Operating System Security

System Security

• Focuses on protecting the Operating System (OS).
• Includes considerations for file access and user authentication.
• System software manages application software to maintain security.

General Purpose OS

• Modern OSes protect the controlled sharing of objects.
• Objects include hardware and software, each with a unique name.
• Objects are accessed through defined operations.

Protection

• Needed to prevent intentional or mischievous violations of access restrictions.
• Protection-oriented systems distinguish between authorized and unauthorized usage.
• Guarantees program components use system resources consistent with stated policies.
• Provides mechanisms for policy enforcement.
• Application programmers use protection mechanisms to guard resources against misuse.

Protected Objects

• Include memory, shareable I/O devices like disks and printers, programs, and libraries like Dynamic Link Libraries (DLLs).
• Extends to networks and shareable data, such as databases.
• Addresses a problem: ensuring that only authorized processes correctly access objects.

Security Methods

• Protection is based on separation.
• Types of separation include:
  • Physical separation: uses different physical hardware for different processes.
  • Temporal separation: executes processes at different times.
  • Logical separation: creates the illusion that no other processes exist.
  • Cryptographic separation: each process encrypts its data and computations.
• Physical and temporal separation do not utilize resources well.
• Cryptographic separation requires too many resources.

Resource Sharing

• Sharing methods include:
  • Not protecting at all, relying on temporal separation.
  • Isolation: processes are unaware of each other and have their own memory space.
  • Sharing all or nothing: the owner declares resources as public or private.
  • Sharing via limited access, with the OS checking permissions.
  • Limiting user actions with accessed objects, for example, allowing viewing but not printing.

Memory Protection

• A crucial need in a multi-programmed OS.
• Includes protection between the operating system and user programs.
• Also, protection among user programs.
• Can be built into hardware.

Fence

• Employed in single-user OSs like DOS.
• Prevents faulty user programs from affecting memory-resident OS sections.
• Achieved in hardware by placing a "fence" between the OS and user programs.

Fence Register

• Addresses the limitation of fixed memory space in hardware fences.
• Stores the address at the end of the OS.
• Protects the OS but not between user programs.

Relocation

• Like using a fence register, relocation lets OS memory allocation be dynamically changed.
• Involves taking a program written as if it started at address 0 and changing all addresses to reflect the actual address in memory.
• Achieved using a fence register.
• User programs' memory addresses are relative to a "relocation factor."

Bound Registers

• Fence registers act as the lower bound or starting address for user programs, also known as the base register.
• A "bound register" is used to limit the program's upper memory usage.
• Each user program is confined to its address space.
• OS context switching includes switching the base and bound registers.
• Protects users from each other.

Tagged Architectures

• Used when different memory parts need different protection levels.
• Each memory location has extra bits for the OS to identify access rights.

Segmentation

• Process creates address spaces of various sizes, called segments, in a computer system.
• Segmentation is an extension of the base/bound registers.
• Programs are divided into separate pieces.
• This creates a segment address table for each process.
• Segments are addressed by <name, offset> pairs.
• Memory addresses consist of a segment ID and an offset inside the segment.
• Effectively offers an "unlimited" number of base/bound registers.
• Each segment is tagged for different permissions.

Segmentation Details

• A program segment contains main functions, utility functions, and data structures.
• The OS keeps a segment map table for each process, with free memory blocks.
• For each segment, the table stores the start address and length.
• A memory location reference includes a segment identifier and an offset.

Segmentation Features

• Enables segments to be moved and placed in any memory location, even during execution.
• Segments can be moved off main memory when not in use.
• Address references pass through the OS, making protection checks available.

Segmentation Security

• Each address reference has protection.
• Different data items are assigned different protection levels.
• Segments can be shared among users/programs with differing access rights.
• Prevents users from accessing other memory areas as they are invisible.

Paging

• Fixed-size segmentation.
• Programmers don't have to check segment memory size, unlike in segmentation.
• A fault occurs if a program goes beyond its memory boundaries.
• Lacks the flexibility of different protection levels for each segment found in segmentation.

Access Control

• Pertains to protecting files.
• Addresses who can access what objects and how. Basic Concept of Access Control
• A subject can access an object in a specific mode, with only authorized accesses allowed.
• Subjects are human users (or programs running on their behalf).
• Objects are items on which actions are performed.
• Access modes include read, write, modify, execute, etc.

Access Control Principles

• Check every access as user privileges change.
• Enforce least privilege by providing only enough privileges to perform tasks,
• Verify acceptable usage for proper usage, for example, one can view but not edit.

Domain of Protection

• Processes should access only authorized resources.
• They should access only resources needed to complete their tasks (need-to-know principle).
• Limits the damage from faulty processes.
• A process operates within a protection domain that specifies accessible resources.

Domain Structure

• The ability to perform an operation on an object.
• Access-right = <object-name, rights-set>
• Association between process and domain are static or dynamic.
• Domains can be treated as subjects or users in this lecture.

Directory-Based Protection

• A straightforward way to protect objects in an OS.
• A global list managed by the OS that is called a directory which lists file permissions.
• Is easy to implement.

Drawbacks of Directory-Based Protection

• Large multi-user systems need an entry for each user, which is inefficient.
• Revoking access is time-consuming.
• Handling pseudonyms or same-named files shared among users introduces complexity.

Access Control List (ACL)

• Per-object based, not per user.
• Reduced overhead by not requiring entries for every user.
• Generally has default access rights.

Access Matrix

• Represents protection as a matrix.
• Rows represent users (domains).
• Columns represent objects.
• Access(i, j) is the set of operations a process in Domain i can invoke on Object j.

Use of Access Matrix

• A process in Domain Di can only do "op" on Object Oj if "op" is in the access matrix.
• Supports dynamic protection through operations to add/delete access rights.
• Special access rights include "Own" (owner of O), "copy op," "control" (modify access rights), and "transfer" (switch domains).

Access Matrix Design

• Separates mechanism and policy.
• The OS provides the access matrix and rules.
• Ensures authorized agents only manipulate the matrix.
• Sets user policies.
• Determines who can access what objects and how.