The Protection of Information in Computer Systems
Total Page：16
File Type：pdf, Size：1020Kb
The Protection of Information in Computer Systems JEROME H. SALTZER, SENIOR MEMBER, IEEE, AND MICHAEL D. SCHROEDER, MEMBER, IEEE Invited Paper Abstract - This tutorial paper explores the mechanics of Confinement protecting computer-stored information from unauthorized Allowing a borrowed program to have access to data, use or modification. It concentrates on those architectural while ensuring that the program cannot release the structures--whether hardware or software--that are information. necessary to support information protection. The paper Descriptor develops in three main sections. Section I describes A protected value which is (or leads to) the physical desired functions, design principles, and examples of address of some protected object. elementary protection and authentication mechanisms. Any Discretionary reader familiar with computers should find the first section (In contrast with nondiscretionary.) Controls on access to be reasonably accessible. Section II requires some to an object that may be changed by the creator of the familiarity with descriptor-based computer architecture. It object. examines in depth the principles of modern protection Domain architectures and the relation between capability systems The set of objects that currently may be directly and access control list systems, and ends with a brief accessed by a principal. analysis of protected subsystems and protected objects. Encipherment The reader who is dismayed by either the prerequisites or The (usually) reversible scrambling of data according the level of detail in the second section may wish to skip to to a secret transformation key, so as to make it safe for Section III, which reviews the state of the art and current transmission or storage in a physically unprotected research projects and provides suggestions for further environment. reading. Grant To authorize (q. v.). Hierarchical control Glossary Referring to ability to change authorization, a scheme in which the record of each authorization is controlled The following glossary provides, for reference, brief definitions by another authorization, resulting in a hierarchical for several terms as used in this paper in the context of protecting tree of authorizations. information in computers. List-oriented Access Used to describe a protection system in which each The ability to make use of information stored in a protected object has a list of authorized principals. computer system. Used frequently as a verb, to the Password horror of grammarians. A secret character string used to authenticate the Access control list claimed identity of an individual. A list of principals that are authorized to have access to Permission some object. A particular form of allowed access, e.g., permission to Authenticate READ as contrasted with permission to WRITE. To verify the identity of a person (or other agent Prescript external to the protection system) making a request. A rule that must be followed before access to an object Authorize is permitted, thereby introducing an opportunity for To grant a principal access to certain information. human judgment about the need for access, so that Capability abuse of the access is discouraged. In a computer system, an unforgeable ticket, which Principal when presented can be taken as incontestable proof The entity in a computer system to which authorizations that the presenter is authorized to have access to the are granted; thus the unit of accountability in a object named in the ticket. computer system. Certify Privacy To check the accuracy, correctness, and completeness The ability of an individual (or organization) to decide of a security or protection mechanism. whether, when, and to whom personal (or Complete isolation organizational) information is released. A protection system that separates principals into Propagation compartments between which no flow of information or control is possible. When a principal, having been authorized access to reservations for people whose names he can supply. A flight some object, in turn authorizes access to another boarding agent might have the additional authority to print out principal. the list of all passengers who hold reservations on the flights for Protected object which he is responsible. The airline might wish to withhold from A data structure whose existence is known, but whose the reservation agent the authority to print out a list of internal organization is not accessible, except by reservations, so as to be sure that a request for a passenger list invoking the protected subsystem (q.v.) that manages it. from a law enforcement agency is reviewed by the correct level Protected subsystem of management. A collection of procedures and data objects that is The airline example is one of protection of corporate information encapsulated in a domain of its own so that the internal for corporate self-protection (or public interest, depending on structure of a data object is accessible only to the one's view). A different kind of example is an online warehouse procedures of the protected subsystem and the inventory management system that generates reports about the procedures may be called only at designated domain current status of the inventory. These reports not only represent entry points. corporate information that must be protected from release outside Protection the company, but also may indicate the quality of the job being 1) Security (q.v.). done by the warehouse manager. In order to preserve his personal 2) Used more narrowly to denote mechanisms and privacy, it may be appropriate to restrict the access to such techniques that control the access of executing reports, even within the company, to those who have a legitimate programs to stored information. reason to be judging the quality of the warehouse manager's Protection group work. A principal that may be used by several different Many other examples of systems requiring protection of individuals. information are encountered every day: credit bureau data banks; Revoke law enforcement information systems; time-sharing service To take away previously authorized access from some bureaus; on-line medical information systems; and government principal. social service data processing systems. These examples span a Security wide range of needs for organizational and personal privacy. All With respect to information processing systems, used to have in common controlled sharing of information among denote mechanisms and techniques that control who multiple users. All, therefore, require some plan to ensure that the may use or modify the computer or the information computer system helps implement the correct authority structure. stored in it. Of course, in some applications no special provisions in the Self control computer system are necessary. It may be, for instance, that an Referring to ability to change authorization, a scheme externally administered code of ethics or a lack of knowledge in which each authorization contains within it the about computers adequately protects the stored information. specification of which principals may change it. Although there are situations in which the computer need provide Ticket-oriented no aids to ensure protection of information, often it is appropriate Used to describe a protection system in which each to have the computer enforce a desired authority structure. principal maintains a list of unforgeable bit patterns, The words "privacy," "security," and "protection" are frequently called tickets, one for each object the principal is used in connection with information-storing systems. Not all authorized to have access. authors use these terms in the same way. This paper uses User definitions commonly encountered in computer science literature. Used imprecisely to refer to the individual who is The term "privacy" denotes a socially defined ability of an accountable for some identifiable set of activities in a individual (or organization) to determine whether, when, and to computer system. whom personal (or organizational) information is to be released. This paper will not be explicitly concerned with privacy, but 1 instead with the mechanisms used to help achieve it. The term "security" describes techniques that control who may use or modify the computer or the information contained in it.2 I. BASIC PRINCIPLES OF INFORMATION PROTECTION Security specialists (e.g., Anderson [6] ) have found it useful to place potential security violations in three categories. 1) Unauthorized information release: an unauthorized person is A. Considerations Surrounding the Study of Protection able to read and take advantage of information stored in the computer. This category of concern sometimes extends to "traffic 1) General Observations: As computers become better analysis," in which the intruder observes only the patterns of understood and more economical, every day brings new information use and from those patterns can infer some applications. Many of these new applications involve both storing information content. It also includes unauthorized use of a information and simultaneous use by several individuals. The key proprietary program. concern in this paper is multiple use. For those applications in 2) Unauthorized information modification: an unauthorized which all users should not have identical authority, some scheme person is able to make changes in stored information--a form of is needed to ensure that the computer system implements the sabotage. Note that this kind of violation does not require that the desired authority structure.