information flow analysis信息安全概論課件06

November25,2008Copyright?2008byJingshaHe1IntroductiontoInformationSecurityProf.JingshaHeSchoolofSoftwareEngineeringBeijingUniversityofTechnologyNovember25,20081Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe2FactoftheLectureQuantumcomputingisatheoreticalwayofusingthepropertiesofmatteratthequantummechanical(microscopic)levelinordertobuildcomputationalsystems.Quantumcomputerswouldnotworklikeordinarycomputers,butonawholenewprinciple.Ithasbeentheorizedthatquantumcomputerscouldbreakstandardencryptioncodesinafractionofasecond.Theraceisontobuildquantumcomputers.November25,20082Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe3PracticesInformationFlowAnalysisNovember25,20083Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe4Identification&AuthenticationEncryption&DecryptionAccessControlCEOIdentification&AuthenticationEncryption&DecryptionRegularEmployeeInformationFlowAuditingNovember25,20084Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe5InformationFlowPolicyAnyconfidentialityandintegritymodelembodiesaninformationflowpolicyThereisthustheneedforassurancethatinformationflowdoesn'tviolatetheconstraintsofsuchapolicyAccesscontrolcanconstraintherightsofauser,butnottheflowofinformationbetweensubjectsorobjectsThereisthustheneedformechanismsthatcontroltheflowofinformationinadditiontoaccesscontrolExampleIntheBell-LaPadulamodel,informationcanflowfromoneobjecttoanotherifandonlyifthesecondobjectdominatesthefirstNovember25,20085Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe6DefinitionofInformationFlowComponentsObjectxObjectySequenceofcommandsSDefinitionInformationflowsfromobjectxtoobjectyif,aftertheexecutionofthesequenceofcommandsS,thevalueinobjectyallowsonetodeducethevalueinobjectxNotationy←xxiscalledthesourceoftheinformationflowyiscalledthetargetoftheinformationflowNovember25,20086Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe7SecurityConstraintsonInformationFlowTheBell-LaPadulamodely←xissecureifandonlyifthesecuritylevelofydominatesthatofxNotationsx:securitylevelofx≥:dominate≤:dominatedbyy←xrequiresthaty

≥

x(orx

≤

y)November25,20087Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe8TypesofInformationFlowStronginformationflowy←xaccordingtothedefinitionValueofxdirectly/explicitlyaffectsthevalueofyy=f(x)f()isanarithmeticexpressionWeakinformationflowy←xaccordingtothedefinitionValueofxindirectly/implicitlyaffectsthevalueofyIf(f1(x))theny=f2(a)elseB=f3(b)f1(),f2()andf3()arearithmeticexpressionsaandbareobjects.November25,20088Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe9InformationFlowinProgramsProgramstatementsAssignmentstatementCompoundstatementConditionalstatementIterativestatementGotostatementProcedurecallFunctioncallInput/outputstatementNovember25,20089Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe10AssignmentStatementStatementy=f(x1,x2,…,xn)InformationflowsStronginformationflowsy←x1y←x2 ……y←xnWeakinformationflowsNoneSecurityrequirementlub(x1,x2,…xn)≤

yNovember25,200810Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe11ExampleofAssignmentStatementStatementa=b+c-dInformationflowsStronginformationflowsa←ba←ca←dWeakinformationflowsNoneSecurityrequirementlub(b,c,d)≤

aNovember25,200811Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe12CompoundStatementStatementbegin S1; …… Sn;end;InformationflowsAlltheinformationflowsinstatementSi,1≤i≤nSecurityrequirementS1issecure……SnissecureNovember25,200812Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe13ConditionalStatementStatementIff(x1,x2,…,xn)thenS1;else S2;end;InformationflowsAlltheinformationflowsincompoundstatementsS1andS2Weakinformationflowsy←x1,y←x2,…,y←xnyisthetargetofanassignmentstatementinS1andS2SecurityrequirementS1issecureS2issecurelub(x1,x2,…,xn)≤

glb(y)yisthetargetofanassignmentstatementinS1andS2November25,200813Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe14ExampleofConditionalStatementStatementIfx+y≤zthena=b;else c=b;end;InformationflowsStronginformationflowsa←b,c←bWeakinformationflowsa←x,a←y,a←zc←x,c←y,c←zSecurityrequirementb

≤

ab

≤

club(x,y,z)≤glb(a,c)November25,200814Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe15IterativeStatementStatementwhilef(x1,x2,…,xn)doS1;S2;InformationflowsAlltheinformationflowsincompoundstatementS1Weakinformationflowsy←x1,y←x2,…,y←xnyisthetargetofanassignmentstatementinS1Note:thestatementisrequiredtoterminateWhatifnot?Hint:whatistheconsequencetoS2?SecurityrequirementS1issecurelub(x1,x2,…,xn)≤

glb(y)yisthetargetofanassignmentstatementinS1November25,200815Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe16GotoStatementStatementiff(x1,x2,…,xn)thenS1;gotolabel;S2;label:S3;InformationflowsAlltheinformationflowsincompoundstatementsS1,S2,andS3Weakinformationflowsy←x1,y←x2,…,y←xnyisthetargetofanassignmentstatementinS1,S2andS3SecurityrequirementS1issecureS2issecureS3issecurelub(x1,x2,…,xn)≤

glb(y)yisthetargetofanassignmentstatementinS1,S2andS3November25,200816Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe17ProcedureCallStatementprocpname(i1,i2,…,im:int;varo1,o2,…,on:int);beginS;end;……pname(x1,x2,…,xm;y1,y2,…,yn);InformationflowsAlltheinformationflowsincompoundstatementSNote:intheabsenceofprocedurecalldetail,ok

←ij,1≤j≤m,1≤k≤nSecurityrequirementSissecureIfij

≤

ok,thenxj

≤

yk,1≤j≤m,1≤k≤nIfoj

≤

ok,thenyj

≤

yk,1≤j≤n,1≤k≤nNovember25,200817Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe18FunctionCallStatementintf(i1,i2,…,in:int);beginS;end;……y=f(x1,x2,…,xn);InformationflowsAlltheinformationflowsincompoundstatementSNote:intheabsenceoffunctioncalldetail,f()←ik,1≤k≤nSecurityrequirementSissecureIfik

≤

f(),thenxk

≤

y,1≤k≤nNovember25,200818Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe19Input/OutputStatementStatementcanbemodeledafteranassignmentstatementForaninputstatementSourcecanbeadevicenameobjectorafilenameobjectTargetcanbeafilenameobjectoraregularprogramvariableobjectForanoutputstatementSourcecanbeafilenameobjectoraregularprogramvariableobjectTargetcanbeadevicenameobjectorafilenameobjectNovember25,200819Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe20OtherInformationFlows(1)Arrayelementsy=a[i]Stronginformationflows:y←a[i],y←ia[i]=xStronginformationflows:a[i]←xInfiniteloopsandexceptionsy=0;while(x=0)doy=1;AnalysisIfx=0,theny=1andtheexecutionentersintoaninfiniteloop(andx

≤

ycouldbeenforcedtomeetsecurityrequirement)Ifx≠0,theny=0andtheexecutionterminates(butx

≤

ywouldnotbeenforced)Result:y←xNovember25,200820Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe21OtherInformationFlows(2)Pointers&y=&xStronginformationflows:&y←&xResultinginformationflows(x=z)?(y=z)x←z?y←z(y=z)?(x=z)y←z?x←zConsequenceTheaddressassignment(&y=&xor&x=&y)nowmakesxandythesameobjectfromtheviewpointofinformationflowsbecausethesamememory/storagecellisnowrepresentedbytwodifferentvariables/symbols,i.e.,xandyResult:y?xNovember25,200821Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe22ProgramSecurityCertificationofthesecurityofaprogramThestraightforwardmethodDetermineinformationflowsforeachtypeofstatementsbasedonthesemanticsofthestatementsCertifythesecurityofeachandeveryprogramstatementinasequentialorderIssuesItisalmostimpossibletodosoinastaticmannerIftrue,thenwhat?VariablesarenotalwaysequivalenttoobjectsLocalvariablesifalocalvariableisthetargetofaninformationflow,itssecuritylevelmustbesettothe“l(fā)ub”ofthesecuritylevelsofallthesourcesregardlessofitscurrentsecuritylevelNovember25,200822Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe23ConfinementProblemProblemstatementTopreventaservicefromleakinginformationthatisregardedasbeingconfidentialbytheuseroftheserviceProblemdomainInformationflowsthatviolatethepropertiesintheBell-LaPadulamodelInformationcanonlybeallowedtoflowupwardsaccordingtothemodelTotalconfinementIsolationCannotbeobservedbyothersCannotbeallowedtocommunicatewithothersVerydifficult,ifnotimpossibleResourcesharingDirectandindirectcommunicationNovember25,200823Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe24ExamplesInageneral-purposecomputersysteminwhichCPU,memory,diskspace,I/OsareallsharedresourcesforprocessesexecutingonbehalfoftheusersAusercandeducetheexecutionstatusofanotherprocessByobservingthespeedortheexecutionstatusofaprocessinitiatedbytheuserByaccessingadataiteminthememoryoronthediskintowhichtheotherprocessissupposedtowriteInacommunicationsysteminwhichservicesareprovidedinresponsetouserrequestsAusercandeducetheexecutionstatusofanotherprocessByrequestingaservicethattheotherprocessisknowntoalsouseByrequestingaserviceoverwhichtheotherprocessisknowntohavetheabilitytoinfluenceNovember25,200824Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe25LeakingofInformationPassiveAreceiveronly(inviolationofinformationflowpolicy)ExploringsystemsecurityflawsObservingthestatusorvalueofsystemstateIndirectlyinvokingandobservingcertainsystemoperationsbysettingtrueofthenecessaryconditionsActiveorcollaborativeBothasenderandareceiver(inviolationofinformationflowpolicy)ExploringsystemsecurityflawsSettingandobservingthestatusorvalueofsystemstateDirectlyinvokingandobservingcertainsystemoperationswithorwithoutsettingtrueofthenecessaryconditionsNovember25,200825Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe26CovertChannelsDefinitionApathofcommunicationthatisNOTdesignedtobeusedforcommunicationPropertiesAnactiveorcollaborativewayofleakinginformationSecuritychecksareusuallynotimposedNecessaryconditionsAsenderAreceiverResourcesharingTypesofcovertchannelsStorage(spatial)ResourceexhaustionchannelsEventcountingchannelsTiming(temporal)November25,200826Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe27ChannelClassificationsNoiselesscovertchannelsThesharedresourcethatisusedforinformationtransmissionisavailabletothesenderandthereceiveronlyInformationtransmittedthroughthechannelscomesonlyfromthesenderNoisycovertchannelsThesharedresourcethatisusedforinformationtransmissionisalsoavailabletootherusersorsubjectsinadditiontothesenderandthereceiverInformationtransmittedthroughthechannelsismixedtogetherwithmeaningless/uselessinformation(i.e.,thenoise)introducedduetoaccesstothesharedresourcebytheotherusersorsubjectsNovember25,200827Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe28StorageChannelsNecessaryconditionsResourcesharingBoththesendingandreceivingprocessesmusthaveaccesstothesameattributeofasharedresourceInformationsendingThesendingprocessmustbeabletomodifythatattributeofthesharedresourceInformationreceivingThereceivingprocessmustbeabletoreferencethatattributeofthesharedresourceSynchronizationorcoordinationTheremustexistamechanismforinitiatingboththesendingandthereceivingprocessesandforsynchronizing/sequencingtheiraccessestothatattributeofthesharedresourcebytheprocessesNovember25,200828Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe29ResourceExhaustionChannelsMechanismThroughexhaustingasharedresourceExampleSharedresource:memorySendingprocessTransmitting“1”:takingall(exhausting)theavailablememoryTransmitting“0”:leavingsomememoryforotherprocessestouseReceivingprocessReceiving“1”:requestingmemory,resultinginfailureReceiving“0”:requestingmemory,resultinginsuccessInformationistransmittedbythesendingprocesstothereceivingprocessonebitatatimeSpecialpropertiesTakingadvantageofthefactthatresourcesarelimitedandaresharedUsingtheboundaryconditiontoencodeinformationRelyingonthefactthatresourceexhaustionisaglobalstatusthatcanbeobservedbytherequestingprocessDuetotherealitythatusuallynosecuritychecksareimposedNovember25,200829Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe30EventCountingChannelsMechanismThroughmodifyingthevalueofasharedcounterExampleSharedresource:processIDSendingprocessTransmitting“1”:requestinganewprocessID,resultinginincrementtotheprocessIDcounterTransmitting“0”:leavingtheprocessIDcounteraloneReceivingprocessReceiving“1”:requestinganewprocessIDandobservingtheincrementReceiving“0”:requestinganewprocessIDandobservingacontinuousvalueInformationistransmittedbythesendingprocesstothereceivingprocessonebitatatimeSpecialpropertiesTakingadvantageofthefactthatcountervaluesareincrementallyassignedUsingtheincrementtoencodeinformationRelyingonthefactthatthevalueofasharedcounterisaglobalvalueDuetotherealitythatusuallynosecuritychecksareimposedNovember25,200830Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe31TimingChannelsNecessaryconditionsResourcesharingBoththesendingandreceivingprocessesmusthaveaccesstothesameattributeofasharedresourceReferenceoftimingBoththesendingandthereceivingprocessesmusthaveaccesstoacommontimereference,suchasatimer,areal-timeclock,ortheorderingofeventsInformationsendingandreceivingThesendingprocessmustbeabletocontrolthetimingofthedetectionofachangeintheattributebythereceivingprocessSynchronizationorcoordinationTheremustexistamechanismforinitiatingboththesendingandthereceivingprocessesandforsynchronizing/sequencingtheiraccessestothatattributeofthesharedresourcebytheprocessesNovember25,200831Copyright?2008byJingshaHeNovember25,2008Copyright?2008byJingshaHe32AnExampleofTimingChannelsMechanismThroughcontrollingtheexecutionofaprocessExampleSharedresource:CPUSharedtimereference:thesystemclockSendingprocessTransmitting“1”:requestingoneCPUslotforprocessexecutionTransmitting“0”:leavingtheCPUaloneReceivingprocessReceiving“1”:requestingoneCPUslotandobservingalongercompletiontimeReceiving“0”:requestingoneCPUslotandobservingashortercompletiontimeInformationistransmittedbythesendingprocesstothereceivingprocessonebitatatimeSpecialpropertiesTakingadvantageofthefactthatC