label and event processes in asbestos n.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
Label and Event Processes in Asbestos PowerPoint Presentation
Download Presentation
Label and Event Processes in Asbestos

Loading in 2 Seconds...

play fullscreen
1 / 18

Label and Event Processes in Asbestos - PowerPoint PPT Presentation


  • 81 Views
  • Uploaded on

Label and Event Processes in Asbestos. Af Troels Munk Haar. Oversigt. Mandatory Access Control Asbestos overordnet Asbestos labels Asbestos event proces Covert chanels Implementeringseksempel. Mandatory Access Control. Grundlæggende Sikkerhedsniveauer og kategorier

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'Label and Event Processes in Asbestos' - washi


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
oversigt
Oversigt

Mandatory Access Control

Asbestos overordnet

Asbestos labels

Asbestos event proces

Covert chanels

Implementeringseksempel

mandatory access control
Mandatory Access Control
  • Grundlæggende
  • Sikkerhedsniveauer og kategorier
  • Foruddefinerede kategorier
  • *-egenskaben
mac forts
MAC forts.

*-egenskaben

Q

Unclassified information

P

Adgang: U,S,T

R

Adgang: U,S

Unclassified information

Adgang: U

asbestos
Asbestos
  • Dynamiske oprettelse af afdelinger
  • Bypass af *-egenskaben
  • Kommunikationsporte til beskeder
    • Pipe- og filtilgang via porte
  • Asynkrone og upålidelige beskeder
  • Mulig pålidelighed i praksis
asbestos labels
Asbestos labels
  • Labels som funktioner
  • MAC skemaer
  • Contamination
  • Separate send/modtag labels
  • Privilegier [*,0,1,2,3]
  • Notation
file server eksempel
File Server Eksempel

U: Shell

User u

UT: Terminal

User u

US = {uT3,1}

UR = {uT3,2}

UTS = {uT3,1}

UTR = {uT3,2}

FS

File Server

Users u and v

V: Shell

User v

VS = {vT3,1}

VR = {vT3,2}

contamination levels
Contamination levels
  • Hæve contamination level
  • Defaultværdier
    • Brugerinformation (uT3)
    • Send og modtag
    • Alternativ
  • Flerniveaupolitiker

U: Shell

User u

UT: Terminal

User u

Us = {vT2,uT2,1}

UR = {uT2,2}

Us = {uT2,1}

UR = {uT2,2}

UTs = {uT2,1}

UTR = {vT1,2}

FS

File Server

Users u and v

V: Shell

User v

Vs = {vT2,1}

VR = {vT2,2}

declassification decontamination
Declassification & decontamination
  • PS(h) = *
  • Filserveren
    • FSS = {uT*,vT*,1}
    • FSR = {uT3,vT3,2}
  • Decontaminate send / modtag DS og DR
    • Kræver decontamination rettigheder for h
integritet
Integritet
  • FS - Skriveadgang
  • Grant handle uG
  • PS(uG) ≤ 0
  • Asbestos: Verifikations label V
  • V = {uG0,3}, V(uG) ≤ 0
  • Obligatorisk integritet
forhindring af contamination
Forhindring af contamination
  • Mailprogram
  • Porte (port label pR)
  • Proces styrer egne port labels (default 0)
  • Bevilling af portrettigheder
    • DS = {p*,3}

Mail prog

Attachment

reader

High taint

event processer
Event Processer
  • Akkumulering af contamination
  • Forking: Lav ydelse
  • Threads: Ingen isolering
  • Event dispatch loop:

Klassisk dispatch loop:

Asbestos dispatch loop:

event processer1
Event Processer
  • Delprocestilstand pr. bruger
  • Kernen begrænser privilegier
  • Base proces > Event proces
    • ep_checkpoint
    • ep_yield
  • Kernen skedulerer event processer
  • Begrænset samtidighed og skedulerings-overhead
covert channels
Covert Channels
  • Timing channels
    • A påvirker ressource, der indvirker på B
    • Afhjælpes ved at begrænse præcision
  • Storage channels
    • A påvirker en tilstand, B kan observere
    • Afhjælpes ved at forhindre fork
web server
Web Server

Port: uC

Port label uCR: {uC0,2}

Port: uC

Port label uCR: {uC0,uT3,2}

u’s TCP connection

netd

Grant uw*; read/write

Grant uC*

Grant uT*

Lookup UN/PW

idd

ok-demux

Worker W

Grant uC*,uG*, Contaminate uT3

Grant uG*,uT*

Create W[u]

web server1
Web Server
  • Web sessions
  • Managing identities
  • Database interaction
    • ok-dbproxy
  • Evaluering
asbestos1
Asbestos
  • Spørgsmål?