A Secure Context-Sensitive File System Britton Dennis, Tyler Travis

A Secure Context-Sensitive File System determined within a split second. Computers, like humans, experience a variety of contexts Britton Dennis, Tyler Travis, Clark Wood at different times. The difference between visiting the real Facebook website and a clever Abstract imposter may be the difference between seeing HTTP and HTTPS in one’s browser. In this paper we present a secure, Until now, security context was determined in context-sensitive file system. Our system was real-time by users picking up various context designed to offer block level security as well as clues and modifying their own behavior present access to a file under multiple, accordingly. The disadvantage of this manual, constantly shifting contexts in diverse fashions. case-by-case decision is that humans make Some of our related works illustrate different mistakes. A less technologically-savvy person ways to use the different context / view may not even notice that what appears to be approach, but these prior works raise similar their banking website has an invalid SSL security concerns, and consequently we chose certificate, and because additional security to design our file system to limit the information comes at the cost of usability, users often that gets presented to the viewer. This is ignore such warnings, even if they know what because of a fundamental capacity for the warning means. The burden of determining sensitive data leakage in these systems, owing the secureness of a given system cannot be to the presence of naming collisions. This placed solely upon end-users. becomes important when trying to design a In order to mitigate these concerns, secure file system which adheres to such researchers are developing context-aware security schemes as Biba or BLP[3, 2], which software. Michael Mitchell explained restrict reading or writing to objects of a higher environmental context as differing from the or lower security level. We currently implement conventional process context switching. a version of Bell LaPadula, which enforces a Instead, environmental context is derived from general “no read up” policy to protect data many different sources that each explain a confidentiality. small piece of where the machine is and how it Under the most privileged access, is being used. For instance, sensors like GPS, wherein a user or application has complete processes running within the machine, and the access to all file blocks, the file will appear as user’s internet activity can be used in unison to normal, but as the security level drops due to determine the context in which the machine is monitored contextual changes which our being operated [9]. system deems as putting the system in a less There already exist frameworks for secure state, less and less information will be creating context-sensitive files, like quFiles [F], presented. This is implemented at the block but, for various reasons, these projects do not level of the file system. Depending upon a achieve the type and level of security some user’s context, he or she may have access to users require. Context-sensitive security can all or a subset of the blocks which make up a mean many different things, so for the scope of file. We left the choice of what gets displayed this paper context-sensitive security will be under each context to the user, since this is a defined as protection of a resource’s policy decision, where users with different confidentiality and or integrity as determined security requirements would have different by the current nature of its environment. There views as to what constitutes important is a natural understanding of varying levels of information. When a change in context is security, from a completely insecure detecting, the user is given access to either environment, perhaps an unencrypted hard more or fewer blocks, depending upon whether drive on a system with many conspicuous the security level has risen or fallen processes running which is attached to and respectively. sending sensitive data over an unencrypted wireless network, to a highly secure, air I Introduction gapped, guarded SCIF which can only be accessed by individuals with a particular Context is all around us. The security clearance [14]. difference between a genuine compliment and Time-tested security models, like Biba a snide affront is subtle, minute, and and BLP [3 ,2], provide general ways to implement security for integrity and the file system are obscured from users and confidentiality respectively. Confidentiality user land processes. gives access to information only to authorized Security is baked into every level, from users, while integrity prohibits the changing of NX bits at the hardware level, which mark this information by unauthorized users [12]. whether a page can be executed or not [8], to Biba protects integrity by disallowing read HTTPS, an application layer protocol which down or write up, and inversely Bell Lapadula provides web site authentication and internet protects confidentiality by disallowing read up traffic encryption [6]. or write down. Both of these properties, along In addition, context itself is becoming with availability, are valuable to users, and more and more important as users become must be taken into consideration. increasingly mobile [4]. An application which provides context- sensitive security must safeguard confidentiality, integrity, and availability by moving to and from more and less secure states depending upon the environmental context. This context exists as an aggregation of the aforementioned factors, and our system detects these changes in context and responds appropriately by moving between security levels. Our project exists at the filesystem level, and consists of three major parts: i) a context monitor, which runs a suite of tests to determine the current security context, ii) a custom file system based on the ext3 file system, with the ability to handle multiple versions of the same file, which co- exist at a low level, but which may be invisible to a user and applications, depending upon the system’s security level, and iii) A set of IOCTL calls which allow the context manager to interact with the file system. II Motivation (Graph available at [4]). Context-based security in the file By 2012 Q3, over 1 billion system follows in the footsteps of such smartphones were in use worldwide, and this research as ext3cow, an offshoot of the ext3 proportion is predicted to rise over time by file system, which was developed to allow for Strategy Analytics [5]. One of the major easier file versioning and auditing which was markers of this meteoric trend in computing is beginning to be required by legislation [11]. As that users are able to access all sorts of data a file system, ext3cow resides in a sweet spot, in all sorts of locations. The rise of social where no modification to the kernel is required, media has made it increasingly easy to find and user land applications can be oblivious to personally identifiable information (PII) about the custom file system. This is the primary users, and social engineering continues to be reason for the placement of context sensitivity the easiest route to getting PII or other in the file system, because costs to the user sensitive information. Users must, in a sense, are minimized. No custom hardware setups or be protected from themselves, because it purchases are required, so adopters of this incurs an unreasonable cost to continue to re- system incur relatively few extra purchasing educate all users as technology continues to costs. No kernel modification is required, which change and progress. It is important, in light of greatly reduces complexity and time costs to these changes, to adapt security to protect users. Lastly, user land applications require no users from themselves, since they are often modification, because the changes from within the weakest link in the security chain [1]. A secure, context-sensitive file system level application’s job by working at the file is a broad topic, with many possible level. quFiles can also realize performance applications and consequent threat models. In gains, for instance by using excess storage to particular, we aim to address confidentiality by hold music files in an uncompressed state and enforcing ascending levels of security. If an providing this uncompressed version to a object is labelled with security level n, then this music player, saving battery power in object should be inaccessible to all users when smartphones. They can also implement a the security level is less than or equal to n - 1. copy-on-write filesystem [13]. We are assuming attackers have no access to However, quFiles are not realizable as the hardware or root access, since either of a base for our project because of several these scenarios allows attackers access to the disadvantages. First and foremost, all quFile kernel and file system data structures, and views are completely visible to the user. They completely circumvents our protections. are implemented by appending a .qufile to the Hardware access attacks could be mitigated directory in question, and storing various by encrypting secure files. versions of the quFile within this directory [13]. There is nothing stopping a user from III Related work changing to this directory and interacting with the contents directly, in fact, this is encouraged III.i quFiles to make quFiles policies more easily writable by third-parties. This is unacceptable for our In 2008, the concept of quFiles was project, because if, for example, a secret user introduced. The authors argued that can read a top secret file, then we have failed environmental context was becoming more to provide data confidentiality. Furthermore, and more important, as could be seen by the the simplistic scheme of appending .qufile to rise in applications designed to act differently the directory allows for collisions, however depending on such context clues as battery unlikely.

Load more