Transcript Operating Systems

Operating Systems
软件学院
高海昌
[email protected]
Operating Systems
Contents
 1.
Introduction
**
 2.
Processes and Threads
*******
 3.
Deadlocks
**
 4.
Memory Management
*****
 5.
Input/Output
***
 6.
File Systems
****
 8.
Multiple Processor Systems
*
 9.
Security
**
Gao Haichang , Software School, Xidian University
2
Operating Systems
Chapter 9: Security
 9.1
The security environment
 9.2
Basics of cryptography
 9.3
User authentication
 9.4
Attacks from inside the system
 9.5
Attacks from outside the system
 9.6
Protection mechanisms
 9.7
Trusted systems
Gao Haichang , Software School, Xidian University
3
Operating Systems
Threats
机密性
篡改
Security goals and threats
Gao Haichang , Software School, Xidian University
4
Operating Systems
Intruders
Common Categories
1.
Casual prying (窥探) by nontechnical users
2.
Snooping by insiders
3.
Determined attempt to make money
4.
Commercial or military espionage
Gao Haichang , Software School, Xidian University
5
Operating Systems
Accidental Data Loss
Common Causes
Acts of God
1.
-
fires, floods, wars
Hardware or software errors
2.
-
CPU malfunction, bad disk, program bugs
Human errors
3.
-
data entry, wrong tape mounted
Gao Haichang , Software School, Xidian University
6
Operating Systems
Chapter 9: Security
 9.1
The security environment
 9.2
Basics of cryptography
 9.3
User authentication
 9.4
Attacks from inside the system
 9.5
Attacks from outside the system
 9.6
Protection mechanisms
 9.7
Trusted systems
Gao Haichang , Software School, Xidian University
7
Operating Systems
Basics of Cryptography
Relationship between the plaintext and the ciphertext
Gao Haichang , Software School, Xidian University
8
Operating Systems
Secret-Key Cryptography
 Monoalphabetic substitution 单字符替换
 each
letter replaced by different letter
A B C D E F G……
ATTACK
Q W E R T Y U……
QZZQEA
 Given the encryption key, easy to find decryption key
 Secret-key crypto called symmetric-key crypto
Gao Haichang , Software School, Xidian University
9
Operating Systems
Public-Key Cryptography
Q1: How much is 314159265358979 x 314159265358979 ?
Q2: What is the square root of 3912571506419387090594828508241?
 All users pick a public key/private key pair
 publish
the public key
 private key not published
 Public key is the encryption key, private key is the
decryption key
 RSA, slow than symmetric cryptography
Gao Haichang , Software School, Xidian University
10
Operating Systems
One-Way Functions
 Function such that given formula for f(x)
 easy
to evaluate y = f(x)
 But given y，
 computationally infeasible to
find x
Gao Haichang , Software School, Xidian University
11
Operating Systems
Digital Signatures
(b)
 (a) Computing a signature block
 (b) What the receiver gets
 MD5 16-byte, SHA 20-byte
 E(D(x))=x
Gao Haichang , Software School, Xidian University
12
Operating Systems
Chapter 9: Security
 9.1
The security environment
 9.2
Basics of cryptography
 9.3
User authentication
 9.4
Attacks from inside the system
 9.5
Attacks from outside the system
 9.6
Protection mechanisms
 9.7
Trusted systems
Gao Haichang , Software School, Xidian University
13
Operating Systems
User Authentication
Basic Principles. Authentication must identify:
1.
Something the user knows
2.
Something the user has
3.
Something the user is
This is done before user can use the system
Gao Haichang , Software School, Xidian University
14
Operating Systems
Authentication Using Passwords
(a) A successful login
(b) Login rejected after name entered
(c) Login rejected after name and password typed
Gao Haichang , Software School, Xidian University
15
Operating Systems
How crackers break in
 How a cracker broke into LBL


a U.S. Dept. of Energy research lab
Ping / telnet / dnsquery / passwd / packet sniffer
Gao Haichang , Software School, Xidian University
16
Operating Systems
UNIX password security
UNIX: the user password is “encrypted” by using it as a
key to encrypt a fixed block of data.
Salt
Password
The use of salt to defeat precomputation of encrypted passwords
Gao Haichang , Software School, Xidian University
17
Operating Systems
One-Time passwords
 One way function y=f(x)
 given
x it is easy to find y, but given y it is computational
infeasible to find x.
 The input and output should be the same length, i.e. 128 bits
 pi-1 = f(pi)
p0 = f(p1), p1 = f(p2), p2 = f(p3), p3 = f(p4)
p1 = f(f(f(f(s)))), p2 = f(f(f(s))), p3 = f(f(s)) , p4 = f(s)
 Challenge-Response authentication
 client
get r, send f(r,k)
Gao Haichang , Software School, Xidian University
18
Operating Systems
Authentication Using a Physical Object
 Magnetic cards
 magnetic
 chip
stripe cards
cards: stored value cards, smart cards
Gao Haichang , Software School, Xidian University
19
Operating Systems
Authentication Using Biometrics
A device for measuring finger length.
Gao Haichang , Software School, Xidian University
20
Operating Systems
Countermeasures 对策
 Limiting times when someone can log in
 Automatic callback at number prespecified
 Limited number of login tries
 A database of all logins
 Simple login name/password as a trap
 security personnel
notified when attacker bites
Gao Haichang , Software School, Xidian University
21
Operating Systems
Chapter 9: Security
 9.1
The security environment
 9.2
Basics of cryptography
 9.3
User authentication
 9.4
Attacks from inside the system
 9.5
Attacks from outside the system
 9.6
Protection mechanisms
 9.7
Trusted systems
Gao Haichang , Software School, Xidian University
22
Operating Systems
Trojan Horses
 Free program made available to unsuspecting user
 Actually contains
code to do harm
 Place altered version of utility program on victim's
computer
 trick
user into running that program
Gao Haichang , Software School, Xidian University
23
Operating Systems
Login Spoofing
(a) Correct login screen
(b) Phony login screen
Gao Haichang , Software School, Xidian University
24
Operating Systems
Logic Bombs
 Company programmer writes program
 potential to
 OK
 if
do harm
as long as he/she enters password daily
programmer fired, no password and bomb explodes
Gao Haichang , Software School, Xidian University
25
Operating Systems
Trap Doors
(a) Normal code.
(b) Code with a trapdoor inserted
Gao Haichang , Software School, Xidian University
26
Operating Systems
Buffer Overflow
 (a) Situation when main program is running
 (b) After program A called
 (c) Buffer overflow shown in gray
Gao Haichang , Software School, Xidian University
27
Operating Systems
Generic Security Attacks
Typical attacks
 Request memory, disk space, tapes and just read
 Try illegal system calls
 Start a login and hit DEL, RUBOUT, or BREAK
 Try modifying complex OS structures
 Try to do specified DO NOTs
 Convince a system programmer to add a trap door
 Beg admin's sec’y to help a poor user who forgot
password
Gao Haichang , Software School, Xidian University
28
Operating Systems
Famous Security Flaws
(a)
(b)
(c)
The TENEX – password problem
Gao Haichang , Software School, Xidian University
29
Operating Systems
Design Principles for Security
1.
System design should be public
2.
Default should be no access
3.
Check for current authority
4.
Give each process least privilege possible
5.
Protection mechanism should be
6.
-
simple
-
uniform
-
in lowest layers of system
Scheme should be psychologically acceptable
And … keep it simple
Gao Haichang , Software School, Xidian University
30
Operating Systems
Lesson 2
Operating Systems
Chapter 9: Security
 9.1
The security environment
 9.2
Basics of cryptography
 9.3
User authentication
 9.4
Attacks from inside the system
 9.5
Attacks from outside the system
 9.6
Protection mechanisms
 9.7
Trusted systems
Gao Haichang , Software School, Xidian University
32
Operating Systems
Network Security
 External threat
 code
transmitted to target machine
 code executed there, doing damage
 Goals of virus writer
 quickly
spreading virus
 difficult to detect
 hard to get rid of
 Virus = program can reproduce itself
 attach its
code to another program
 additionally, do harm
Gao Haichang , Software School, Xidian University
33
Operating Systems
Virus Damage Scenarios
 Blackmail
 Denial of service as long as virus runs
 Permanently damage hardware
 Target a competitor's computer
 do
harm
 espionage 间谍活动
 Intra-corporate dirty tricks
 sabotage (阴谋破坏) another
corporate officer's files
Gao Haichang , Software School, Xidian University
34
Operating Systems
How Viruses Work
 Virus written in assembly language
 Inserted into another program
 use
tool called a “dropper”
 Virus dormant (潜伏) until program executed
 then
infects other programs
 eventually executes
its “payload”
Gao Haichang , Software School, Xidian University
35
Operating Systems
How Viruses Work (1)
 Several kinds of Viruses based on what is infected
 companion
 executable program
 memory
 boot
sector
 device
driver
 macro
 source
code viruses
Gao Haichang , Software School, Xidian University
36
Operating Systems
How Viruses Work (2)
Recursive
procedure that
finds executable
files on a UNIX
system
Virus could
infect them all
Gao Haichang , Software School, Xidian University
37
Operating Systems
How Viruses Work (3)
Parasitic virus 寄生病毒




An executable program
With a virus at the front
With the virus at the end
With a virus spread over free space within program
Gao Haichang , Software School, Xidian University
38
Operating Systems
How Viruses Work (5)



After virus has captured interrupt, trap vectors
After OS has retaken printer interrupt vector
After virus has noticed loss of printer interrupt vector and
recaptured it
Gao Haichang , Software School, Xidian University
39
Operating Systems
How Viruses Spread
 Virus placed where likely to be copied
 When copied
 infects
 may
programs on hard drive, floppy
try to spread over LAN
 Attach to innocent (无辜) looking email
 when
it runs, use mailing list to replicate
Gao Haichang , Software School, Xidian University
40
Operating Systems
Antivirus and Anti-Antivirus Techniques
(a) A program
(b) Infected program
(c) Compressed infected program
(d) Encrypted virus (disguise)
(e) Compressed virus with encrypted compression code
Gao Haichang , Software School, Xidian University
41
Operating Systems
Antivirus and Anti-Antivirus Techniques
Examples of a polymorphic virus 多形态病毒
All of these examples do the same thing
Gao Haichang , Software School, Xidian University
42
Operating Systems
Antivirus and Anti-Antivirus Techniques
 Integrity checkers
 Behavioral checkers
 Virus avoidance
 good
OS
 install only shrink-wrapped software
 use antivirus software
 do not click on attachments to email
 frequent backups
 Recovery from virus attack
 halt computer, reboot from safe disk, run antivirus
Gao Haichang , Software School, Xidian University
43
Operating Systems
The Internet Worm (Morris)
 Consisted of two programs
 bootstrap
 the
to upload worm
worm itself
 Worm first hid its existence
 Next replicated itself on new machines
Gao Haichang , Software School, Xidian University
44
Operating Systems
Mobile Code (1) Sandboxing
(a) Memory divided into 1-MB sandboxes
(b) One way of checking an instruction for validity
Gao Haichang , Software School, Xidian University
45
Operating Systems
Mobile Code (2)
Applets can be interpreted (解释) by a Web browser
Gao Haichang , Software School, Xidian University
46
Operating Systems
Mobile Code (3)
How code signing works
Gao Haichang , Software School, Xidian University
47
Operating Systems
Java Security

A type safe language
 compiler rejects attempts to misuse variable

Checks include …
1. Attempts to forge 伪造 pointers
2. Violation of access restrictions on private class members
3. Misuse of variables by type
4. Generation of stack over/underflows
5. Illegal conversion of variables to another type
Gao Haichang , Software School, Xidian University
48
Operating Systems
Chapter 9: Security
 9.1
The security environment
 9.2
Basics of cryptography
 9.3
User authentication
 9.4
Attacks from inside the system
 9.5
Attacks from outside the system
 9.6
Protection mechanisms
 9.7
Trusted systems
Gao Haichang , Software School, Xidian University
49
Operating Systems
Protection Domains (1)
Examples of three protection domains
Gao Haichang , Software School, Xidian University
50
Operating Systems
Protection Domains (2)
A protection matrix
Dis: large and sparse
Gao Haichang , Software School, Xidian University
51
Operating Systems
Access Control Lists (1)
Use of access control lists to manage file access
Gao Haichang , Software School, Xidian University
52
Operating Systems
Access Control Lists (2)
(UID,GID)
Two access control lists
Gao Haichang , Software School, Xidian University
53
Operating Systems
Capabilities (1) 权能字
Each process has a capability list
Gao Haichang , Software School, Xidian University
54
Operating Systems
Capabilities (2)

Capability list must be protected from user tampering 篡改
1.
First way, require a tagged architecture
2.
Second way, keep the C-list inside the OS
3.
Third way, keep the C-list in user space, but manage the
capabilities cryptographically
Gao Haichang , Software School, Xidian University
55
Operating Systems
Chapter 9: Security
 9.1
The security environment
 9.2
Basics of cryptography
 9.3
User authentication
 9.4
Attacks from inside the system
 9.5
Attacks from outside the system
 9.6
Protection mechanisms
 9.7
Trusted systems
Gao Haichang , Software School, Xidian University
56
Operating Systems
Trusted Computing Base

Is it possible to build a secure computer system?

If so, why is it not done?

user habits

feature is the enemy of security
Gao Haichang , Software School, Xidian University
57
Operating Systems
Trusted Computing Base 可信计算基
Operating system functions that must be part of the TCB include process
creation, process switching, memory map management, and part of file
and I/O management.
A reference monitor 访问监视器
Gao Haichang , Software School, Xidian University
58
Operating Systems
Formal Models of Secure Systems

Six primitive operations on the protection matrix that can
be used as a base to model any protection system.
(protection commands)

create object, delete object

create domain, delete domain

insert right, remove right
Gao Haichang , Software School, Xidian University
59
Operating Systems
Formal Models of Secure Systems
(a) An authorized state
(b) An unauthorized state
Gao Haichang , Software School, Xidian University
60
Operating Systems
Multilevel Security

Discretionary access control 自主访问控制: allow
individual users to determine who may read and write
their files and other objects.

Mandatory access control 强制访问控制: the stated
security policies are enforced by the system.

Bell-La Padula model (popular multilevel security model)

The simple security property. A process running at security
level k can read only objects at its level or lower.

The * property. A process running at security level k can
write only objects at its level or higher.
Gao Haichang , Software School, Xidian University
61
Operating Systems
Multilevel Security (1)
The Bell-La Padula multilevel security model
Gao Haichang , Software School, Xidian University
62
Operating Systems
Multilevel Security (2)
Dis of Bell-La Padula: devise to keep secrets, but not
guarantee the integrity of the data.
 The Biba Model

Simple integrity principle. process can write only objects
at its security level or lower.

The integrity * property. process can read only objects at
its security level or higher.
Gao Haichang , Software School, Xidian University
63
Operating Systems
Orange Book Security (DoD 5200.28)
 Symbol X means new requirements
 Symbol -> requirements from next lower category
apply here also
Gao Haichang , Software School, Xidian University
64
Operating Systems
Orange Book Security (2)
Gao Haichang , Software School, Xidian University
65
Operating Systems
Covert Channels
Client, server and
collaborator processes
隐蔽信道
Encapsulated server can
still leak to collaborator via
covert channels
Gao Haichang , Software School, Xidian University
66
Operating Systems
Covert Channels (2)
A covert channel using file locking
Gao Haichang , Software School, Xidian University
67
Operating Systems
Covert Channels (3)
 Pictures appear the same
 Picture on right has text of 5 Shakespeare plays

encrypted, inserted into low order bits of color values
Zebras
Hamlet , King Lear, Macbeth ,
Merchant of Venice, Julius Caesar
Gao Haichang , Software School, Xidian University
68