计算机操作系统（第3版）课件 第15章 安全

第15章安全保护严格来讲是内部问题，应该是以一种怎样的方式来提供对存储在计算机系统中的程序和数据的受控访问。安全除了需要一个适当的保护系统外，还需要考虑系统运行的外部环境。安全是对系统完整性和系统数据安全的可信度的衡量。第15章安全本章目标讨论了安全威胁和攻击解释加密、认证和哈希函数基础计算中密码的使用各种抵御安全攻击的对策15.1安全问题威胁意味着对违反安全的潜在危险，如漏洞。攻击则是试图破坏安全。计算机系统在安全性上受到威胁的方式通常有下面的四种：（1）切断：系统的资源被破坏或变的不可用或不能用。这是对可用性的威胁，如破坏硬盘、切断通信线路或使文件管理失效。（2）截取：未经授权的用户、程序或计算机系统获得了对某资源的访问。这是对机密性的威胁，如在网络中窃取数据及非法拷贝文件和程序。（3）篡改：未经授权的用户不仅获得了对某资源的访问，而且进行篡改。这是对完整性的攻击，如修改数据文件中的值，修改网络中正在传送的消息内容。（4）伪造：未经授权的用户将伪造的对象插入到系统中。这是对合法性的威胁，如非法用户把伪造的消息加到网络中或向当前文件加入记录。SecurityViolationsCategoriesBreachofconfidentialityBreachofintegrityBreachofavailabilityTheftofserviceDenialofserviceMethodsMasquerading(breachauthentication)ReplayattackMessagemodificationMan-in-the-middleattackSessionhijackingStandardSecurityAttacksSecurityMeasureLevelsSecuritymustoccuratfourlevelstobeeffective:PhysicalHumanAvoidsocialengineering,phishing,dumpsterdivingOperatingSystemNetworkSecurityisasweekastheweakestchain15.2程序威胁TrojanHorseCodesegmentthatmisusesitsenvironmentExploitsmechanismsforallowingprogramswrittenbyuserstobeexecutedbyotherusersSpyware,pop-upbrowserwindows,covertchannelsTrapDoorSpecificuseridentifierorpasswordthatcircumventsnormalsecurityproceduresCouldbeincludedinacompilerLogicBombProgramthatinitiatesasecurityincidentundercertaincircumstancesStackandBufferOverflowExploitsabuginaprogram(overfloweitherthestackormemorybuffers)CProgramwithBuffer-overflowCondition#include<stdio.h>#defineBUFFERSIZE256intmain(intargc,char*argv[]){ charbuffer[BUFFERSIZE]; if(argc<2) return-1; else{ strcpy(buffer,argv[1]); return0; }}LayoutofTypicalStackFrameModifiedShellCode#include<stdio.h>intmain(intargc,char*argv[]){ execvp(‘‘\bin\sh’’,‘‘\bin\sh’’,NULL); return0;}HypotheticalStackFrameBeforeattackAfterattackProgramThreats(Cont.)VirusesCodefragmentembeddedinlegitimateprogramVeryspecifictoCPUarchitecture,operatingsystem,applicationsUsuallyborneviaemailorasamacroVisualBasicMacrotoreformatharddriveSubAutoOpen()DimoFS SetoFS=CreateObject(’’Scripting.FileSystemObject’’) vs=Shell(’’c:/kformat c:’’,vbHide)EndSubProgramThreats(Cont.)VirusdropperinsertsvirusontothesystemManycategoriesofviruses,literallymanythousandsofvirusesFileBootMacroSourcecodePolymorphicEncryptedStealthTunnelingMultipartiteArmoredABoot-sectorComputerVirus15.3系统和网络威胁Worms–usespawnmechanism;standaloneprogramInternetwormExploitedUNIXnetworkingfeatures(remoteaccess)andbugsinfingerandsendmailprogramsGrapplinghookprogramuploadedmainwormprogramPortscanningAutomatedattempttoconnecttoarangeofportsononeorarangeofIPaddressesDenialofServiceOverloadthetargetedcomputerpreventingitfromdoinganyusefulworkDistributeddenial-of-service(DDOS)comefrommultiplesitesatonceTheMorrisInternetWorm15.4作为安全工具的密码术BroadestsecuritytoolavailableSourceanddestinationofmessagescannotbetrustedwithoutcryptographyMeanstoconstrainpotentialsenders(sources)and/orreceivers(destinations)ofmessagesBasedonsecrets(keys)SecureCommunicationoverInsecureMediumEncryptionEncryptionalgorithmconsistsofSetofKkeysSetofMMessagesSetofCciphertexts(encryptedmessages)AfunctionE:K→(M→C).Thatis,foreachk

K,E(k)isafunctionforgeneratingciphertextsfrommessages.BothEandE(k)foranykshouldbeefficientlycomputablefunctions.AfunctionD:K→(C→M).Thatis,foreachk

K,D(k)isafunctionforgeneratingmessagesfromciphertexts.BothDandD(k)foranykshouldbeefficientlycomputablefunctions.Anencryptionalgorithmmustprovidethisessentialproperty:Givenaciphertext

c

C,acomputercancomputemsuchthatE(k)(m)=conlyifitpossessesD(k).Thus,acomputerholdingD(k)candecryptciphertextstotheplaintextsusedtoproducethem,butacomputernotholdingD(k)cannotdecryptciphertexts.Sinceciphertextsaregenerallyexposed(forexample,sentonthenetwork),itisimportantthatitbeinfeasibletoderiveD(k)fromtheciphertextsSymmetricEncryptionSamekeyusedtoencryptanddecryptE(k)canbederivedfromD(k),andviceversaDESismostcommonlyusedsymmetricblock-encryptionalgorithm(createdbyUSGovt)EncryptsablockofdataatatimeTriple-DESconsideredmoresecureAdvancedEncryptionStandard(AES),twofishupandcomingRC4ismostcommonsymmetricstreamcipher,butknowntohavevulnerabilitiesEncrypts/decryptsastreamofbytes(i.ewirelesstransmission)Keyisainputtopsuedo-random-bitgeneratorGeneratesaninfinitekeystreamAsymmetricEncryptionPublic-keyencryptionbasedoneachuserhavingtwokeys:publickey–publishedkeyusedtoencryptdataprivatekey–keyknownonlytoindividualuserusedtodecryptdataMustbeanencryptionschemethatcanbemadepublicwithoutmakingiteasytofigureoutthedecryptionschemeMostcommonisRSAblockcipherEfficientalgorithmfortestingwhetherornotanumberisprimeNoefficientalgorithmisknowforfindingtheprimefactorsofanumberAsymmetricEncryption(Cont.)Formally,itiscomputationallyinfeasibletoderiveD(kd,N)fromE(ke,N),andsoE(ke

,N)neednotbekeptsecretandcanbewidelydisseminatedE(ke,N)(orjustke)isthepublickeyD(kd,N)(orjustkd)istheprivatekeyNistheproductoftwolarge,randomlychosenprimenumberspandq(forexample,pandqare512bitseach)EncryptionalgorithmisE(ke,N)(m)=mke

modN,whereke

satisfieskekd

mod(p−1)(q−1)=1ThedecryptionalgorithmisthenD(kd,N)(c)=ckd

modNAsymmetricEncryptionExampleForexample.makep=7andq=13WethencalculateN=7∗13=91and(p−1)(q−1)=72Wenextselectke

relativelyprimeto72and<72,yielding5Finally,wecalculatekd

suchthatkekd

mod72=1,yielding29WehowhaveourkeysPublickey,ke,N=5,91Privatekey,kd,N=29,91Encryptingthemessage69withthepublickeyresultsinthecyphertext62CyphertextcanbedecodedwiththeprivatekeyPublickeycanbedistributedincleartexttoanyonewhowantstocommunicatewithholderofpublickeyEncryptionandDecryptionusingRSAAsymmetricCryptographyCryptography(Cont.)Notesymmetriccryptographybasedontransformations,asymmetricbasedonmathematicalfunctionsAsymmetricmuchmorecomputeintensiveTypicallynotusedforbulkdataencryptionAuthenticationConstrainingsetofpotentialsendersofamessageComplementaryandsometimesredundanttoencryptionAlsocanprovemessageunmodifiedAlgorithmcomponentsAsetKofkeysAsetMofmessagesAsetAofauthenticatorsAfunctionS:K→(M→A)Thatis,foreachk

K,S(k)isafunctionforgeneratingauthenticatorsfrommessagesBothSandS(k)foranykshouldbeefficientlycomputablefunctionsAfunctionV:K→(M×A→{true,false}).Thatis,foreachk

K,V(k)isafunctionforverifyingauthenticatorsonmessagesBothVandV(k)foranykshouldbeefficientlycomputablefunctionsAuthentication(Cont.)Foramessagem,acomputercangenerateanauthenticatora

AsuchthatV(k)(m,a)=trueonlyifitpossessesS(k)Thus,computerholdingS(k)cangenerateauthenticatorsonmessagessothatanyothercomputerpossessingV(k)canverifythemComputernotholdingS(k)cannotgenerateauthenticatorsonmessagesthatcanbeverifiedusingV(k)Sinceauthenticatorsaregenerallyexposed(forexample,theyaresentonthenetworkwiththemessagesthemselves),itmustnotbefeasibletoderiveS(k)fromtheauthenticatorsAuthentication–HashFunctionsBasisofauthenticationCreatessmall,fixed-sizeblockofdata(messagedigest,hashvalue)frommHashFunctionHmustbecollisionresistantonmMustbeinfeasibletofindanm’≠msuchthatH(m)=H(m’)IfH(m)=H(m’),thenm=m’ThemessagehasnotbeenmodifiedCommonmessage-digestfunctionsincludeMD5,whichproducesa128-bithash,andSHA-1,whichoutputsa160-bithashAuthentication-MACSymmetricencryptionusedinmessage-authenticationcode(MAC)authenticationalgorithmSimpleexample:MACdefinesS(k)(m)=f(k,H(m))Wherefisafunctionthatisone-wayonitsfirstargumentkcannotbederivedfromf(k,H(m))Becauseofthecollisionresistanceinthehashfunction,reasonablyassurednoothermessagecouldcreatethesameMACAsuitableverificationalgorithmisV(k)(m,a)≡(f(k,m)=a)NotethatkisneededtocomputebothS(k)andV(k),soanyoneabletocomputeonecancomputetheotherAuthentication–DigitalSignatureBasedonasymmetrickeysanddigitalsignaturealgorithmAuthenticatorsproducedaredigitalsignaturesInadigital-signaturealgorithm,computationallyinfeasibletoderiveS(ks

)fromV(kv)Visaone-wayfunctionThus,kv

isthepublickeyandks

istheprivatekeyConsidertheRSAdigital-signaturealgorithmSimilartotheRSAencryptionalgorithm,butthekeyuseisreversedDigitalsignatureofmessageS(ks

)(m)=H(m)ks

modNThekeyks

againisapaird,N,whereNistheproductoftwolarge,randomlychosenprimenumberspandqVerificationalgorithmisV(kv)(m,a)≡(akv

modN=H(m))Wherekv

satisfieskvks

mod(p−1)(q−1)=1Authentication(Cont.)Whyauthenticationifasubsetofencryption?Fewercomputations(exceptforRSAdigitalsignatures)AuthenticatorusuallyshorterthanmessageSometimeswantauthenticationbutnotconfidentialitySignedpatchesetalCanbebasisfornon-repudiationKeyDistributionDeliveryofsymmetrickeyishugechallengeSometimesdoneout-of-bandAsymmetrickeyscanproliferate–storedonkeyringEvenasymmetrickeydistributionneedscare–man-in-the-middleattackMan-in-the-middleAttackonAsymmetricCryptographyDigitalCertificatesProofofwhoorwhatownsapublickeyPublickeydigitallysignedatrustedpartyTrustedpartyreceivesproofofidentificationfromentityandcertifiesthatpublickeybelongstoentityCertificateauthorityaretrustedparty–theirpublickeysincludedwithwebbrowserdistributionsTheyvouchforotherauthoritiesviadigitallysigningtheirkeys,andsoonEncryptionExample-SSLInsertionofcryptographyatonelayeroftheISOnetworkmodel(thetransportlayer)SSL–SecureSocketLayer(alsocalledTLS)CryptographicprotocolthatlimitstwocomputerstoonlyexchangemessageswitheachotherVerycomplicated,withmanyvariationsUsedbetweenwebserversandbrowsersforsecurecommunication(creditcardnumbers)TheserverisverifiedwithacertificateassuringclientistalkingtocorrectserverAsymmetriccryptographyusedtoestablishasecuresessionkey(symmetricencryption)forbulkofcommunicationduringsessionCommunicationbetweeneachcomputerthebusessymmetrickeycryptography15.5用户认证Crucialtoidentifyusercorrectly,asprotectionsystemsdependonuserIDUseridentitymostoftenestablishedthroughpasswords,canbeconsideredaspecialcaseofeitherkeysorcapabilitiesAlsocanincludesomethinguserhasand/orauserattributePasswordsmustbekeptsecretFrequentchangeofpasswordsUseof“non-guessable”passwordsLogallinvalidaccessattemptsPasswordsmayalsoeitherbeencryptedorallowedtobeusedonlyonce15.6实现安全防御Defenseindepthismostcommonsecuritytheory–multiplelayersofsecuritySecuritypolicydescribeswhatisbeingsecuredVulnerabilityassessmentcomparesrealstateofsystem/networkcomparedtosecuritypolicyIntrusiondetectionendeavorstodetectattemptedorsuccessfulintrusionsSignature-baseddetectionspotsknownbadpatternsAnomalydetectionspotsdifferencesfromnormalbehaviorCandetectzero-dayattacksFalse-positivesandfalse-negativesaproblemVirusprotectionAuditing,accounting,andloggingofallorspecificsystemornetworkactivities15.7保护系统和网络的防火墙AnetworkfirewallisplacedbetweentrustedanduntrustedhostsThefirewalllimitsnetworkaccessbetweenthesetwosecuritydomainsCanbetunneledorspoofedTunnelingallowsdisallowedprotocoltotravelwithinallowedprotocol(i.e.telnetinsideofHTTP)FirewallrulestypicallybasedonhostnameorIPaddresswhichcanbespoofedPersonalfirewallissoftwarelayerongivenhostCanmonitor/lim