CSE543 - Introduction to Computer and Network Security Module: - - PowerPoint PPT Presentation

▶
cse543 introduction to computer and network security
SMART_READER_LITE
LIVE PREVIEW

CSE543 - Introduction to Computer and Network Security Module: - - PowerPoint PPT Presentation

Jan 09, 2023 49 likes •324 views

slide-1
SLIDE 1

฀฀฀฀ ฀

  • ฀฀฀฀

฀฀฀฀฀ ฀฀฀฀฀฀

CSE543 - Introduction to Computer and Network Security Page

CSE543 - Introduction to Computer and Network Security Module: Capability Systems

Professor Trent Jaeger

1

slide-2
SLIDE 2

CSE543 - Introduction to Computer and Network Security Page

Confused Deputy

  • Imagine a multi-client server (e.g., web server)
  • Clients have a different set of objects that they can access
  • In an ACL system, the server always has access to all

the objects

  • What happens if a client tricks the server into accessing

into another client’s objects or sensitive server objects?

  • Shouldn’t the server only have access to that client’s
  • bjects for its requests?
  • Leads to confused deputy...

2

slide-3
SLIDE 3

CSE543 - Introduction to Computer and Network Security Page

Action-specific Permissions

  • Ideally, we would like the permissions of a request to
  • nly those available to the requesting client
  • How do we change the permissions of a process in an

ACL system?

3

slide-4
SLIDE 4

CSE543 - Introduction to Computer and Network Security Page

Capabilities

  • Each row lists the access rights of

a subject

  • Capabilities
  • In theory, a server could use

capabilities to change permissions

  • Choose among subjects with the desired

permissions

  • Or choose to activate the permissions

to apply for the specific case

  • How can programmers use such a

concept?

  • Will they?

O1 O2 O3 S1 Y Y N S2 N Y N S3 N Y Y

4

slide-5
SLIDE 5

CSE543 - Introduction to Computer and Network Security Page

Capabilities

  • A capability is the tuple (object, rights)
  • A capability system implements access control by

checking if the process has an appropriate capability

  • Simple, right? Analogous to keys for a lock
  • Can use or delegate (copy) for others
  • This is a little like a ticket in the Kerberos system
  • Q: Does this eliminate the need for authentication?

5

slide-6
SLIDE 6

CSE543 - Introduction to Computer and Network Security Page

Capabilities

  • A: Well, yes and no …
  • Capabilities remove the overhead of managing per-
  • bject rights, but add the overhead of managing

capabilities

  • Moreover, to get any real security, they have to be

unforgeable

  • Hardware tags (to protect capabilities)
  • Protected address space/registers
  • Language based techniques
  • Enforce access restrictions on caps.
  • Cryptography
  • Make them unforgeable

6

slide-7
SLIDE 7

CSE543 - Introduction to Computer and Network Security Page

User space capability?

  • Well, what are the requirements?
  • Authenticity/integrity - do not want malicious process to

forge capabilities

  • Start with the data itself: [object, rights]
  • Object is typically encoded with identifier, or by some other

tag (capabilities are sometimes known as tags)

  • Rights are often fixed (read, modify, write, execute, etc.)
  • Now, do what you with any other data (assume the

kernel has a secret key k) E(k, [Oi, r1, r2, … rn])

  • What’s wrong with this construction (I got it from the website
  • f one of the experts in the area)?

7

slide-8
SLIDE 8

CSE543 - Introduction to Computer and Network Security Page

The right construction

  • Encryption does not provide authenticity/integrity, it

provides confidentiality instead [Oi, r1, r2, … rn],HMAC(k, [Oi, r1, r2, … rn])

  • So how would you attack the preceding construction?

8

slide-9
SLIDE 9

CSE543 - Introduction to Computer and Network Security Page

OS Capability Lists

  • The OS kernel manages capabilities in the process table, out of

reach of the process

  • Capabilities added by user requests (delegation)

Process Table . . . Process Z X C R D W E . . . C List A B C D RX A RW B

9

slide-10
SLIDE 10

CSE543 - Introduction to Computer and Network Security Page

A (fictional) Capability Example

  • We use the “ls -lt” command to view the contents of our home

directory in a OS implementing capabilities:

  • Initially, our shell process has RWX capabilities for our home directory, and

RX capabilities for all the directories to the root.

  • The “ls -lt” command is exec()ed, and the shell delegates the directory

permissions by giving “ls” the capabilities

  • Note that the capabilities are _not_ tied to any subject - copied to “ls” C-list
  • The “ls -lt” process exercises the rights to read the directory structure
  • Of course, the “ls -lt” process now needs to obtain read rights to the files

(to get their specific meta-information), and obtains them by appealing to the security manager (in kernel) -- the request fulfills the policy, and they are added and exercised

  • The “ls -lt” uses access rights given to the terminal to write output
  • Note: there are many ways that the policy can be implemented,

rights handed off, etc.

10

slide-11
SLIDE 11

CSE543 - Introduction to Computer and Network Security Page

Capabilities Between Procs

  • So, how do we use capabilities to prevent confused

deputy attacks on web servers?

11

slide-12
SLIDE 12

CSE543 - Introduction to Computer and Network Security Page

Capabilities Between Procs

  • So, how do we use capabilities to prevent confused

deputy attacks on web servers?

  • Client sends a request to a web server
  • Request includes client’s capabilities for web server
  • E.g., files that may be read (served) to the client
  • Web server uses the client’s capabilities to process the

request

  • Provides capabilities in system call
  • Like file descriptors
  • How does this prevent confused deputy attacks on web

servers?

  • ???

12

slide-13
SLIDE 13

CSE543 - Introduction to Computer and Network Security Page

Capabilities Between Procs

  • So, how do we use capabilities to prevent confused

deputy attacks on web servers?

  • Client sends a request to a web server
  • Request includes client’s capabilities for web server
  • E.g., files that may be read (served) to the client
  • Web server uses the client’s capabilities to process the

request

  • How does this prevent confused deputy attacks on web

servers?

  • Client cannot gain unauthorized access if only accesses are

made using the client’s capabilities

13

slide-14
SLIDE 14

CSE543 - Introduction to Computer and Network Security Page

Capabilities Between Procs

  • Another way to use capabilities
  • The client has a capability to communicate with a server

(i.e., write messages to the server)

  • A client can provide a write capability to the server for a file
  • The client has read-write access (capability) to this file
  • Is there a problem with this situation?

14

slide-15
SLIDE 15

CSE543 - Introduction to Computer and Network Security Page

Capabilities and *-Property

  • Earl Boebert found the following problem:
  • So, consider a high secrecy Trojan horse program
  • Low secrecy programs can write to high secrecy programs
  • Suppose the low secrecy program writes a capability to

write a low secrecy file to the high secrecy program

  • E.g., User-space capabilities are just data
  • Then, the high secrecy Trojan horse has a capability to

write to a low secrecy file

  • Can use this capability in an operation to violate the *-

property

  • What would you do to prevent this?

15

slide-16
SLIDE 16

CSE543 - Introduction to Computer and Network Security Page

Capability Systems

  • Solutions to this problem have been produced
  • Compare capability to MLS before use
  • Compare capability to MLS before propagation
  • Not really holding up use of capability systems
  • Security people like capability systems
  • In general, prevents all kinds of confused deputy attacks
  • If programmers use the right capabilities at the right time
  • Problem is that programmers won’t use capability

systems

  • And programmers often make mistakes programming

simple security code, so ...

16

slide-17
SLIDE 17

CSE543 - Introduction to Computer and Network Security Page

Procedure-Level Protection Domains

  • HYDRA (CMU, 1970s)
  • Each procedure defines a new protection domain
  • Procedure
  • Code
  • Data
  • Capabilities to other objects
  • Caller-independent
  • Caller-dependent templates
  • Local Name Space (Stack Frame)
  • Capabilities are bound here
  • Record of a procedure invocation (procedure instance)
  • Process
  • Stack of LNSs

17

slide-18
SLIDE 18

CSE543 - Introduction to Computer and Network Security Page

How HYDRA works

  • Q: Which object defines the protection domain?

18

Caller LNS Callee LNS Kernel

Call Callee + Capabilities Create Callee LNS

Caller Proc Callee Proc

Capabilities Capabilities Data Data

Template Template

Caller-Dep Capabilities Caller-Dep Capabilities

slide-19
SLIDE 19

CSE543 - Introduction to Computer and Network Security Page

Implications of Fine-Grained Protection

  • Programmer
  • Must define templates for procedure
  • Connect the procedure rights together
  • Programmer is responsible for
  • Functionality
  • And security
  • At the same time

19

slide-20
SLIDE 20

CSE543 - Introduction to Computer and Network Security Page

Programming for Capabilities

  • Programmer
  • Must use the right capabilities for security-sensitive
  • perations
  • Determine which capabilities to delegate to other

processes

  • Programmer is responsible for
  • Instantiation
  • Use
  • Delegation
  • Revocation
  • Proven difficult to convince programmers to do these tasks

20

slide-21
SLIDE 21

CSE543 - Introduction to Computer and Network Security Page

Can the System Help?

  • Can the system enforce capabilities without

programmer modifications?

  • How about for name resolution attacks?
  • File squat
  • Remember, we have figure out what the programmer

expects for each system call?

  • Will the programmer tell us?
  • Can we estimate?

21

slide-22
SLIDE 22

CSE543 - Introduction to Computer and Network Security Page

Can the System Help?

  • Can the system enforce capabilities without

programmer modifications?

  • How about for name resolution attacks?
  • Suppose a system call is only supposed to open a

protected file (SSL private key)

  • Attacks may be possible: E.g., File squat
  • For a system call, ensure that only protected files are

retrieved

  • How to achieve this defense?

22

slide-23
SLIDE 23

CSE543 - Introduction to Computer and Network Security Page

Can the System Help?

  • Can the system enforce capabilities without program

modifications?

  • How about for name resolution attacks?
  • Suppose a system call is only supposed to open a

protected file (SSL private key)

  • Attacks may be possible: E.g., File squat
  • For a system call, ensure that only protected files are

retrieved

  • How to achieve this defense?
  • For that specific open (library) call, restrict the set
  • f permissions available to the process (protected

files)

23

slide-24
SLIDE 24

CSE543 - Introduction to Computer and Network Security Page

Process Firewall

  • There

24 Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Process Firewall

57

File Dir IPC

Access Control

Signal

OPERATING SYSTEM USERSPACE

Passwd

✔

Students

Check Passwd ! Serve HTML File

.edu webserver

/home/ student/ home.html

Process Firewall

✗ Introspect

Process Context: Entrypoint, Call Stack, etc.

slide-25
SLIDE 25

CSE543 - Introduction to Computer and Network Security Page

Process Firewall

  • This defense can be implemented efficiently
  • Much more efficiently than program-internal defenses
  • However, the system needs to know the programmer intent
  • May be easier to specify declaratively to system rather than

modifying program code

  • Still an open research problem

25

slide-26
SLIDE 26

CSE543 - Introduction to Computer and Network Security Page

Program to System

  • For name resolution defenses to prevent confused

deputy attacks

  • (1) Programmer may use POSIX API (stat, lstat, fstat -

don’t prevent all attacks)

  • (2) Programmer may leverage capability systems

(programmer needs to reason about the system)

  • (3) System may enforce context-specific rules

(introspection into the process - e.g., Process Firewall)

  • (4) System enforces access control (even MAC allows

confused deputy attacks)

26

slide-27
SLIDE 27

CSE543 - Introduction to Computer and Network Security Page

Take Away

  • There are some vulnerabilities MAC cannot prevent
  • Could trick the victim into using its permissions for the

unauthorized operations for the adversaries

  • Confused Deputy vulnerabilities
  • These vulnerabilities are still common (and latent) in

many programs

  • Can prevent confused deputy attacks using capability

systems

  • A capability system enables programmers to determine

permissions for individual functions (Hydra)

  • Requires more effort from programmers
  • Have system infer capabilities per syscall (Process Firewall)

27