- fundamentals
- security is an adversarial game you play
- if the rules support the game, you win; if not, you lose
- what's the point of the game - it may not be what you think
- it's important to understand the game and the rules
- objectives, policy, and mechanism - the why, the what, and the how
- objectives determine overall goals
- only those that need information can get it
- every resource use is traced back to a billable entity
- it is impossible to discern the agents responsible for an action
- policy determines what the rules are
- security classifications, RADIUS, anonymity
- mechanism determines how the rules are implemented
- disjoint systems, challenge-response, hot-potato routing
- the difference is the level of detail - one level's objectives is
another level's policy, and so on
- making policy match objectives, mechanism match policy
- basic computer security policies
- authentication - every entity is an identified, known entity
- authorization - entities must have permission to carry out actions on
objects
- quotas - user's rate of resource use must be constrained
- computers are anti-security devices
- computers are dumb, and require detailed, correct instructions to work
- software is infinitely malleable - hardware too, to a lesser extent
- everything looks the same on a computer
- observations
- security is a process, not a mechanism
- there are many levels to security, the computer is perhaps the least
important (but the most damaging)
- security is expensive
- authentication - who are you
- verifying and tagging a claim of identity
- mechanisms - prove your claim
- mental - tell me a secret - password protection, ticketing schemes
- physical - characteristic traits; - biometrics
- internal and external authentication - external is more costly
- attacks
- a masquerade is an attack on authentication - unfortunately, it's also
a generally useful technique; unix set-uid bits
- identity theft - network packet sniffers
- trojan horses - login trojans
- example - kerberos
- developed for project athena - a campus-wide open network of
computers
- an authentication server - clients receive secrets they can share
with each other
- the kerberos server must be trusted and secure
- authorization - what can you do to what
- important for resource control - sharing and security
- authorization models
- agents, actions, objects (which may be agents) - actions are related
to objects
- no authorization - any agent can do any operation on any object
- more restrictive policies are organized as a matrix
- agents by objects gives operations
- sometimes agents are replaced by protection domains - indirection
- matrix elements are determined by the policy
- the matrix itself is an object with actions
- the security monitor (or kernel) checks that an (agent, action,
object) triple is given in the matrix
- must be protected and trusted - but frees up other software from
being so
- required on every operation
- implementation
- lock and key - tell me a secret; usually timestamped; kerberos's
ticket-granting service
- access matrix - very expensive; the matrix is huge and sparse; the security
monitor is expensive to invoke
- access control lists - slice the access matrix down the columns
- each object has a list of agents and the operations they can
perform
- non-monolithic - each class of object can be checked separately
- capabilities - slice the access matrix across the rows
- each agent has a list of objects and operations it can perform
- flexible - capabilities can be passed around (with permission)
- expensive - a security monitor needs to check capabilities
This page last modified on 9 December 2003.