




版權(quán)說(shuō)明:本文檔由用戶(hù)提供并上傳,收益歸屬內(nèi)容提供方,若內(nèi)容存在侵權(quán),請(qǐng)進(jìn)行舉報(bào)或認(rèn)領(lǐng)
文檔簡(jiǎn)介
November25,2008Copyright?2008byJingshaHe1IntroductiontoInformationSecurityProf.JingshaHeSchoolofSoftwareEngineeringBeijingUniversityofTechnologyNovember25,20081Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe2FactoftheLectureQuantumcomputingisatheoreticalwayofusingthepropertiesofmatteratthequantummechanical(microscopic)levelinordertobuildcomputationalsystems.Quantumcomputerswouldnotworklikeordinarycomputers,butonawholenewprinciple.Ithasbeentheorizedthatquantumcomputerscouldbreakstandardencryptioncodesinafractionofasecond.Theraceisontobuildquantumcomputers.November25,20082Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe3PracticesInformationFlowAnalysisNovember25,20083Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe4Identification&AuthenticationEncryption&DecryptionAccessControlCEOIdentification&AuthenticationEncryption&DecryptionRegularEmployeeInformationFlowAuditingNovember25,20084Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe5InformationFlowPolicyAnyconfidentialityandintegritymodelembodiesaninformationflowpolicyThereisthustheneedforassurancethatinformationflowdoesn'tviolatetheconstraintsofsuchapolicyAccesscontrolcanconstraintherightsofauser,butnottheflowofinformationbetweensubjectsorobjectsThereisthustheneedformechanismsthatcontroltheflowofinformationinadditiontoaccesscontrolExampleIntheBell-LaPadulamodel,informationcanflowfromoneobjecttoanotherifandonlyifthesecondobjectdominatesthefirstNovember25,20085Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe6DefinitionofInformationFlowComponentsObjectxObjectySequenceofcommandsSDefinitionInformationflowsfromobjectxtoobjectyif,aftertheexecutionofthesequenceofcommandsS,thevalueinobjectyallowsonetodeducethevalueinobjectxNotationy←xxiscalledthesourceoftheinformationflowyiscalledthetargetoftheinformationflowNovember25,20086Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe7SecurityConstraintsonInformationFlowTheBell-LaPadulamodely←xissecureifandonlyifthesecuritylevelofydominatesthatofxNotationsx:securitylevelofx≥:dominate≤:dominatedbyy←xrequiresthaty
≥
x(orx
≤
y)November25,20087Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe8TypesofInformationFlowStronginformationflowy←xaccordingtothedefinitionValueofxdirectly/explicitlyaffectsthevalueofyy=f(x)f()isanarithmeticexpressionWeakinformationflowy←xaccordingtothedefinitionValueofxindirectly/implicitlyaffectsthevalueofyIf(f1(x))theny=f2(a)elseB=f3(b)f1(),f2()andf3()arearithmeticexpressionsaandbareobjects.November25,20088Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe9InformationFlowinProgramsProgramstatementsAssignmentstatementCompoundstatementConditionalstatementIterativestatementGotostatementProcedurecallFunctioncallInput/outputstatementNovember25,20089Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe10AssignmentStatementStatementy=f(x1,x2,…,xn)InformationflowsStronginformationflowsy←x1y←x2 ……y←xnWeakinformationflowsNoneSecurityrequirementlub(x1,x2,…xn)≤
yNovember25,200810Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe11ExampleofAssignmentStatementStatementa=b+c-dInformationflowsStronginformationflowsa←ba←ca←dWeakinformationflowsNoneSecurityrequirementlub(b,c,d)≤
aNovember25,200811Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe12CompoundStatementStatementbegin S1; …… Sn;end;InformationflowsAlltheinformationflowsinstatementSi,1≤i≤nSecurityrequirementS1issecure……SnissecureNovember25,200812Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe13ConditionalStatementStatementIff(x1,x2,…,xn)thenS1;else S2;end;InformationflowsAlltheinformationflowsincompoundstatementsS1andS2Weakinformationflowsy←x1,y←x2,…,y←xnyisthetargetofanassignmentstatementinS1andS2SecurityrequirementS1issecureS2issecurelub(x1,x2,…,xn)≤
glb(y)yisthetargetofanassignmentstatementinS1andS2November25,200813Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe14ExampleofConditionalStatementStatementIfx+y≤zthena=b;else c=b;end;InformationflowsStronginformationflowsa←b,c←bWeakinformationflowsa←x,a←y,a←zc←x,c←y,c←zSecurityrequirementb
≤
ab
≤
club(x,y,z)≤glb(a,c)November25,200814Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe15IterativeStatementStatementwhilef(x1,x2,…,xn)doS1;S2;InformationflowsAlltheinformationflowsincompoundstatementS1Weakinformationflowsy←x1,y←x2,…,y←xnyisthetargetofanassignmentstatementinS1Note:thestatementisrequiredtoterminateWhatifnot?Hint:whatistheconsequencetoS2?SecurityrequirementS1issecurelub(x1,x2,…,xn)≤
glb(y)yisthetargetofanassignmentstatementinS1November25,200815Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe16GotoStatementStatementiff(x1,x2,…,xn)thenS1;gotolabel;S2;label:S3;InformationflowsAlltheinformationflowsincompoundstatementsS1,S2,andS3Weakinformationflowsy←x1,y←x2,…,y←xnyisthetargetofanassignmentstatementinS1,S2andS3SecurityrequirementS1issecureS2issecureS3issecurelub(x1,x2,…,xn)≤
glb(y)yisthetargetofanassignmentstatementinS1,S2andS3November25,200816Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe17ProcedureCallStatementprocpname(i1,i2,…,im:int;varo1,o2,…,on:int);beginS;end;……pname(x1,x2,…,xm;y1,y2,…,yn);InformationflowsAlltheinformationflowsincompoundstatementSNote:intheabsenceofprocedurecalldetail,ok
←ij,1≤j≤m,1≤k≤nSecurityrequirementSissecureIfij
≤
ok,thenxj
≤
yk,1≤j≤m,1≤k≤nIfoj
≤
ok,thenyj
≤
yk,1≤j≤n,1≤k≤nNovember25,200817Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe18FunctionCallStatementintf(i1,i2,…,in:int);beginS;end;……y=f(x1,x2,…,xn);InformationflowsAlltheinformationflowsincompoundstatementSNote:intheabsenceoffunctioncalldetail,f()←ik,1≤k≤nSecurityrequirementSissecureIfik
≤
f(),thenxk
≤
y,1≤k≤nNovember25,200818Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe19Input/OutputStatementStatementcanbemodeledafteranassignmentstatementForaninputstatementSourcecanbeadevicenameobjectorafilenameobjectTargetcanbeafilenameobjectoraregularprogramvariableobjectForanoutputstatementSourcecanbeafilenameobjectoraregularprogramvariableobjectTargetcanbeadevicenameobjectorafilenameobjectNovember25,200819Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe20OtherInformationFlows(1)Arrayelementsy=a[i]Stronginformationflows:y←a[i],y←ia[i]=xStronginformationflows:a[i]←xInfiniteloopsandexceptionsy=0;while(x=0)doy=1;AnalysisIfx=0,theny=1andtheexecutionentersintoaninfiniteloop(andx
≤
ycouldbeenforcedtomeetsecurityrequirement)Ifx≠0,theny=0andtheexecutionterminates(butx
≤
ywouldnotbeenforced)Result:y←xNovember25,200820Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe21OtherInformationFlows(2)Pointers&y=&xStronginformationflows:&y←&xResultinginformationflows(x=z)?(y=z)x←z?y←z(y=z)?(x=z)y←z?x←zConsequenceTheaddressassignment(&y=&xor&x=&y)nowmakesxandythesameobjectfromtheviewpointofinformationflowsbecausethesamememory/storagecellisnowrepresentedbytwodifferentvariables/symbols,i.e.,xandyResult:y?xNovember25,200821Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe22ProgramSecurityCertificationofthesecurityofaprogramThestraightforwardmethodDetermineinformationflowsforeachtypeofstatementsbasedonthesemanticsofthestatementsCertifythesecurityofeachandeveryprogramstatementinasequentialorderIssuesItisalmostimpossibletodosoinastaticmannerIftrue,thenwhat?VariablesarenotalwaysequivalenttoobjectsLocalvariablesifalocalvariableisthetargetofaninformationflow,itssecuritylevelmustbesettothe“l(fā)ub”ofthesecuritylevelsofallthesourcesregardlessofitscurrentsecuritylevelNovember25,200822Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe23ConfinementProblemProblemstatementTopreventaservicefromleakinginformationthatisregardedasbeingconfidentialbytheuseroftheserviceProblemdomainInformationflowsthatviolatethepropertiesintheBell-LaPadulamodelInformationcanonlybeallowedtoflowupwardsaccordingtothemodelTotalconfinementIsolationCannotbeobservedbyothersCannotbeallowedtocommunicatewithothersVerydifficult,ifnotimpossibleResourcesharingDirectandindirectcommunicationNovember25,200823Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe24ExamplesInageneral-purposecomputersysteminwhichCPU,memory,diskspace,I/OsareallsharedresourcesforprocessesexecutingonbehalfoftheusersAusercandeducetheexecutionstatusofanotherprocessByobservingthespeedortheexecutionstatusofaprocessinitiatedbytheuserByaccessingadataiteminthememoryoronthediskintowhichtheotherprocessissupposedtowriteInacommunicationsysteminwhichservicesareprovidedinresponsetouserrequestsAusercandeducetheexecutionstatusofanotherprocessByrequestingaservicethattheotherprocessisknowntoalsouseByrequestingaserviceoverwhichtheotherprocessisknowntohavetheabilitytoinfluenceNovember25,200824Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe25LeakingofInformationPassiveAreceiveronly(inviolationofinformationflowpolicy)ExploringsystemsecurityflawsObservingthestatusorvalueofsystemstateIndirectlyinvokingandobservingcertainsystemoperationsbysettingtrueofthenecessaryconditionsActiveorcollaborativeBothasenderandareceiver(inviolationofinformationflowpolicy)ExploringsystemsecurityflawsSettingandobservingthestatusorvalueofsystemstateDirectlyinvokingandobservingcertainsystemoperationswithorwithoutsettingtrueofthenecessaryconditionsNovember25,200825Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe26CovertChannelsDefinitionApathofcommunicationthatisNOTdesignedtobeusedforcommunicationPropertiesAnactiveorcollaborativewayofleakinginformationSecuritychecksareusuallynotimposedNecessaryconditionsAsenderAreceiverResourcesharingTypesofcovertchannelsStorage(spatial)ResourceexhaustionchannelsEventcountingchannelsTiming(temporal)November25,200826Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe27ChannelClassificationsNoiselesscovertchannelsThesharedresourcethatisusedforinformationtransmissionisavailabletothesenderandthereceiveronlyInformationtransmittedthroughthechannelscomesonlyfromthesenderNoisycovertchannelsThesharedresourcethatisusedforinformationtransmissionisalsoavailabletootherusersorsubjectsinadditiontothesenderandthereceiverInformationtransmittedthroughthechannelsismixedtogetherwithmeaningless/uselessinformation(i.e.,thenoise)introducedduetoaccesstothesharedresourcebytheotherusersorsubjectsNovember25,200827Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe28StorageChannelsNecessaryconditionsResourcesharingBoththesendingandreceivingprocessesmusthaveaccesstothesameattributeofasharedresourceInformationsendingThesendingprocessmustbeabletomodifythatattributeofthesharedresourceInformationreceivingThereceivingprocessmustbeabletoreferencethatattributeofthesharedresourceSynchronizationorcoordinationTheremustexistamechanismforinitiatingboththesendingandthereceivingprocessesandforsynchronizing/sequencingtheiraccessestothatattributeofthesharedresourcebytheprocessesNovember25,200828Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe29ResourceExhaustionChannelsMechanismThroughexhaustingasharedresourceExampleSharedresource:memorySendingprocessTransmitting“1”:takingall(exhausting)theavailablememoryTransmitting“0”:leavingsomememoryforotherprocessestouseReceivingprocessReceiving“1”:requestingmemory,resultinginfailureReceiving“0”:requestingmemory,resultinginsuccessInformationistransmittedbythesendingprocesstothereceivingprocessonebitatatimeSpecialpropertiesTakingadvantageofthefactthatresourcesarelimitedandaresharedUsingtheboundaryconditiontoencodeinformationRelyingonthefactthatresourceexhaustionisaglobalstatusthatcanbeobservedbytherequestingprocessDuetotherealitythatusuallynosecuritychecksareimposedNovember25,200829Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe30EventCountingChannelsMechanismThroughmodifyingthevalueofasharedcounterExampleSharedresource:processIDSendingprocessTransmitting“1”:requestinganewprocessID,resultinginincrementtotheprocessIDcounterTransmitting“0”:leavingtheprocessIDcounteraloneReceivingprocessReceiving“1”:requestinganewprocessIDandobservingtheincrementReceiving“0”:requestinganewprocessIDandobservingacontinuousvalueInformationistransmittedbythesendingprocesstothereceivingprocessonebitatatimeSpecialpropertiesTakingadvantageofthefactthatcountervaluesareincrementallyassignedUsingtheincrementtoencodeinformationRelyingonthefactthatthevalueofasharedcounterisaglobalvalueDuetotherealitythatusuallynosecuritychecksareimposedNovember25,200830Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe31TimingChannelsNecessaryconditionsResourcesharingBoththesendingandreceivingprocessesmusthaveaccesstothesameattributeofasharedresourceReferenceoftimingBoththesendingandthereceivingprocessesmusthaveaccesstoacommontimereference,suchasatimer,areal-timeclock,ortheorderingofeventsInformationsendingandreceivingThesendingprocessmustbeabletocontrolthetimingofthedetectionofachangeintheattributebythereceivingprocessSynchronizationorcoordinationTheremustexistamechanismforinitiatingboththesendingandthereceivingprocessesandforsynchronizing/sequencingtheiraccessestothatattributeofthesharedresourcebytheprocessesNovember25,200831Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe32AnExampleofTimingChannelsMechanismThroughcontrollingtheexecutionofaprocessExampleSharedresource:CPUSharedtimereference:thesystemclockSendingprocessTransmitting“1”:requestingoneCPUslotforprocessexecutionTransmitting“0”:leavingtheCPUaloneReceivingprocessReceiving“1”:requestingoneCPUslotandobservingalongercompletiontimeReceiving“0”:requestingoneCPUslotandobservingashortercompletiontimeInformationistransmittedbythesendingprocesstothereceivingprocessonebitatatimeSpecialpropertiesTakingadvantageofthefactthatC
溫馨提示
- 1. 本站所有資源如無(wú)特殊說(shuō)明,都需要本地電腦安裝OFFICE2007和PDF閱讀器。圖紙軟件為CAD,CAXA,PROE,UG,SolidWorks等.壓縮文件請(qǐng)下載最新的WinRAR軟件解壓。
- 2. 本站的文檔不包含任何第三方提供的附件圖紙等,如果需要附件,請(qǐng)聯(lián)系上傳者。文件的所有權(quán)益歸上傳用戶(hù)所有。
- 3. 本站RAR壓縮包中若帶圖紙,網(wǎng)頁(yè)內(nèi)容里面會(huì)有圖紙預(yù)覽,若沒(méi)有圖紙預(yù)覽就沒(méi)有圖紙。
- 4. 未經(jīng)權(quán)益所有人同意不得將文件中的內(nèi)容挪作商業(yè)或盈利用途。
- 5. 人人文庫(kù)網(wǎng)僅提供信息存儲(chǔ)空間,僅對(duì)用戶(hù)上傳內(nèi)容的表現(xiàn)方式做保護(hù)處理,對(duì)用戶(hù)上傳分享的文檔內(nèi)容本身不做任何修改或編輯,并不能對(duì)任何下載內(nèi)容負(fù)責(zé)。
- 6. 下載文件中如有侵權(quán)或不適當(dāng)內(nèi)容,請(qǐng)與我們聯(lián)系,我們立即糾正。
- 7. 本站不保證下載資源的準(zhǔn)確性、安全性和完整性, 同時(shí)也不承擔(dān)用戶(hù)因使用這些下載資源對(duì)自己和他人造成任何形式的傷害或損失。
最新文檔
- 2025年割灌機(jī)合作協(xié)議書(shū)
- 強(qiáng)化合規(guī)經(jīng)營(yíng)管理規(guī)避經(jīng)營(yíng)風(fēng)險(xiǎn)隱患
- 構(gòu)建智能物流系統(tǒng)優(yōu)化配送效率
- 2025年離合器主缸合作協(xié)議書(shū)
- 西安機(jī)械加工生產(chǎn)服務(wù)合同
- 化妝品行業(yè)產(chǎn)品品質(zhì)追溯系統(tǒng)建設(shè)方案
- Perfluoro-2-5-dimethyl-3-6-dioxanonanoic-acid-生命科學(xué)試劑-MCE
- Fumonisin-B1-Standard-生命科學(xué)試劑-MCE
- D-Psicose-Standard-生命科學(xué)試劑-MCE
- 電鍍培訓(xùn)資料
- 運(yùn)營(yíng)總監(jiān)個(gè)人總結(jié)
- 2025年陜西延長(zhǎng)石油集團(tuán)礦業(yè)公司招聘筆試參考題庫(kù)含答案解析
- 2025中國(guó)煙草/中煙工業(yè)招聘易考易錯(cuò)模擬試題(共500題)試卷后附參考答案
- 2025至2030年中國(guó)PVC熱縮封帽數(shù)據(jù)監(jiān)測(cè)研究報(bào)告
- 2025年遼寧農(nóng)業(yè)職業(yè)技術(shù)學(xué)院高職單招高職單招英語(yǔ)2016-2024年參考題庫(kù)含答案解析
- 《教育強(qiáng)國(guó)建設(shè)規(guī)劃綱要(2024-2035年)》解讀與培訓(xùn)
- 2025年市場(chǎng)營(yíng)銷(xiāo)人員工作計(jì)劃
- 2024年徐州工業(yè)職業(yè)技術(shù)學(xué)院高職單招職業(yè)適應(yīng)性測(cè)試歷年參考題庫(kù)含答案解析
- 2025年春新人教版語(yǔ)文一年級(jí)下冊(cè)全冊(cè)課件
- 2025年春新北師大版數(shù)學(xué)七年級(jí)下冊(cè)全冊(cè)教案
- 第七章老年人泌尿系統(tǒng)疾病
評(píng)論
0/150
提交評(píng)論