計算機操作系統（第3版）課件 第15章 安全

第15章安全保護嚴格來講是內部問題，應該是以一種怎樣的方式來提供對存儲在計算機系統中的程序和數據的受控訪問。安全除了需要一個適當的保護系統外，還需要考慮系統運行的外部環境。安全是對系統完整性和系統數據安全的可信度的衡量。第15章安全本章目標討論了安全威脅和攻擊解釋加密、認證和哈希函數基礎計算中密碼的使用各種抵御安全攻擊的對策15.1安全問題威脅意味著對違反安全的潛在危險，如漏洞。攻擊則是試圖破壞安全。計算機系統在安全性上受到威脅的方式通常有下面的四種：（1）切斷：系統的資源被破壞或變的不可用或不能用。這是對可用性的威脅，如破壞硬盤、切斷通信線路或使文件管理失效。（2）截取：未經授權的用戶、程序或計算機系統獲得了對某資源的訪問。這是對機密性的威脅，如在網絡中竊取數據及非法拷貝文件和程序。（3）篡改：未經授權的用戶不僅獲得了對某資源的訪問，而且進行篡改。這是對完整性的攻擊，如修改數據文件中的值，修改網絡中正在傳送的消息內容。（4）偽造：未經授權的用戶將偽造的對象插入到系統中。這是對合法性的威脅，如非法用戶把偽造的消息加到網絡中或向當前文件加入記錄。SecurityViolationsCategoriesBreachofconfidentialityBreachofintegrityBreachofavailabilityTheftofserviceDenialofserviceMethodsMasquerading(breachauthentication)ReplayattackMessagemodificationMan-in-the-middleattackSessionhijackingStandardSecurityAttacksSecurityMeasureLevelsSecuritymustoccuratfourlevelstobeeffective:PhysicalHumanAvoidsocialengineering,phishing,dumpsterdivingOperatingSystemNetworkSecurityisasweekastheweakestchain15.2程序威脅TrojanHorseCodesegmentthatmisusesitsenvironmentExploitsmechanismsforallowingprogramswrittenbyuserstobeexecutedbyotherusersSpyware,pop-upbrowserwindows,covertchannelsTrapDoorSpecificuseridentifierorpasswordthatcircumventsnormalsecurityproceduresCouldbeincludedinacompilerLogicBombProgramthatinitiatesasecurityincidentundercertaincircumstancesStackandBufferOverflowExploitsabuginaprogram(overfloweitherthestackormemorybuffers)CProgramwithBuffer-overflowCondition#include<stdio.h>#defineBUFFERSIZE256intmain(intargc,char*argv[]){ charbuffer[BUFFERSIZE]; if(argc<2) return-1; else{ strcpy(buffer,argv[1]); return0; }}LayoutofTypicalStackFrameModifiedShellCode#include<stdio.h>intmain(intargc,char*argv[]){ execvp(‘‘\bin\sh’’,‘‘\bin\sh’’,NULL); return0;}HypotheticalStackFrameBeforeattackAfterattackProgramThreats(Cont.)VirusesCodefragmentembeddedinlegitimateprogramVeryspecifictoCPUarchitecture,operatingsystem,applicationsUsuallyborneviaemailorasamacroVisualBasicMacrotoreformatharddriveSubAutoOpen()DimoFS SetoFS=CreateObject(’’Scripting.FileSystemObject’’) vs=Shell(’’c:/kformat c:’’,vbHide)EndSubProgramThreats(Cont.)VirusdropperinsertsvirusontothesystemManycategoriesofviruses,literallymanythousandsofvirusesFileBootMacroSourcecodePolymorphicEncryptedStealthTunnelingMultipartiteArmoredABoot-sectorComputerVirus15.3系統和網絡威脅Worms–usespawnmechanism;standaloneprogramInternetwormExploitedUNIXnetworkingfeatures(remoteaccess)andbugsinfingerandsendmailprogramsGrapplinghookprogramuploadedmainwormprogramPortscanningAutomatedattempttoconnecttoarangeofportsononeorarangeofIPaddressesDenialofServiceOverloadthetargetedcomputerpreventingitfromdoinganyusefulworkDistributeddenial-of-service(DDOS)comefrommultiplesitesatonceTheMorrisInternetWorm15.4作為安全工具的密碼術BroadestsecuritytoolavailableSourceanddestinationofmessagescannotbetrustedwithoutcryptographyMeanstoconstrainpotentialsenders(sources)and/orreceivers(destinations)ofmessagesBasedonsecrets(keys)SecureCommunicationoverInsecureMediumEncryptionEncryptionalgorithmconsistsofSetofKkeysSetofMMessagesSetofCciphertexts(encryptedmessages)AfunctionE:K→(M→C).Thatis,foreachk

K,E(k)isafunctionforgeneratingciphertextsfrommessages.BothEandE(k)foranykshouldbeefficientlycomputablefunctions.AfunctionD:K→(C→M).Thatis,foreachk

K,D(k)isafunctionforgeneratingmessagesfromciphertexts.BothDandD(k)foranykshouldbeefficientlycomputablefunctions.Anencryptionalgorithmmustprovidethisessentialproperty:Givenaciphertext

c

C,acomputercancomputemsuchthatE(k)(m)=conlyifitpossessesD(k).Thus,acomputerholdingD(k)candecryptciphertextstotheplaintextsusedtoproducethem,butacomputernotholdingD(k)cannotdecryptciphertexts.Sinceciphertextsaregenerallyexposed(forexample,sentonthenetwork),itisimportantthatitbeinfeasibletoderiveD(k)fromtheciphertextsSymmetricEncryptionSamekeyusedtoencryptanddecryptE(k)canbederivedfromD(k),andviceversaDESismostcommonlyusedsymmetricblock-encryptionalgorithm(createdbyUSGovt)EncryptsablockofdataatatimeTriple-DESconsideredmoresecureAdvancedEncryptionStandard(AES),twofishupandcomingRC4ismostcommonsymmetricstreamcipher,butknowntohavevulnerabilitiesEncrypts/decryptsastreamofbytes(i.ewirelesstransmission)Keyisainputtopsuedo-random-bitgeneratorGeneratesaninfinitekeystreamAsymmetricEncryptionPublic-keyencryptionbasedoneachuserhavingtwokeys:publickey–publishedkeyusedtoencryptdataprivatekey–keyknownonlytoindividualuserusedtodecryptdataMustbeanencryptionschemethatcanbemadepublicwithoutmakingiteasytofigureoutthedecryptionschemeMostcommonisRSAblockcipherEfficientalgorithmfortestingwhetherornotanumberisprimeNoefficientalgorithmisknowforfindingtheprimefactorsofanumberAsymmetricEncryption(Cont.)Formally,itiscomputationallyinfeasibletoderiveD(kd,N)fromE(ke,N),andsoE(ke

,N)neednotbekeptsecretandcanbewidelydisseminatedE(ke,N)(orjustke)isthepublickeyD(kd,N)(orjustkd)istheprivatekeyNistheproductoftwolarge,randomlychosenprimenumberspandq(forexample,pandqare512bitseach)EncryptionalgorithmisE(ke,N)(m)=mke

modN,whereke

satisfieskekd

mod(p?1)(q?1)=1ThedecryptionalgorithmisthenD(kd,N)(c)=ckd

modNAsymmetricEncryptionExampleForexample.makep=7andq=13WethencalculateN=7?13=91and(p?1)(q?1)=72Wenextselectke

relativelyprimeto72and<72,yielding5Finally,wecalculatekd

suchthatkekd

mod72=1,yielding29WehowhaveourkeysPublickey,ke,N=5,91Privatekey,kd,N=29,91Encryptingthemessage69withthepublickeyresultsinthecyphertext62CyphertextcanbedecodedwiththeprivatekeyPublickeycanbedistributedincleartexttoanyonewhowantstocommunicatewithholderofpublickeyEncryptionandDecryptionusingRSAAsymmetricCryptographyCryptography(Cont.)Notesymmetriccryptographybasedontransformations,asymmetricbasedonmathematicalfunctionsAsymmetricmuchmorecomputeintensiveTypicallynotusedforbulkdataencryptionAuthenticationConstrainingsetofpotentialsendersofamessageComplementaryandsometimesredundanttoencryptionAlsocanprovemessageunmodifiedAlgorithmcomponentsAsetKofkeysAsetMofmessagesAsetAofauthenticatorsAfunctionS:K→(M→A)Thatis,foreachk

K,S(k)isafunctionforgeneratingauthenticatorsfrommessagesBothSandS(k)foranykshouldbeefficientlycomputablefunctionsAfunctionV:K→(M×A→{true,false}).Thatis,foreachk

K,V(k)isafunctionforverifyingauthenticatorsonmessagesBothVandV(k)foranykshouldbeefficientlycomputablefunctionsAuthentication(Cont.)Foramessagem,acomputercangenerateanauthenticatora

AsuchthatV(k)(m,a)=trueonlyifitpossessesS(k)Thus,computerholdingS(k)cangenerateauthenticatorsonmessagessothatanyothercomputerpossessingV(k)canverifythemComputernotholdingS(k)cannotgenerateauthenticatorsonmessagesthatcanbeverifiedusingV(k)Sinceauthenticatorsaregenerallyexposed(forexample,theyaresentonthenetworkwiththemessagesthemselves),itmustnotbefeasibletoderiveS(k)fromtheauthenticatorsAuthentication–HashFunctionsBasisofauthenticationCreatessmall,fixed-sizeblockofdata(messagedigest,hashvalue)frommHashFunctionHmustbecollisionresistantonmMustbeinfeasibletofindanm’≠msuchthatH(m)=H(m’)IfH(m)=H(m’),thenm=m’ThemessagehasnotbeenmodifiedCommonmessage-digestfunctionsincludeMD5,whichproducesa128-bithash,andSHA-1,whichoutputsa160-bithashAuthentication-MACSymmetricencryptionusedinmessage-authenticationcode(MAC)authenticationalgorithmSimpleexample:MACdefinesS(k)(m)=f(k,H(m))Wherefisafunctionthatisone-wayonitsfirstargumentkcannotbederivedfromf(k,H(m))Becauseofthecollisionresistanceinthehashfunction,reasonablyassurednoothermessagecouldcreatethesameMACAsuitableverificationalgorithmisV(k)(m,a)≡(f(k,m)=a)NotethatkisneededtocomputebothS(k)andV(k),soanyoneabletocomputeonecancomputetheotherAuthentication–DigitalSignatureBasedonasymmetrickeysanddigitalsignaturealgorithmAuthenticatorsproducedaredigitalsignaturesInadigital-signaturealgorithm,computationallyinfeasibletoderiveS(ks

)fromV(kv)Visaone-wayfunctionThus,kv

isthepublickeyandks

istheprivatekeyConsidertheRSAdigital-signaturealgorithmSimilartotheRSAencryptionalgorithm,butthekeyuseisreversedDigitalsignatureofmessageS(ks

)(m)=H(m)ks

modNThekeyks

againisapaird,N,whereNistheproductoftwolarge,randomlychosenprimenumberspandqVerificationalgorithmisV(kv)(m,a)≡(akv

modN=H(m))Wherekv

satisfieskvks

mod(p?1)(q?1)=1Authentication(Cont.)Whyauthenticationifasubsetofencryption?Fewercomputations(exceptforRSAdigitalsignatures)AuthenticatorusuallyshorterthanmessageSometimeswantauthenticationbutnotconfidentialitySignedpatchesetalCanbebasisfornon-repudiationKeyDistributionDeliveryofsymmetrickeyishugechallengeSometimesdoneout-of-bandAsymmetrickeyscanproliferate–storedonkeyringEvenasymmetrickeydistributionneedscare–man-in-the-middleattackMan-in-the-middleAttackonAsymmetricCryptographyDigitalCertificatesProofofwhoorwhatownsapublickeyPublickeydigitallysignedatrustedpartyTrustedpartyreceivesproofofidentificationfromentityandcertifiesthatpublickeybelongstoentityCertificateauthorityaretrustedparty–theirpublickeysincludedwithwebbrowserdistributionsTheyvouchforotherauthoritiesviadigitallysigningtheirkeys,andsoonEncryptionExample-SSLInsertionofcryptographyatonelayeroftheISOnetworkmodel(thetransportlayer)SSL–SecureSocketLayer(alsocalledTLS)CryptographicprotocolthatlimitstwocomputerstoonlyexchangemessageswitheachotherVerycomplicated,withmanyvariationsUsedbetweenwebserversandbrowsersforsecurecommunication(creditcardnumbers)TheserverisverifiedwithacertificateassuringclientistalkingtocorrectserverAsymmetriccryptographyusedtoestablishasecuresessionkey(symmetricencryption)forbulkofcommunicationduringsessionCommunicationbetweeneachcomputerthebusessymmetrickeycryptography15.5用戶認證Crucialtoidentifyusercorrectly,asprotectionsystemsdependonuserIDUseridentitymostoftenestablishedthroughpasswords,canbeconsideredaspecialcaseofeitherkeysorcapabilitiesAlsocanincludesomethinguserhasand/orauserattributePasswordsmustbekeptsecretFrequentchangeofpasswordsUseof“non-guessable”passwordsLogallinvalidaccessattemptsPasswordsmayalsoeitherbeencryptedorallowedtobeusedonlyonce15.6實現安全防御Defenseindepthismostcommonsecuritytheory–multiplelayersofsecuritySecuritypolicydescribeswhatisbeingsecuredVulnerabilityassessmentcomparesrealstateofsystem/networkcomparedtosecuritypolicyIntrusiondetectionendeavorstodetectattemptedorsuccessfulintrusionsSignature-baseddetectionspotsknownbadpatternsAnomalydetectionspotsdifferencesfromnormalbehaviorCandetectzero-dayattacksFalse-positivesandfalse-negativesaproblemVirusprotectionAuditing,accounting,andloggingofallorspecificsystemornetworkactivities15.7保護系統和網絡的防火墻AnetworkfirewallisplacedbetweentrustedanduntrustedhostsThefirewalllimitsnetworkaccessbetweenthesetwosecuritydomainsCanbetunneledorspoofedTunnelingallowsdisallowedprotocoltotravelwithinallowedprotocol(i.e.telnetinsideofHTTP)FirewallrulestypicallybasedonhostnameorIPaddresswhichcanbespoofedPersonalfirewallissoftwarelayerongivenhostCanmonitor/lim