Concepts of Security 1

Concepts of Security

Mohamad Aljnidi “mjnidi@[Link]”

Course for Master in Telecommunications

Higher Institute for Applied Sciences and Technology (HIAST) - Damascus - Syria

May/June 2011
Concepts of Security 2

Overview

1 Introduction

2 Security Models

3 Cryptography

4 Exercise - Cryptographic Protocols

5 Security Mechanisms

6 Security Practices

7 Exercise - Covert Channels

8 Security Evaluation
Concepts of Security 3
Introduction

Overview

1 Introduction

2 Security Models

3 Cryptography

4 Exercise - Cryptographic Protocols

5 Security Mechanisms

6 Security Practices

7 Exercise - Covert Channels

8 Security Evaluation
Concepts of Security 4
Introduction

Terminologies - Elements of Security

Subject: An active entity that carries out an action on other entities

(examples: users, processors, processes).
Object: An entity on which actions might be executed (examples:
processes, files, devices).
Right: An action that a subject is allowed or disallowed to perform
on an object (examples: create, read, write, execute).
Concepts of Security 5
Introduction

Terminologies - Access Control

Access Control Matrix (the protection state): The rights for each
subject on different objects. Objects may include other subjects.
An abstract model: Implementation is system-dependent. A system
is characterized here by its sets of subjects, objects and possible
rights.
Two possible implementation methods:
1 Capabilities (rows).
2 ACL: Access Control Lists (Columns).
Concepts of Security 6
Introduction

Terminologies - Security Policy

A security policy states what is, or is not, allowed:

This defines security for an application, a system, a network or an
organization.
The specification might be formal or informal.
Security mechanisms enforce policies.
Negotiation of policies:
To create a shared policy.
To set up a composition of policies.
To resolve policy conflicts.
Concepts of Security 7
Introduction

Fundamentals - Security Goals

Prevention: To prevent the violation of the security policy.

Detection:
1 Detect violation of the security policy.
2 Characterize vulnerabilities that led to the violation.
3 Verify that the prevention mechanism is efficient.
Recovery:
1 Stop policy violations (attacks).
2 Evaluate and repair damage.
3 Ensure availability in presence of attacks (coping).
4 Fix vulnerabilities.
5 Counter attacks.
Concepts of Security 8
Introduction

Fundamentals - Security Properties

Confidentiality: Prevention of unauthorized disclosure of

information.
Integrity: Prevention of data altering, damaging or deleting.
Availability: Prevention of unauthorized withholding of information
or resources.
Concepts of Security 9
Introduction

Fundamentals - Security Models

Multi-level security:
Subjects and objects are attributed security levels, for example: top
secret, secret, confidential and open.
A subject is given rights according to its level and the level of the
object on which it operates.
The Bell-LaPadula model: no read up, no write down.
Multilateral security:
All objects might be accessed by all subjects.
A subject is given rights according to inter-object rules.
The Chinese Wall model: interest classes, company datasets,
individual objects and conflict rules.
Concepts of Security 10
Introduction

Functions - Authentication

Authentic: Conforming to fact. Here: having a verifiable claimed

origin or authorship.
Authentication: Establishing authenticity. Here: the verification of
the identity of a person or a process. Moreover, in a communication
system, its also the verification of the message source (digital
signatures).
Examples:
Challenge / Response.
Biometrics.
Public Key Infrastructures (PKI) / digital certificates.
User ID / Password pairs.
Concepts of Security 11
Introduction

Functions - Authorization

Provides access control for different parties (e.g: all employees, sales
department, managers, system administrators) claiming desired
rights.
An implementation method: a security reference monitor depending
on the Access Control Matrix is implemented.
The function determines what you are allowed to do after having
been authenticated to the system.
Concepts of Security 12
Introduction

Other Security Functions

Auditing / Tracing: Tracking the trails of various actions performed

on a system.
Non-repudiation: Ability to ensure that a party cannot deny being
the source of a message or the issuer of a data.
Accountability: To be able to provide user information related to
objects and rights when required: who, what and when.
Concepts of Security 13
Introduction

Risks

Vulnerability: Weakness that can be exploited to cause damage.

Threat: Method of exploiting a vulnerability.
Attack: A threat mounted by a capable adversary.
Concepts of Security 14
Introduction

Classes of Threats

Disclosure: Unauthorized access to information.

Deception: Acceptance of false data.
Disruption: Interruption / prevention of correct operation.
Usurpation: Unauthorized control of a system component.
Concepts of Security 15
Introduction

Common Types of Security Attacks

Interruption, delay, denial of receipt or denial of service.

Interception or snooping (spying).
Alteration, damaging or deletion.
Fabrication, masquerade or spoofing (injection or networking of false
data).
Repudiation of origin.
Concepts of Security 16
Introduction

A General Security Model

Concepts of Security 17
Introduction

Trust and Trustworthiness

Trust is a belief that a system meets its specification, or otherwise

lives up to its security expectation.
Trustworthiness is assurance that the system deserves to be trusted:
Trust backed up by believable evidence.
Approval by an expert entity.
Compliance to accepted security standards.
Trusted systems have assurances / evidences that the implemented
system meets its security requirements.
Concepts of Security 18
Introduction

Assurance

To indicate how much to trust a system.

Is achieved by ensuring that:
1 The required functionality is present and correctly implemented.
2 There is sufficient protection against unintentional errors.
3 There is sufficient resistance to intentional attacks.
Concepts of Security 19
Introduction

References

Computer crime and security survey, [Link]

Dieter Gollman, Computer Security, 2nd edition, Wiley, 2006, ISBN
0 470 86293 9
Handbook of Applied Cryptography, Alfred Menezes, Paul van
Oorschot, and Scott Vanstone, 1996,
[Link]
An Overview of Cryptography, Gary C. Kessler,
[Link]
Applied Cryptography (2nd edition), Bruce Schneier, 1996
Network Security (2nd edition), Charlie Kaufman, Radia Perlman
and Mike Speciner, 2002
Concepts of Security 20
Security Models

Overview

1 Introduction

2 Security Models

3 Cryptography

4 Exercise - Cryptographic Protocols

5 Security Mechanisms

6 Security Practices

7 Exercise - Covert Channels

8 Security Evaluation
Concepts of Security 21
Security Models

Discretionary Access Control

Generally used to limit a users access to a file.

It is the owner of the file who controls other users accesses to the
file.
Rather in legacy systems.
Concepts of Security 22
Security Models

Mandatory Access Control

Needed when a security policy of a system implies that:

Protection decisions must not be taken by the object owner.
The system must enforce the protection decisions.
The system enforces the security policy over the wishes or the
intentions of the object owners.
Concepts of Security 23
Security Models

Role-Based Access Control

A subject has access to an object based on the subjects assigned

role.
Subjects change frequently, Roles don’t.
For instance:
Roles are defined based on job functions.
Permissions are defined based on job authority and responsibilities
within a job function.
Concepts of Security 24
Security Models

Role-Based Access Control - Model

Concepts of Security 25
Security Models

The Bell-LaPadula Model

Was proposed by Bell and LaPadula of MITRE for enforcing access

control in government and military applications.
In such applications, subjects and objects are partitioned into
different security levels.
A subject can only access objects at certain levels determined by its
security level.
For instance, the following are two typical access specifications:
Unclassified personnel cannot read data at confidential levels.
Top-secret data cannot be written into the files at unclassified levels.
Simplest type of confidentiality classification is a set of security
clearances arranged in a total ordering.
Concepts of Security 26
Security Models

The Bell-LaPadula Model - DAC / MAC

Bell-LaPadula combines Mandatory and Discretionary Access

Controls.
Example:
Subject S has a discretionary read access to object O.
Means that the access control matrix entry for S and O
corresponding to the discretionary access control contains a read
right:
A B C D O
Q
S read
T
If the mandatory controls are not present, S would be able to read O.
Concepts of Security 27
Security Models

The Bell-LaPadula Model - Definition

Let ls be the security clearance of subject S.

Let lo be the security classification of object O.
Simple security condition: NO READ UP
S can read O if and only if lo ≤ ls and S has
discretionary read access to O
*-property (star property): NO WRITE DOWN
S can write O if and only if ls ≤ lo and S has
discretionary write access to O
For instance: to prevent classified information leak, top-secret
personnel cannot write documents lower than top-secret level.
Concepts of Security 28
Security Models

The Bell-LaPadula Model - Total / Partial Order

The total order of classification is not flexible enough:

Example: Alice cleared for missiles. Bob cleared for warheads. Both
cleared for targets.
Solution is a partial order of categories:
Each category describes a kind of information.
These categories arise from the “need to know” principle:
No subject should be able to read objects unless reading them is
necessary for that subject to perform its action.
A security preliminary level and a set of categories form together a
security level or compartment.
Concepts of Security 29
Security Models

The Bell-LaPadula Model - Extension

The security level (L1, C1) dominates the security level (L2,C2) if
and only if L2 ≤ L1 and C 2 ⊆ C 1.
If an entity e1 dominates an entity e2, we write “e1 DOM e2”, and
if not, we write “e1 !DOM e2”.
Example:
George is cleared into security level (S, {NUC, EUR}).
DocA is classified as (C, {NUC}).
DocB is classified as (S, {EUR, US}).
DocC is classified as (S, {EUR}).
George DOM DocA.
George !DOM DocB.
George DOM DocC.
Concepts of Security 30
Security Models

The Bell-LaPadula Model - Security Lattice

Concepts of Security 31
Security Models

The Bell-LaPadula Model - Extended Definition

Let S be a subject, and O an object, having each a security

preliminary level and a set of categories (a security compartment).
Simple security condition: NO READ UP
S can read O if and only if S DOM O and S has
discretionary read access to O
*-property: NO WRITE DOWN
S can write O if and only if O DOM S and S has
discretionary write access to O
Concepts of Security 32
Security Models

The Biba Model

Integrity levels with the same dominance relation defined for

Bell-LaPadula.
Higher levels are more reliable, trustworthy and accurate.
Usually used for information transfer paths.
Si reads Oi ; Si writes Oi+1 .
NO WRITE UP - NO READ DOWN.
Information can only flow downwards.
Prevents corruption of clean higher level entities by (bad) lower level
entities.
Biba model addresses integrity, while Bell-LaPadula model concerns
disclosure of information.
Concepts of Security 33
Security Models

The Biba Model - Definition

Subjects and objects are ordered by an integrity scheme denoted

I (x) where x is a subject or an object.
Simple integrity property: subject S can write object O if and only if
I (S) ≥ I (O).
Integrity *-property: if subject S has read access to object O, then
S can have write access to object P if and only if I (O) ≥ I (P).
Concepts of Security 34
Security Models

The Clark-Wilson Model

Addresses data integrity requirements in commercial applications

(e.g. bank transactions).
Integrity requirements are divided into:
Internal consistency: properties of the internal state that can be
enforced by the computer system.
External consistency: the relation of the internal state with the real
world: enforced by means outside the system (e.g. auditing).
Integrity is enforced by:
Well-formed transactions:
Data items can be manipulated only by a specific set of programs;
users have access to programs rather than data items.
Separation of duties:
Users have to collaborate to manipulate data and collude to
penetrate the system.
Concepts of Security 35
Security Models

The Clark-Wilson Model - Policy

Subjects must be identified and authenticated.

Objects can be manipulated only by a restricted set of programs.
Subjects can execute only a restricted set of programs.
A proper audit log has to be maintained.
The system must be certified to work properly.
Concepts of Security 36
Security Models

The Clark-Wilson Model - Elements

Data items are called Constrained Data Items (CDIs).

Input items are Unconstrained Data Items (UDIs).
CDIs can only be manipulated by Transformation Procedures (TPs).
The integrity is checked by Integrity Verification Procedures (IVPs).
Concepts of Security 37
Security Models

The Clark-Wilson Model - Security Procedures

Security procedures are defined by 5 certification rules:

1 IVPs must ensure that all CDIs are in valid states when they are run.
2 TPs must transform their valid CDIs into possibly-different valid
CDIs.
3 The allowed access relations must meet the requirements imposed by
the principle of separation of duty.
4 All TPs must write to an append-only CDI log.
5 Any TP that takes a UDI as input must either convert it into a CDI
or reject it.
Concepts of Security 38
Security Models

The Clark-Wilson Model - Integrity Enforcement

Integrity is enforced by 4 enforcement rules:

1 The system must maintain and protect the certified relations
(TPi : CDIa , CDIb ...) and ensure that only TPs certified to run on a
CDI manipulate that CDI.
2 The system must maintain and protect the list of entries (User,
TPi : CDIa , CDIb ...) specifying the TPs that users can execute.
3 The system must authenticate each user requesting to execute a TP.
4 Only the certifier of a TP may modify the respective entities
associated with that TP. No certifier of a TP may have execute
permission with respect to an entity.
Concepts of Security 39
Security Models

The Clark-Wilson Model - Example

Banking application:
CDI = bank account values.
Transformation procedures on bank accounts: credit - debit -
transfer - set overdraft - update account details.
We can define a consistency property as follows:
today’s money = deposited today + end-of-yesterday’s money -
withdrawn today.
Users (transformations) can modify CDIs (move money) if and only
if:
The consistency property remains maintained.
A second user must confirm a transaction.
All transactions are recorded in an append-only log.
Concepts of Security 40
Security Models

The Chinese Wall Model

Used mainly by services and consultancy firms.

Effective in securing information that may lead to conflict of
interests within an organization.
Intended to prevent unauthorized flow of information from one
organization to another via consultants working at both.
Uses the concept of separation of duty.
GENERAL RULE: there must be no information flow that causes a
conflict of interest.
Concepts of Security 41
Security Models

The Chinese Wall Model - Policy

A subject has access to a particular object in company X only if such

subject has had access to such object.
A subject can write to an object in a given company X only if such
subject cannot read any data (or objects) from any company that is
competitor of X unless such objects have been sanitized (not
commercially sensitive).
Concepts of Security 42
Security Models

The Chinese Wall Model - Elements

Set of subjects.
Set of objects.
Set of companies.
Set of conflict of interest classes:
Companies of a class are competitors.
Each company belongs to at least one class.
Every non-sanitized object has a security label (x(o), y(o)):
“x” identifies the objects conflict of interest class.
“y” identifies the owner of the object.
Sanitized objects have all the same security label.
Concepts of Security 43
Security Models

The Chinese Wall Model - History Matrix

The Chinese Wall model must address confidentiality requirements

over time.
The history matrix is used to record a history of past access to
objects:
Rows indexed by subjects.
Columns indexed by objects.
Entries 0 or 1:
[s, o] = 1 indicates that subject s has accessed object o.
Concepts of Security 44
Security Models

The Chinese Wall Model - Definition

Simple security property:

s can access o if for all p such that [s, p] = 1 either x(o) = x(p) or
y (o) = y (p).
s can access o if s has not already accessed an object in the same
Class Of Interest, or o contains sanitized information.
*-Property:
Sensitive information can only flow from one object to another if
both objects are owned by the same company.
s can write to an object o if the simple security property is satisfied
and for all non-sanitized objects p that s can read, y (o) = y (p).
Concepts of Security 45
Cryptography

Overview

1 Introduction

2 Security Models

3 Cryptography

4 Exercise - Cryptographic Protocols

5 Security Mechanisms

6 Security Practices

7 Exercise - Covert Channels

8 Security Evaluation
Concepts of Security 46
Cryptography

Scenario

Alice wants to send a message (plaintext p) to Bob.

The communication channel is insecure and can be eavesdropped by
Trudy.
If Alice and Bob have previously agreed on an encryption scheme
(cipher), the message can be sent encrypted (cipher-text c).
Concepts of Security 47
Cryptography

Issues

What is a good cipher?

What is the complexity of encryption / decryption?
What is the size of the cipher-text relative to the plaintext?
If Alice and Bob have never interacted before, how can they agree
on a cipher?
...
Concepts of Security 48
Cryptography

Ancient Cryptography

Caesar’s Cipher:
replace a with d
replace b with e
...
replace z with c
A more general mono-alphabetic substitution cipher maps each
letter to some other letter.
In general: a mix of substitution and transposition.
Concepts of Security 49
Cryptography

Secret-Key Ciphers

A secret-key cipher means using a shared secret key to encrypt and

decrypt.
Caesar’s generalized cipher uses modular addition of each character
(viewed as an integer) with a secret key:
ci = (pi + k) mod m
pi = (ci − k) mod m
A more secure scheme is to use modular exponentiation to encrypt
blocks of characters, and then chaining the encrypted blocks
according to a security algorithm:
k
ci,j = pi,j mod m (the character i in the block j)
where m is a large prime.
Concepts of Security 50
Cryptography

Secret-Key Ciphers - Modular Exponentiation

Unlike modular addition, modular exponentiation is considered

computationally hard enough to invert. Thus, even if Trudy guesses
a pair (ci,j , pi,j ) - for example, she knows that the plaintext starts
with “Dear Bob” - she still cannot compute the key k.
Alice and Bob need to share only a key k. Bob decrypts using
Euler’s Theorem from number theory:
d
pi,j = ci,j mod m
Where d can be computed from k and m using Euclid’s GCD
algorithm.
Concepts of Security 51
Cryptography

Types of Encryption

Text is converted to cipher-text by use of an algorithm and a key:

The algorithm can be publicly known.
The key secrecy depends on the encryption category.
Three main categories:
Secret Key (symmetric cryptosystem)
A single key is used to encrypt and decrypt information.
Public / Private Key (asymmetric cryptosystem)
Two keys are used: one for encryption (public key) and one for
decryption (private key).
One-Way Function (hash functions)
Information is encrypted to produce a “digest” of the original
information, which can be used later to prove authenticity.
Concepts of Security 52
Cryptography

Symmetric Encryption

Sender and receiver have the same secret key that will be used to
encrypt plaintext and decrypt cipher-text.
Strength of encryption technique depends on key length.
Known symmetrical algorithms:
Data Encryption Standard (DES) - 56-bit key.
Triple DES, DESX, GDES, RDES - 168-bit key.
RC2, RC4, RC5 - variable-length key up to 2048 bits.
IDEA - basis of PGP - 128-bit key.
Blowfish - variable-length key up to 448 bits.
Concepts of Security 53
Cryptography

Asymmetric Encryption

Better known as Public / Private Key Systems.

Most common algorithm is the RSA (Rivest - Shamir - Adelman),
with key lengths generally from 512 to 1024 bits:
User X has a pair of keys, public “(e,n)” and private “d”.
To encrypt p before sending it to X, send c = p e mod n.
X will decrypt c using X’s private key that “matches” X’s public key:
p = c d mod n = p ed mod n, where e * d = 1 mod n.
Based on the fact that it is computationally hard enough to find the
prime factors of large numbers.
Concepts of Security 54
Cryptography

Digital Signature

Alice can provide a digital signature for the message x:

s = x d mod n
(e,n) is Alice’s public key and d is her private key.
If Bob receives both x and s, he computes:
y = s e mod n, given that x ed mod n = x
Thus, if y = x, Bob knows that Alice indeed sent x, since she is the
only person that can compute s from x.
Also Alice cannot cheat and deny to have sent message x
(non-repudiation).
Using digital signature Alice and Bob can authenticate each other
and prevent Trudy’s man-in-the-middle attacks.
Validating a signed message requires knowledge of the signer’s
public key.
Concepts of Security 55
Cryptography

Certificates

A certificate consists of a public key together with an identification

of the public key owner.
The certificate is issued by a Trusted Third Party (TTP) called a
Certification Authority (CA).
The certification authority might be a government agency or a
financial institution.
The CA guarantees the link between the user and the public key by
digitally signing a document which contains the user ID, the public
key, the ID of the CA, the expiration date of the certificate and
perhaps other information such as access rights. Example: X.509
standard.
Concepts of Security 56
Cryptography

Public Key Infrastructure (PKI)

A Public Key Infrastructure consists of one or more Certification

Authorities plus a relevant policy system.
Certification Authorities issue public key certificates to users.
Users employ keys contained in public key certificates to verify
signatures or encrypt messages, transactions or documents.
PKI Services: confidentiality - integrity - identification -
authentication - non-repudiation.
PKI Uses: S/MIME - SSL - Securing stored data - Integrity of
critical electronic data - certificate-based access control.
Concepts of Security 57
Cryptography

Hash Functions

A hash function h acts on a data x and returns a value h(x),

belonging to a fixed range.
The hash function must have the following essential properties:
Given x, it should be easy enough to compute h(x).
Given x, h(x) should be time-independent.
The input x can be of an arbitrary length.
Given a value y, it should be hard enough to find a data x such that
h(x) = y.
It should be hard enough to find two different inputs x1 and x2 such
that h(x1) = h(x2).
Used with digital signature to authenticate both data and its origin.
Concepts of Security 58
Cryptography

Timestamps

Inclusion of a date / time stamp in a message allows the recipient to

check it for freshness (as long as the timestamp is protected by
cryptographic means).
Requires securely synchronized clocks to prevent replay (not so
trivial).
A typical clock drift on a workstation is of 1 second per day.
Need for a window of acceptance for Alice’s messages on the side of
Bob (drift + variable propagation time).
Also a need for a log of recently received messages to prevent replay
attacks.
Concepts of Security 59
Cryptography

Logical Timestamps

Alternative to clocks: Alice and Bob could use pair of sequence

numbers NAB and NBA in their communications.
Every time A sends B a message she increments value NAB and
includes it. Likewise for B.
Needs pair of secret sequence numbers for every pair of
communicating parties.
Concepts of Security 60
Cryptography

Diffie-Hellman Key Exchange

The Diffie-Hellman protocol allows 2 people to use random values,

and yet each generates the same symmetric key without transmitting
the value of the key.
The security of the protocol lies in the Discrete Logarithm Problem
(DLP):
given y, g and p, find x such that
y = g x mod p
Concepts of Security 61
Cryptography

Diffie-Hellman Key Exchange - Protocol Specification

Alice and Bob need to agree on a key to use in a symmetric-key

cryptosystem. They share a large prime number p and a generator g.
Alice: Bob:
1. Generates random number a 1. Generates random number b
2. Computes x = g a mod p 2. Computes y = g b mod p
3. Sends x to Bob 3. Sends y to Alice
4. Receives y from Bob 4. Receives x from Alice
5. Computes k = y a mod p = g ab mod p 5. Computes k = x b mod p = g ab mod p
Concepts of Security 62
Cryptography

Needham-Schroeder Protocol

Alice and Bob use symmetric-key cryptography but they need a

Trusted Third Party (TTP) or Server (S).
Alice and the server share a key KAS .
Bob and the server share a key KBS .
Alice and Bob want to establish a shared key KAB so that Alice can
send Bob a message.
Concepts of Security 63
Cryptography

Needham-Schroeder Protocol - Specification

Alice, Bob and the Server communicate with each other as follows:
1. Alice → S : Alice, Bob
2. S → Alice : {Bob, KAB , {Alice, KAB }KBS }KAS
3. Alice → Bob : {Alice, KAB }KBS
{M}K indicates the result of encrypting the message M with the key
K.
Alice decrypts the message received at step 2 using KAS and gets
the session key KAB . She uses KAB as shared symmetric key with
Bob during a session of communication to send him encrypted
messages. Bob gets KAB in his turn at step 3 by decrypting the
received message using KBS .
Concepts of Security 64
Exercise - Cryptographic Protocols

Overview

1 Introduction

2 Security Models

3 Cryptography

4 Exercise - Cryptographic Protocols

5 Security Mechanisms

6 Security Practices

7 Exercise - Covert Channels

8 Security Evaluation
Concepts of Security 65
Exercise - Cryptographic Protocols

Authentication Protocol SPLICE/AS1

Allows mutual authentication between a client and a server.

Uses asymmetric cryptography, where a certification authority is
supposed to distribute public keys.
Protocol tasks: authentication and session-key distribution.
Protocol goals:
The session key must be known only by the client and the server.
The client must be sure that the server received the session key.
The server must be sure that the received session key was sent by
the client.
Initial assumptions:
Every member of the system only knows his key pair and the public
key of the certification authority.
The certification authority knows the public keys of all members.
The exercice aims at discovering certain vulnerabilities in the initial
version of the protocol, and in a later version as well.
1A system proposed by S. Yamaguchi, K. Okayama and H. Miyahara in 1991
Concepts of Security 66
Exercise - Cryptographic Protocols

SPLICE/AS - Notation

S, C , CA and X represent respectively the server, the client, the

certification authority and the attacker.
N1 , N2 and N3 represent pseudo-random numbers.
T represents a timestamp.
L represents a time slice (lifetime of the timestamp).
PKi and SKi represent respectively the public key and the private
key of the unit I (I ∈ {S, C , CA, X }).
Concepts of Security 67
Exercise - Cryptographic Protocols

SPLICE/AS - Specification

1. C → CA : C , S, N1
2. CA → C : CA, {CA, C , N1 , PKS }SKCA
3. C →S : C , S, {C , T , L, {N2 }PKS }SKC
4. S → CA : S, C , N3
5. CA → S : CA, {CA, S, N3 , PKC }SKCA
6. S →C : S, C , {S, N2 + 1}PKC

By the end of a valid execution of the protocol, N2 is used by C and

S as a symmetric key to secure their communications.
Concepts of Security 68
Exercise - Cryptographic Protocols

SPLICE/AS - Question 1

How is the mutual authentication achieved between C and S, and after

which step(s)?
Concepts of Security 69
Exercise - Cryptographic Protocols

SPLICE/AS - Question 1 - Answer

Question: How is the mutual authentication achieved between C

and S, and after which step(s)?
Answer:
C is authenticated by S after the step 5, where S receives the public
key of C from CA, which allows the verification of the digital
signature of C received by S at step 3.
S is authenticated by C after the step 6, where C receives a response
(“N2 + 1” encrypted by the public key of C ) to its challenge (“N2 ”
encrypted by the public key of S) sent in step 3, which proves that S
is the one who could get N2 using his private key.
Concepts of Security 70
Exercise - Cryptographic Protocols

SPLICE/AS - Question 2

How can an attacker intercept certain messages of the protocol and get
the key N2 to impersonate S in communications with C (without binding
sessions between C and S)?
Concepts of Security 71
Exercise - Cryptographic Protocols

SPLICE/AS - Question 2 - Answer

Question: How can an attacker intercept certain messages of the

protocol and get the key N2 to impersonate S in communications
with C (without binding sessions between C and S)?
Answer:
1. C → X /CA : C , S, N1
10 . X /C → CA : C , X , N1
2. CA → C : CA, {CA, C , N1 , PKX }SKCA
3. C → X /S : C , S, {C , T , L, {N2 }PKX }SKC
4. X → CA : X , C , N3
5. CA → X : CA, {CA, X , N3 , PKC }SKCA
6. X /S → C : S, C , {S, N2 + 1}PKC
Concepts of Security 72
Exercise - Cryptographic Protocols

SPLICE/AS - Question 3

How can we modify the protocol to prevent the previous attack (without
additional encryption)?
Concepts of Security 73
Exercise - Cryptographic Protocols

SPLICE/AS - Question 3 - Answer

Question: How can we modify the protocol to prevent the previous

attack (without additional encryption)?
Answer: The previous attack is possible because C can not be sure
that the publik key received in the message number 2 belongs to S.
It is enough then to add the identifier of S to the “certificate” sent
by CA in the message number 2:
1. C → CA : C , S, N1
2. CA → C : CA, {CA, C , N1 , S, PKS }SKCA
3. C → S : C , S, {C , T , L, {N2 }PKS }SKC
4. S → CA : S, C , N3
5. CA → S : CA, {CA, S, N3 , PKC }SKCA
6. S → C : S, C , {S, N2 + 1}PKC
Concepts of Security 74
Exercise - Cryptographic Protocols

SPLICE/AS - Question 4

Similarly, first suggest an attack by which an attacker X impersonates

the client C in communications with the server S, and then suggest a
modification to the protocol to prevent this attack
Concepts of Security 75
Exercise - Cryptographic Protocols

SPLICE/AS - Question 4 - Answer 1

Question: Similarly, first suggest an attack by which an attacker X

impersonates the client C in communications with the server S, and
then suggest a modification to the protocol to prevent this attack
Answer: The message number 5 has the same problem of the
message number 2 in the original specification of the protocol (no
identifier sent with the public key), which allows for the following
attack, even after the last modification:
1. X → CA : X , S, N1
2. CA → X : CA, {CA, X , N1 , S, PKS }SKCA
3. X /C → S : C , S, {C , T , L, {N2 }PKS }SKX
4. S → X /CA : S, C , N3
40 . X /S → CA : S, X , N3
5. CA → S : CA, {CA, S, N3 , PKX }SKCA
6. S → X /C : S, C , {S, N2 + 1}PKX
Concepts of Security 76
Exercise - Cryptographic Protocols

SPLICE/AS - Question 4 - Answer 2

Question: Similarly, first suggest an attack by which an attacker X

impersonates the client C in communications with the server S, and
then suggest a modification to the protocol to prevent this attack
Answer: Similarly, it is enough to add the identifier of C to the
“certificate” sent in the message number 5:
1. C → CA : C , S, N1
2. CA → C : CA, {CA, C , N1 , S, PKS }SKCA
3. C → S : C , S, {C , T , L, {N2 }PKS }SKC
4. S → CA : S, C , N3
5. CA → S : CA, {CA, S, N3 , C , PKC }SKCA
6. S → C : S, C , {S, N2 + 1}PKC
Concepts of Security 77
Exercise - Cryptographic Protocols

SPLICE/AS - Question 5

Nevertheless, there is still a possible attack on the last modified protocol,

which uses binding sessions, and by which an attacker X can impersonate
S in communications with C . Try to describe this attack using only
messages 3 and 6
Concepts of Security 78
Exercise - Cryptographic Protocols

SPLICE/AS - Question 5 - Answer

Question: Nevertheless, there is still a possible attack on the last

modified protocol, which uses binding sessions, and by which an
attacker X can impersonate S in communications with C . Try to
describe this attack using only messages 3 and 6
Answer: We suppose that the attacker X can get the public keys of
all the other members of the system, and that the server S has the
public key of the attacker X :
3. C → X /S : C , S, {C , T , L, {N2 }PKS }SKC
30 . X → S : X , S, {X , T , L, {N2 }PKS }SKX
60 . S → X : S, X , {S, N2 + 1}PKX
6. X /S → C : S, C , {S, N2 + 1}PKC
Concepts of Security 79
Exercise - Cryptographic Protocols

SPLICE/AS - Question 6

Suggest a modification to counter the attack of Question 5

Concepts of Security 80
Exercise - Cryptographic Protocols

SPLICE/AS - Question 6 - Answer

Question: Suggest a modification to counter the attack of Question

5
Answer: It is enough to modify the message number 3 by adding the
identifier of the client C to the part encrypted by the public key of
the server S, which is used to send the proposed shared key N2 :
3. C → S : C , S, {C , T , L, {C , N2 }PKS }SKC
6. S → C : S, C , {S, N2 + 1}PKC
Concepts of Security 81
Exercise - Cryptographic Protocols

SPLICE/AS - Question 7

Suppose that we use RSA for the public-key encryption, prove that by
making assumptions on the length of a ciphered block and the length of
an identifier of a member in the system, the attack of Question 5 is still
possible
Concepts of Security 82
Exercise - Cryptographic Protocols

SPLICE/AS - Question 7 - Answer 1

Question: Suppose that we use RSA for the public-key encryption,

prove that by making assumptions on the length of a ciphered block
and the length of an identifier of a member in the system, the attack
of Question 5 is still possible
Answer: Suppose that we encrypt by blocks of length k:
A message M is divided into blocks of length k (M1 , M2 , ..., Mm ),
where the last block is completed if needed using a specific
algorithm. The final cipher is the concatenation of the ciphered
blocks: {M}PK = {M1 }PK .{M2 }PK .....{Mm }PK .
Identifiers are coded using a length which is a multiple of k.
Concepts of Security 83
Exercise - Cryptographic Protocols

SPLICE/AS - Question 7 - Answer 2

Question: Suppose that we use RSA for the public-key encryption,

prove that by making assumptions on the length of a ciphered block
and the length of an identifier of a member in the system, the attack
of Question 5 is still possible
Answer: The attacker X can get from message 3 the part
{C , N2 }PKS =
{C1 }PKS .{C2 }PKS .....{Cp }PKS .{N21 }PKS .{N22 }PKS .....{N2m }PKS
and replace the p blocks of the identifier C by the p blocks of his
identifer X to get {X , N2 }PKS and execute the attack of Question 5:
3. C → X /S : C , S, {C , T , L, {C , N2 }PKS }SKC
30 . X → S : X , S, {X , T , L, {X , N2 }PKS }SKX
60 . S → X : S, X , {S, N2 + 1}PKX
6. X /S → C : S, C , {S, N2 + 1}PKC
Concepts of Security 84
Security Mechanisms

Overview

1 Introduction

2 Security Models

3 Cryptography

4 Exercise - Cryptographic Protocols

5 Security Mechanisms

6 Security Practices

7 Exercise - Covert Channels

8 Security Evaluation
Concepts of Security 85
Security Mechanisms

Physical Security

Scope:
Keep the machine physically secure.
Ensure that its connections to other machines are secure.
Ensure that its environment is harmless.
Computer room security:
Locks on doors.
Access lists and group access policy.
Maintenance personnel access and monitoring.
Workstation security: locks and/or positionning in public areas.
Policies for storing, maintaining and shipping electronic media.
Concepts of Security 86
Security Mechanisms

Software Security - Countering Malicious Code

Malicious code: Set of instructions that causes a security policy to

be violated.
Generally relies on legal operations. Malicious codes impersonate
authorized users.
Examples of malicious code:
Trojan horse: Tricks the user.
Virus: Spreads by making copies of itself.
Worm: Travels independently over computer networks.
Logic-time bomb: Set off when a specified condition is met.
To counter malicious code: detect its presence by finding its traces
(signature), and then clean, quarantine or delete the infected files.
Concepts of Security 87
Security Mechanisms

Malicious Code - Trojan Horse

A program with an overt (expected) and covert (unexpected)

effects:
Appears normal / expected.
Covert effect violates security policy.
User tricked into executing Trojan Horse:
Expects (and sees) overt behavior.
Covert effect performed with users authorization.
Trojan Horse may replicate:
Creates copy on execution (acts a s Virus).
Spreads to other users / systems (acts as a Worm).
Concepts of Security 88
Security Mechanisms

Malicious Code - Virus

Alters parts of normal code with infected version.

Normal program executed (Operates when infected code is
executed).
Inserts itself into another file.
Some types:
Boot sector infectors (Less common with few boots off floppies).
Executable infectors (Runs when application runs).
Terminate and stay resident (Stays active in memory after
application completes).
Stealth (Read disinfected file, and call infected file).
Encrypted virus (Prevents signature to detect virus).
Polymorphism (Changes virus code to something equivalent each
time it propagates).
Macro virus (Infected code is not a machine code).
Concepts of Security 89
Security Mechanisms

Security of Operating Systems

For an operating system to perform its intended tasks consistently

and reliably, it must:
Protect itself from tampering by users.
Be able to prevent users from tampering with the programs of other
users.
Be able to safeguard users’ applications and its own programs from
accidental corruption.
Be able to protect itself from power failures or other environmental
problems.
First lines of defence: log-on procedures - access token - access
control list - discretionary access control.
Enforcing policies: formalized software acquisition - security
clearances - acknowledgment by users of responsibilities - monitor
security violations - disciplinary actions against security violators -
one-time passwords.
Concepts of Security 90
Security Practices

Overview

1 Introduction

2 Security Models

3 Cryptography

4 Exercise - Cryptographic Protocols

5 Security Mechanisms

6 Security Practices

7 Exercise - Covert Channels

8 Security Evaluation
Concepts of Security 91
Security Practices

Risk Management
The process is concerned with identification, measurement, control
and minimization of security risks in information systems to a level
that is proportionate with the value of the assets protected.
Concepts of Security 92
Security Practices

Risk Assessment

1 Identify assets: hardware - software - data - people - supplies - ...

etc.
2 Determine vulnerabilities: intentional errors - malicious actions -
natural disasters - ... etc.
3 Estimate likelihood of exploitation: presence of threats - strength of
threats - effectiveness of safeguards.
4 Compute expected annual loss.
5 Survey applicable (new) controls.
Concepts of Security 93
Security Practices

Watermarking

Alice encodes a secret message W inside object A such that:

She can retrieve W from A whenever she wants (and hence prove
ownership).
Bob cannot tamper W (by meddling with O) so as to:
Make W unreadable.
Introduce O on top of W and confuse the reader.
Remove W and introduce O and claim object A is his own.
W has to be stealthy.
W has to be resilient.
Concepts of Security 94
Security Practices

Watermarking - Types

Visible watermarks: digitally stamped.

Invisible watermarks:
Usually in images: Permanently, unalterably mark the image.
As any watermark, used for identifying the source, author, owner,
distributor or authorized consumer.
Also used for tracing images in the event of their illicit distribution.
Spatial domain watermarking (may be eliminated by cropping):
Simplest: flip the lowest order bit of chosen pixels.
Superimpose a watermark.
Color separation - watermark in only one color band.
Frequency domain watermarking: Uses Fast Fourier Transform -
Watermarks will be dispersed spatially.
Text-line coding: Lines are shifted imperceptibly up or down.
Word-shift coding: Spacing between words in a line text is altered.
Character coding: E.g. endline at the top of a letter.
Concepts of Security 95
Security Practices

Watermarking - Attacks

Subtractive attack: Bob detects, locates and crops W out of the

object A.
Distortive attack: Bob accepts a small deviation from functionality
of A through transformations affecting W.
Additive attack: Bob augments the object A by inserting his own
watermark W2.
Collusion attack: Bob compares two instances of the same object A
containing two different watermarks, finds the difference and locates
the watermarks.
Concepts of Security 96
Security Practices

Computer Forensics

Forensics: The use of science and technology to investigate and

establish facts in criminal or civil courts of law.
Computer forensics: Collection, preservation, analysis and court
presentation of computer-related evidence.
Types of procedures:
Intrusion analysis.
Damage assessment.
Suspect examination.
Tool analysis.
Log file analysis.
Evidence search (looking for software, files, tools, keywords, ... etc.
to identify the intruder and his actions).
Concepts of Security 97
Security Practices

Legal Issues

Laws regulate the use, development and ownership of data and

programs:
Copyright: gives an author exclusive rights to make copies of his
original ideas / work and sell them to public.
Patent law: protects novel innovations - applies to results of science,
technology and engineering.
Trade secret: prevents only misappropriation (wrongful taking) of
ideas, facts and know-how, whether in tangible form or not - can be
used in conjunction with copyright law and sometimes with patent
law.
Certainly greater protection is available when a combination of legal
areas is used.
Concepts of Security 98
Security Practices

Digital Rights Management (DRM)

Digital rights determine who can do what under which conditions.

Digital rights are not static (E.g. the author of an academic paper
has intellectual property rights, the publisher holds copyright,
readers will have usage rights when the paper is purchased or
acquired. Many of these rights may change over time).
DRM: The process of recording, transmitting, interpreting and
enforcing digital rights.
The aim of DRM is to prevent unauthorized use and to preserve the
integrity of digital information.
DRM products were developed in response to the rapid increase in
online piracy of commercially marketed material, which proliferated
through the widespread use of Napster and other peer-to-peer file
exchange programs.
Concepts of Security 99
Exercise - Covert Channels

Overview

1 Introduction

2 Security Models

3 Cryptography

4 Exercise - Cryptographic Protocols

5 Security Mechanisms

6 Security Practices

7 Exercise - Covert Channels

8 Security Evaluation
Concepts of Security 100
Exercise - Covert Channels

Definition - Types - Countermeasures

A covert channel is an information flow which is not controlled by a

security mechanisme; hence creating an illegitimate communication
channel between subjects.
Two main types can be defined:
1 Time-based channels: control usage of system resources to observe
variations in response times.
2 Resource-based channels: utilize attributes of shared resources.
May be countered by one of the following mechanismes:
Confinement or isolation:
Virtual machines: isolate the application from the specifications of
the computer (its architecture and/or its operating system).
Sandbox: an application environment that restricts actions of
programs according to a security policy.
Introducing noise into the information that may flow through covert
channels.
Concepts of Security 101
Exercise - Covert Channels

Question 1 - Time-based Covert Channel

The following algorithm returns R = y x mod n, given that the length of

x is w :
==========
S[0] := 1;
for k=0 to w-1 do begin
if x[k]=1 then
R[k] := (S[k] * y) mod n
else
R[k] := S[k]
endif;
S[k+1] = R[k] * R[k] mod n
endfor;
return R[w-1];
==========
Find a covert channel giving information about the key x.
Concepts of Security 102
Exercise - Covert Channels

Question 1 - Time-based Covert Channel - Answer

Request: Find a covert channel giving information about the key x

used in the previous algorithm.
Answer: A time-based covert channel is used. If a bit of the key
value is 1, the corresponding operation needs two multiplications
instead of only one if otherwise the bit is 0. The extra multiplication
needs extra time. An attack measuring execution times allows the
extraction of bits of the key value.
Concepts of Security 103
Exercise - Covert Channels

Detecting Covert Channels

Kemmerer introduced a methodology called SRM to detect covert

channels using a resource matrix:
Specify all the shared resources and their attributes that can be
recognized by the subjects. These attributes constitute the lines of
the matrix.
Specify the operations that may observe (read-like) and/or alter
(write-like) those attributes. Thes operations constitute the columns
of the matrix.
A cell in the matrix indicates a read-like and/or a write-like action.
Concepts of Security 104
Exercise - Covert Channels

Detecting Time-based Covert Channels

Kemmerer considers that a time-based covert channel exists if the

following properties are satisfied:
Sender and receiver subjects have access to the same attribute A of
a shared object.
Sender and receiver subjects have access to a time reference (a clock
or a sequence of events).
Sender subject can modify the response time needed by receiver
subject to detect a change in the attribute A.
There is a mechanism to initialize and order the actions of the two
subjects.
Concepts of Security 105
Exercise - Covert Channels

Detecting Resource-based Covert Channels

Kemmerer considers that a resource-based covert channel exists if

the following properties are satisfied:
Sender and receiver subjects have access to the same attribute A of
a shared object.
Sender subject can modify the attribute A of the shared object.
Receiver subject can check the attribute A.
There is a mechanism to initialize and coordinate the actions of the
two subjects.
Concepts of Security 106
Exercise - Covert Channels

Question 2 - Resource-based Channels - Context

Consider a system implementing a multi-level security model, where

files have 4 attributes: existence - owner - label - size, two subjects
HIGH and LOW are active, and 4 operations are defined:
1 read-file: the file exists and the label of the subject dominates the
label of the file (if the file does not exist or the access is not possible,
the requesting subject is alerted).
2 write-file: the file exists and the label of the subject is dominated by
the label of the file (if the file does not exist or the access is not
possible, the requesting subject is alerted).
3 create-file: no file holding the same name exists (the requesting
subject is alerted if the file exists). The subject that created a file is
its owner, and the label of a file is the label of its owner.
4 delete-file: the file does not exist, or the file exists and the requesting
subject is its owner (the requesting subject is alerted if it is not the
owner).
The labels can not be modified.
Subject HIGH can not communicate directly with subject LOW.
Concepts of Security 107
Exercise - Covert Channels

Question 2 - Resource-based Channels - Requests

Request 1: Build the resource matrix using the following

conventions:
“alt” indicates that a subject can modify an attribute as long as the
launched operation is allowed.
“obs” indicates that a subject can get the value of an attribute, or
certain information about this value, as long as the launched
operation is allowed.
“obs*” indicates that a subject can always get the exact value of an
attribute.
Request 2: Use the previous resource matrix to detect a
resource-based covert channel allowing the subject HIGH to send
messages to the subject LOW.
Concepts of Security 108
Exercise - Covert Channels

Question 2 - Resource-based Channels - Answer 1

Request 1: Build the resource matrix.

Answer 1:
read-file write-file create-file delete-file
Existence
Owner
Label
Size
Concepts of Security 109
Exercise - Covert Channels

Question 2 - Resource-based Channels - Answer 1

Request 1: Build the resource matrix.

Answer 1:
read-file write-file create-file delete-file
Existence obs* obs* obs*, alt obs, alt
Owner obs
Label obs obs
Size obs alt
Concepts of Security 110
Exercise - Covert Channels

Question 2 - Resource-based Channels - Answer 2

Request 2: Detect a resource-based covert channel allowing the

subject HIGH to send messages to the subject LOW.
Answer 2: We look for a cell in the resource matrix containing “obs”
and “alt”. There are two: we take the cell related to the operation
“create-file”, because it allows to observe the attribute in all cases
(it contains “obs*”).
Subjects HIGH and LOW can access the attribute “Existence” using
the operation “create-file”.
Subject HIGH can modify the attribute “Existence” of a file of which
it is the owner using the operation “delete-file”.
Subject LOW can always observe the attribute “Existence” using the
operation “create-file” (independently of the label of the file).
Is it possible to specify a protocol to initiate and coordinate the
actions of HIGH and LOW?
Concepts of Security 111
Exercise - Covert Channels

Question 2 - Resource-based Channels - Answer 2

Request 2: Detect a resource-based covert channel allowing the

subject HIGH to send messages to the subject LOW.
Answer 2: A possible protocol is the following:
i=1
end=false
for i=1 to L /*L = size of the message to send*/ while end=false
HIGH creates file “bit-i” to send “1”, otherwise “0”
HIGH creates file “High-ready-i” (retry on failure) LOW tries to create file “High-ready-i”
- if success delete it and retry regularly
- else LOW tries to create file “bit-i”
- if success store “0” and delete file “bit-i”
- else store “1”
HIGH tries to create file “Low-ready-i” - LOW creates file “Low-ready-i” (retry on failure)
- if success delete it and retry regularly
- else delete file “bit-i” if needed
end for i=i+1
LOW gives HIGH enough time to notify the end
HIGH creates file “High-end” LOW tries to create file “High-end”
- if success delete it
- else end=true
Concepts of Security 112
Security Evaluation

Overview

1 Introduction

2 Security Models

3 Cryptography

4 Exercise - Cryptographic Protocols

5 Security Mechanisms

6 Security Practices

7 Exercise - Covert Channels

8 Security Evaluation
Concepts of Security 113
Security Evaluation
Concepts of Security 114
Security Evaluation