilities —
let’s call them instrumental. First of all, this is the possibility of changing
the state of associated objects on the part of the subject (for example,
changing the contents of RAM) of other subjects (changing the content
implies the existence of Stream operations of the write type), the possibility
of initiating and stopping the execution of processes in a non-standard way
(in addition to the mechanisms of the operating environment). In addition,
when implementing SSM and OSM in the stationary phase of the operation
of the DCS, it is necessary that in any subjects closed in the ISE there are
no operations for generating Stream flows to objects of level k < R.
Generally sufficient conditions for a basic set of software can be
formulated as follows.
Statement 6 (requirements for the subject content of the isolated
software environment).
89
In order for the ISE to be maintained throughout the entire period of
activity of the DCS, it is sufficient that the software that can be initiated in
the ISE does not contain functions for generating subjects and terminating
their work, except for those predetermined during the implementation of the
SSM, and there are no possibilities of influencing the environment execution
(the runtime environment is understood as a set of associated objects) of any
process, as well as the initiation of threads to objects of a logical level less
than R.
Let us clarify the requirement that it is impossible to terminate the
execution of a subject in any other way than the predetermined one. In this
case, it is necessary to take into account that in the multitude of subjects
closed in the ISE, two special subjects are identified — SSM and OSM. The
cessation of the existence of the SSM means a violation of the condition of
closed environment, and the cessation of the existence of the SSM means
the admissibility of flows of the set N, i.e., unauthorized access.
Step 3 is to design and develop software or hardware-software
protection systems in the AS, and then test them. It involves the design and
implementation in a given set of subjects of interbank business systems and
international financial institutions.
Step 4 is to “lock” the entire software complex, including security
tools, into an isolated software environment.
So, it is shown that the main elements of maintaining the isolation of
the software environment are integrity control and process generation
control.
Above, we have already formulated the concepts of SSM and the
generation of subjects with control of their immutability. It should be noted
that for reliable control of the immutability of an object (i.e., with a
probability of error equal to 0), it is necessary to ensure the complete identity
of the tested object and the sample. The standard must contain no less
information than the object being tested. The reference object must be at
least the same length as the one being tested. In practice, this approach can
be applied with serious restrictions (for example, for small objects such as
ROM programs or OS boot loaders).
90
In this regard, to monitor integrity, objects are used that contain
information that depends on the entire contents of the object, but
nevertheless of a significantly smaller volume, calculated using a class of
functions such as “hash functions”. Obviously, in this case the process of
establishing the immutability of an object becomes probabilistic.
Based on this fact, it is impossible to talk about guaranteed
(deterministic) properties of the system (since the immutability of an object
is guaranteed only with a certain probability not equal to 1). Consequently,
all the conditions of the statements are satisfied with a certain probability,
depending on the properties of the hash functions used to control the
integrity. To emphasize the changed conditions, we will speak further not
about the control of the immutability of the object, but about the control of
the integrity (CI) of the object.
It should also be noted that at least two objects are involved in the
immutability control procedure (which now takes on a probabilistic nature):
the control object and the reference object (hash value), as well as the subject
that implements the hash function and makes the comparison.
Therefore, for the subject of integrity control, it is important to fulfill
the following conditions:
1) high-quality integrity control algorithm (the term “quality” will be
explained below);
2) control of real data (i.e., mapping the state of the controlled and
reference volumes into associated data objects of the subject of integrity
control, coinciding with the identical one).
Let us explain the second point in more detail. Integrity control is
always associated with data reading (i.e., with the initiation of streams from
objects to associated data objects of the subject of integrity control, and the
streams can correspond to different levels of information presentation —
reading by sector, by file, etc.). For example, a subject built into the BIOS
of a PC (practically it is a software bookmark — see below) can impose
another sector instead of one sector when reading, or directly edit the buffer
into which the data was read. A similar effect can be caused by entities in
the operating environment, such as entities located in OS boot loaders. On
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]