CS363Week 8 - Monday

Last time

What did we talk about last time? Access control Authentication

Questions?

Project 2

Security PresentationAndrew Sandridge

Challenge Response

Pass Algorithms

Some systems have a special function f a user (or user's system) must know

Thus, the system will give the user a prompt, and the user must respond

Perhaps the system would issue a random value to the user, who must then encrypt it with his secret key and send it back to the system

Perhaps it's just some other way of processing the data

Monkey Island 2: LeChuck's Revenge hand puzzle

One-Time Passwords

A one-time password is invalidated as soon as it is used

Thus, an attacker stealing the password can do limited damage He can only log in once He has to act quickly before the legitimate

user logs in first How do you generate all these passwords? How do you synchronize the user and the

system?

One-time password implementations

RSA SecurID's change the password every 30 or 60 seconds

The user must be synchronized with the system within a few seconds to keep this practical

Using a secure hash function, we start with a seed value k, then h(k) = k1, h(k1) = k2, …, h(kn-1) = kn

Then passwords are in reverse order p1 = kn, p2 = kn-1, … pn-1 = k2, pn = k1

Biometrics

Biometrics

Biometrics means identifying humans by their physical and biological characteristics

This technology is often seen in spy and science fiction movies It does exist, but it is far from perfect

Like passwords, the actual biometric scans are usually not stored Instead specific features are stored for later

comparison Biometrics pose unique privacy concerns

because the information collected can reveal health conditions

Fingerprints

Historically, fingerprints are one of the most heavily used forms of biometric identification Especially useful for solving crimes Even identical twins have different fingerprints Fun fact: Koalas have fingerprints so similar to human

beings that even experts are fooled Optical scanners are available Cheap, capacitive scanners are now even

available on many laptops The image of the fingerprint is usually not stored Instead, specific, differentiable features are

recorded

Voice recognition

Voice recognition systems must be trained on your voice

They can be defeated with recording devices

If you have a cold, it throws off the characteristics of your voice

As a consequence, they are particularly susceptible to both false positives and false negatives

Eye recognition

As the technology matures and hardware becomes cheaper, eye recognition is becoming more common

Iris recognition looks at the patterns of light and dark areas in your iris (the colored part of your eye) For simplicity, the image is converted to grayscale for

comparison Newer iris scanners can make successful identifications at 10

feet away or more, even correcting for glasses! Retina scans exist but are unpopular

The retina is the tissue lining the inside of your eye and requires pupil dilation to get an accurate picture, blinding you for several minutes

There are even systems for recognizing the patterns of discolorations on the whites of your eyes!

Face recognition

The shape of your face, the distance between your eyes and nose, and other facial features are relatively distinctive Although they can be nearly the same for identical twins

Computer vision techniques must be used to locate the face, deal with changes in haircut, glasses, etc.

Participants must have a neutral facial expression or results can be thrown off

The US Department of State uses facial recognition and fingerprinting to document foreigners entering the country Their database has over 75 million photographs

Other biometrics

Hand geometry readers measure the shape of your hand

Keystroke dynamics are the patterns that you use when typing Users are quite distinctive, but

distractions and injuries can vary patterns a lot

Combinations of different biometrics are sometimes used

DNA sequencing is not (yet) fast enough to be used for authentication

Researchers are always coming up with new biometrics to use

Problems with biometrics People assume that they are more secure than

they are Attacks:

Fingerprints can be lifted off a champagne glass Voices can be recorded Iris recognition can be faked with special contact lenses

Both false positives and false negatives are possible

It is possible to tamper with transmission from the biometric reader

Biometric characteristics can change Identical twins sometimes pose a problem

Trusted Systems

What is trust?

To trust a program, we are looking for 4 things: Functional correctness▪ The program does what it should

Enforcement of integrity▪ The program’s data is still correct even if given bad or

unauthorized commands Limited privilege▪ If the program accesses secure data, it only accesses what

it needs, and it doesn’t leak rights or data to untrusted parties

Appropriate confidence level▪ The program has been examined carefully and given trust

appropriate for its job

Security policies

A security policy is a statement of the security we expect a system to enforce

A mechanism is a tool or protocol to enforce the policy It is possible to have good policies but bad

mechanisms or vice versa A trusted system has:

Enforcement of a security policy Sufficiency of measures and mechanisms Evaluation

Bell-LaPadula Model

Bell-LaPadula overview

Confidentiality access control system

Military-style classifications Uses a linear clearance

hierarchy All information is on a

need-to-know basis It uses clearance (or

sensitivity) levels as well as project-specific compartments

Unclassified

Restricted

Confidential

Secret

Top Secret

Security clearances

Both subjects (users) and objects (files) have security clearances

Below are the clearances arranged in a hierarchy

Clearance Levels Sample Subjects Sample Objects

Top Secret (TS) Tamara, Thomas Personnel Files

Secret (S) Sally, Samuel E-mail Files

Confidential (C) Claire, Clarence Activity Log Files

Restricted (R) Rachel, Riley Telephone List Files

Unclassified (UC) Ulaley, Ursula Address of Headquarters

Simple security condition

Let levelO be the clearance level of object O Let levelS be the clearance level of subject S The simple security condition states that S

can read O if and only if the levelO ≤ levelS and S has discretionary read access to O

In short, you can only read down Example? In a few slides, we will expand the simple

security condition to make the concept of level

*-Property

The *-property states that S can write O if and only if the levelS ≤ levelO and S has discretionary write access to O

In short, you can only write up Example?

Basic security theorem

Assume your system starts in a secure initial state

Let T be all the possible state transformations

If every element in T preserves the simple security condition and the *-property, every reachable state is secure

This is sort of a stupid theorem, because we define “secure” to mean a system that preserves the security condition and the *-property

Adding compartments

We add compartments such as NUC = Non-Union Countries, EUR = Europe, and US = United States

The possible sets of compartments are: {NUC} {EUR} {US} {NUC, EUR} {NUC, US} {EUR, US} {NUC, EUR, US}

Put a clearance level with a compartment set and you get a security level

The literature does not always agree on terminology

Romaine lattice

The subset relationship induces a lattice {NUC, EUR, US}

{NUC, US}

{EUR}

{NUC, EUR} {EUR, US}

{NUC} {US}

Updated properties

Let L be a security level and C be a category Instead of talking about levelO ≤ levelS, we

say that security level (L, C) dominates security level (L’, C’) if and only if L’ ≤ L and C’ C

Simple security now requires (LS, CS) to dominate (LO, CO) and S to have read access

*-property now requires (LO, CO) to dominate (LS, CS) and S to have write access

Problems?

Clark-Wilson Model

Clark-Wilson model

Commercial model that focuses on transactions Just like a bank, we want certain conditions to hold

before a transaction and the same conditions to hold after

If conditions hold in both cases, we call the system consistent

Example: D is the amount of money deposited today W is the amount of money withdrawn today YB is the amount of money in accounts at the end of

business yesterday TB is the amount of money currently in all accounts Thus,

D + YB – W = TB

Clark-Wilson definitions

Data that has to follow integrity controls are called constrained data items or CDIs

The rest of the data items are unconstrained data items or UDIs

Integrity constraints (like the bank transaction rule) constrain the values of the CDIs

Two kinds of procedures: Integrity verification procedures (IVPs) test that

the CDIs conform to the integrity constraints Transformation procedures (TPs) change the

data in the system from one valid state to another

Clark-Wilson rules

Clark-Wilson has a system of 9 rules designed to protect the integrity of the system

There are five certification rules that test to see if the system is in a valid state

There are four enforcement rules that give requirements for the system

Certification Rules 1 and 2

CR1: When any IVP is run, it must ensure that all CDIs are in a valid state

CR2: For some associated set of CDIs, a TP must transform those CDIs in a valid state into a (possibly different) valid state By inference, a TP is only certified to

work on a particular set of CDIs

Enforcement Rules 1 and 2 ER1: The system must maintain the certified

relations, and must ensure that only TPs certified to run on a CDI manipulate that CDI

ER2: The system must associate a user with each TP and set of CDIs. The TP may access those CDIs on behalf of the associated user. If the user is not associated with a particular TP and CDI, then the TP cannot access that CDI on behalf of that user. Thus, a user is only allowed to use certain TPs on

certain CDIs

Certification Rule 3 and Enforcement Rule 3

CR3: The allowed relations must meet the requirements imposed by the principle of separation of duty

ER3: The system must authenticate each user attempting to execute a TP In theory, this means that users don't

necessarily have to log on if they are not going to interact with CDIs

Certification Rules 4 and 5 CR4: All TPs must append enough

information to reconstruct the operation to an append-only CDI Logging operations

CR5: Any TP that takes input as a UDI may perform only valid transformations, or no transformations, for all possible values of the UDI. The transformation either rejects the UDI or transforms it into a CDI Gives a rule for bringing new information into

the integrity system

Enforcement Rule 4

ER4: Only the certifier of a TP may change the list of entities associated with that TP. No certifier of a TP, or of any entity associated with that TP, may ever have execute permission with respect to that entity. Separation of duties

Clark-Wilson summary

Designed close to real commercial situations No rigid multilevel scheme Enforces separation of duty

Certification and enforcement are separated

Enforcement in a system depends simply on following given rules

Certification of a system is difficult to determine

Mid-Semester Feedback

Upcoming

Next time…

Chinese Wall and Biba models Theoretical limitations (HRU result) Trusted system design elements Yuki Gage presents

Reminders

Read Sections 5.1 – 5.3 Keep working on Project 2