DOCSLIB.ORG

Raytheon Secure Systems and Networks Delivering Mission Assurance in a Hostile Cyberspace Feature the Benefits of Multi-Level Security

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Raytheon Secure Systems and Networks Delivering Mission Assurance in a Hostile Cyberspace Feature the Benefits of Multi-Level Security TecHIGhHLIGHTnING RAoYTHEON l’S oTECHNOgLOGY y Tod2a007 Issyue 2 Raytheon Secure Systems and Networks Delivering Mission Assurance in a Hostile Cyberspace Feature The Benefits of Multi-Level Security ulti-level security (MLS) should be accessible to the individ - secret, confidential and unclassified has been a holy grail ever ual. To ameliorate this problem, data all can reside in a single MLS Msince the early days of high-speed guards requiring addi - domain. MLS provides the ability to applying computer systems to meet tional hardware and processing simultaneously receive, process, Col. Roger Shell was the automation needs of military overhead, or labor intensive proce - store and disseminate data of mul - the deputy director of and intelligence systems. In the dures such as manually reviewing tiple classifications within a domain the National Security 1970s, MITRE published a series of data, are commonly used when where not all users have the securi - Agency’s (NSA) papers (by Bell and LaPadua) that moving data between domains. ty clearance to access all the data National Computer describe the issues and rules of within the domain. MLS needs to Security Center (NCSC) determining access rights of individ - The single-level security domain permeate into the computing envi - as it was formed in the ual users to information, based on paradigm is not compatible with ronment (workstations, servers and early 1980s. Dr. Kenneth their credentials. In fact, in 1971, this time-sensitive collaborative pro - operating systems), the network, Kung joined NCSC in Dr. Roger Schell (then a U.S. Air cessing environment needed to the database and the mission appli - 1984 as one of the Force major) conducted his Ph.D. support net-centric operations and cations — all must work together system evaluators using research at MIT on the Multics OS the systems of element approach to maintain trust. MLS systems the famous Orange protection rings. where information is first published, must assure that users are granted access to all the data, systems and Book. He learned his then later subscribed. The concept of using single-level security services for which they are author - information assurance Although multiple initiatives in the domains results in over-clearing per - ized, while denying them access if techniques from 1980s and ‘90s were launched to sonnel, over-classifying data and they are not authorized. Dr. Shell and other tackle the MLS “problem,” the issue creating system inefficiencies and early pioneers in this is still with us today. This article addresses the background of the redundancies. To minimize or elimi - Figure 1 illustrates a traditional field (e.g., Steve Walker, issues involved in solving the gener - nate these problems, the concept configuration using guards between David Bell, Marv al MLS problem. It also describes of MLS systems was developed. security domains on the left and an Schaefer, Earl Boebert, both the security functionality and MLS enclave on the right. etc.). Dr. Kung is the the assurance needs of the MLS eliminates the need for these co-author and Multinational Department of Defense (DoD) com - separate domains. MLS systems contributor to several munity of users and possible solu - reduce the total cost of ownership Information Systems other Rainbow Series of tions to address those needs. by eliminating hardware and soft - The next major research milestone guidelines, while NSA ware redundancies. Top secret, is to tackle the issue of multination - remains the premier The DoD has a goal of fielding organization to learn Traditional: one domain per systems that provide the right infor - security classification Multi-level security (MLS) the latest information mation at the right time to the Data Store system and weapon right person. In many cases, this Unclassified Secret system protection Domain goal is difficult to achieve due to Computing Data Store techniques. the security classification of Environment the data. To properly safeguard Switch/Router information today, many DoD infor - High Speed Guard Top Secret Data Store mation systems are separated in Unclassified Data Store Data Store domains at the highest classifica - Secret Domain tion level of any data in the Computing domain. They are commonly Environment MLS Domain Switch/Router with referred to as “system high” Unclassified domains. If an individual does not High Speed Guard through Computing Environment possess a security clearance to Top Secret Data Store access a domain, they are denied Top Secret access to all information within the Domain Computing Switch/Router domain, even though some of the Environment information may have originated at Switch/Router a lower classification and thus Figure 1. Traditional vs. MLS Enclaves 8 2007 ISSUE 2 RAYTHEON TECHNOLOGY TODAY al information systems (MNIS). difficulties, customers often prefer the trusted applications will not be MNIS are inherent in battle com - less trustworthy operating systems compromised or interfered with in mand to ensure the timely such as Windows. any way by the untrusted applica - exchange of information across all tions, (see Figure 2). Security policy coalition member domains and Multiple Independent Levels enforcement mediated by the sepa - government agencies. Raytheon is of Security ration kernel is non-bypassable, doing research with the DoD to Another approach being developed always invoked and tamper-proof, identify the issues and potential to provide MLS capability is called because it is the only software that solutions under a study contract. Multiple Independent Levels of runs in privileged mode on the With the proliferation of coalition Security (MILS). Raytheon has been processor. Thus, systems with appli - operations and joint operations, the working with the Air Force Research cations at different security Raytheon is fielding a issue of information separation Laboratory Information Directorate, levels/caveats require fewer pro - product called CHAIN becomes even more challenging. the Cryptographic Modernization cessing resources. (Compartmented High Not only must the information be Program and the National Security Assurance Information separated by clearance levels with Agency for several years on the The separation kernel’s security Network). CHAIN each country’s security policy, but foundational components for this requirements are specified in the permits the separation well-defined information must be high assurance architecture to sup - NSA’s U.S. Government Protection of the information by shared across multiple countries, port systems with MLS require - Profile for Separation Kernels in compartments (as the where agreements to share are on ments and/or Multiple Single Levels Environments Requiring High name implies). Until of Security (MSLS). a bilateral basis. Information Robustness, now in its final draft. A the true MLS system is releasable to certain countries is separation kernel can be evaluated available, Raytheon is The goal of the MILS program is to not releasable to other coalition to a high level of assurance fielding CHAIN in establish a viable commercial mar - partners. This complicated set of (Evaluation Assurance Level (EAL multiple systems to ket for high assurance, standards- access control rules makes the Bell- 6+), because it is very small — on separate information LaPadula hierarchical security model based commercial off-the-shelf the order of 4,000 lines of from different of “write up, read down” tradition - (COTS) products that can be used C-Language code. Although origi - domains using the ally used in MLS systems look sim - to produce NSA-accredited systems. nally targeted to real-time, embed - compartments ple. Raytheon is currently working By leveraging COTS products t hat ded systems, the Separation Kernel enforcement to solve this demanding challenge conform to the DO-178B safety Protection Profile (SKPP) has been mechanism. There are of sharing information in the pres - standard, it is anticipated that the generalized to provide the security multiple commercial ence of multiple compartments wider customer base for these prod - requirements for a high assurance operating systems that within single security levels. ucts will result in a lower cost to virtual machine on which operating allow this enforcement. DoD security customers. systems with medium or no assur - Trusted Operating Systems ance, such as Windows, can exe - To upgrade from There are several common MILS have a layered architecture cute in separate partitions without compartments to approaches when attempting to that enforces an information flow degrading the assurance of the multi-level security, the provide MLS capability. One is to and data isolation security policy. overall system. underlying operating use a trusted operating system that At the bottom layer of the architec - system must meet the attaches sensitivity labels to all ture is a small but highly trusted The Green Hills Software (GHS) functionality and trust objects within the domain. (Sun’s separation kernel. A separation ker - Integrity Separation Kernel is avail - discussed in this article. Trusted Solaris TM is an example of a nel executes on processors such as able commercially and is currently trusted operating system.) Pentiums and PowerPCs to provide undergoing evaluation at a high Sensitivity labels identify security a virtual machine upon which a robustness level by a National classification and handling restric - variety of COTS operating systems Information Assurance Partnership tions
Load more

Recommended publications
  • Formal Modelling of Separation Kernels
    The University of York Department of Computer Science Submitted in part fulfilment for the degree of MSc in Software Engineering. Formal Modelling of Separation Kernels Andrius Velykis 18th September 20091 Supervised by Dr Leo Freitas Number of words = 45327, as counted by detex <report.tex> j wc -w. This report consists of 98 pages in total. This includes the body of the report (without blank pages) and Appendix A, but not Appendices B, C, D, E and F. 1Updated transactional operation proofs, 21st September 2009. Abstract A separation kernel is an architecture for secure applications, which benefits from inherent security of distributed systems. Due to its small size and usage in high-integrity environments, it makes a good target for formal modelling and verification. This project presents results from mechanisation and modelling of separation kernel components: a process table, a process queue and a scheduler. The results have been developed as a part of the pilot project within the international Grand Challenge in Verified Software. This thesis covers full development life-cycle from project initiation through design and evaluation to successful completion. Important findings about kernel properties, formal modelling and design decisions are discussed. The developed formal specification is fully verified and contributes to the pilot project aim of creating a formal kernel model and refining it down to implementation code. Other reusable artefacts, such as general lemmas and a new technique of ensuring transactional properties of operations are defined. The results will be curated within the Verified Software Repository. i Robertai. Aˇci¯u. Acknowledgements I would like to thank Dr Leo Freitas for his supervision, encouragement and getting me hooked on formal methods.
    [Show full text]
  • MILS Architectural Approach Supporting Trustworthiness of the Iiot Solutions
    MILS Architectural Approach Supporting Trustworthiness of the IIoT Solutions An Industrial Internet Consortium Whitepaper Rance J. DeLong (The Open Group); Ekaterina Rudina (Kaspersky) MILS Architectural Approach Context and Overview 1 Context and Overview ...................................................................................................... 4 1.1 Need for Trustworthy System Operation ............................................................................. 5 1.2 What is MILS today .............................................................................................................. 6 1.3 How MILS Addresses Safety ................................................................................................. 7 1.4 How MILS Addresses Security .............................................................................................. 8 1.5 How MILS Supports Reliability, Resilience, and Privacy ........................................................ 9 2 MILS Concepts .................................................................................................................. 9 2.1 Centralized vs Distributed Security Architecture .................................................................. 9 2.1.1 Domain Isolation .................................................................................................................................. 10 2.1.2 Isolation and Information Flow Control ............................................................................................... 11 2.1.3 Separation
    [Show full text]
  • National Information Assurance Partnership
    National Information Assurance Partnership ® TM Common Criteria Evaluation and Validation Scheme Validation Report Green Hills Software INTEGRITY-178B Separation Kernel Report Number: CCEVS-VR-10119-2008 Dated: 01 September 2008 Version: 1.0 National Institute of Standards and Technology National Security Agency Information Technology Laboratory Information Assurance Directorate 100 Bureau Drive 9800 Savage Road STE 6757 Gaithersburg, MD 20899 Fort George G. Meade, MD 20755-6757 VALIDATION REPORT Green Hills Software INTEGRITY-178B Separation Kernel ACKNOWLEDGEMENTS Validation Team Shaun Gilmore Santosh Chokhani Ken Elliott Jerry Myers Paul Bicknell Common Criteria Testing Laboratory SAIC, Inc. Columbia, Maryland ii VALIDATION REPORT Green Hills Software INTEGRITY-178B Separation Kernel Table of Contents 1 Executive Summary................................................................1 1.1 Evaluation Details.............................................................2 2 Identification...........................................................................4 3 Threats to Security ..................................................................5 4 Security Policy........................................................................7 5 Assumptions............................................................................8 5.1 Physical Assumptions .......................................................8 5.2 Personnel Assumptions.....................................................8 5.3 Connectivity Assumptions................................................8
    [Show full text]
  • Partitioned System with Xtratum on Powerpc
    Tesina de M´asteren Autom´aticae Inform´aticaIndustrial Partitioned System with XtratuM on PowerPC Author: Rui Zhou Advisor: Prof. Alfons Crespo i Lorente December 2009 Contents 1. Introduction1 1.1. MILS......................................2 1.2. ARINC 653..................................3 1.3. PikeOS.....................................6 1.4. ADEOS....................................7 2. Overview of XtratuM 11 2.1. Virtualization and Hypervisor........................ 11 2.2. XtratuM.................................... 12 3. Overview of PowerPC 16 3.1. POWER.................................... 16 3.2. PowerPC.................................... 17 3.3. PowerPC in Safety-critical.......................... 19 4. Main PowerPC Drivers to Virtualize 20 4.1. Processors................................... 20 4.2. Timer..................................... 21 4.3. Interrupt.................................... 23 4.4. Memory.................................... 24 5. Porting Implementation 25 5.1. Hypercall................................... 26 5.2. Timer..................................... 27 5.3. Interrupt.................................... 28 5.4. Memory.................................... 31 5.5. Partition.................................... 32 6. Benchmark 34 7. Conclusions and Future Work 38 Abstract Nowadays, the diversity of embedded applications has been developed into a new stage with the availability of various new high-performance processors and low cost on-chip memory. As the result of these new advances in hardware, there is a
    [Show full text]
  • Empirical Performance Comparison of Hardware and Software Task Context Switching
    View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by Calhoun, Institutional Archive of the Naval Postgraduate School Calhoun: The NPS Institutional Archive Theses and Dissertations Thesis Collection 2009-06 Empirical Performance Comparison of Hardware and Software Task Context Switching Schultz, Eric A. Monterey, California. Naval Postgraduate School http://hdl.handle.net/10945/46226 NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS EMPIRICAL PERFORMANCE COMPARISON OF HARDWARE AND SOFTWARE TASK CONTEXT SWITCHING by Eric A. Schultz June 2009 Thesis Advisor: Cynthia E. Irvine Second Reader: David J. Shifflett Approved for public release; distribution is unlimited THIS PAGE INTENTIONALLY LEFT BLANK ii Form Approved REPORT DOCUMENTATION PAGE OMB No. 0704–0188 The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704–0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202–4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS. 1. REPORT DATE (DD–MM–YYYY) 2. REPORT TYPE 3.
    [Show full text]
  • Separation Kernels on Commodity Workstations
    Systems and Network Analysis Center Information Assurance Directorate Separation Kernels on Commodity Workstations 11 March 2010 SNAC DoD, 9800 Savage Rd. Ft. Meade, MD 20755-6704 410-854-6632 DSN: 244-6632 FAX: 410-854-6604 www.nsa.gov/snac [email protected] 1 Separation Kernels on Commodity Workstations 1 Executive Summary ................................................................................................. 3 2 Introduction .............................................................................................................. 4 2.1 SKPP Evaluation ................................................................................................ 4 2.2 Assurance Maintenance ..................................................................................... 5 3 Commodity Workstation Security ............................................................................. 7 3.1 Workstation Security Argument .......................................................................... 7 3.1.1 The Applications .......................................................................................... 7 3.1.2 The Operating System ................................................................................. 7 3.1.3 The Hardware Platform ................................................................................ 8 3.2 Evaluating the Workstation Security Argument .................................................. 8 3.3 Too Many Cooks in the Kitchen ........................................................................
    [Show full text]
  • Say Goodbye to Virtualization for a Safer Cloud
    Say Goodbye to Virtualization for a Safer Cloud Dan Williams Ricardo Koller Brandon Lum IBM T.J. Watson Research Center, Yorktown Heights, NY When it comes to isolation on the cloud, conven- The main culprit is the hugely powerful kernel tional wisdom holds that virtual machines (VMs) pro- syscall API that containers use to interact with vide greater isolation than containers because of their the host OS. [23] low-level interface to the host. A lower-level interface reduces the amount of code and complexityneeded in the Yet LightVM then goes on to try to introduce container- kernel that must be relied upon for isolation. However, like properties to VMs, without giving up the complex it is incorrectly assumed that virtualization mechanisms hardware-based virtualization mechanism implementing are required to achieve a low-level interface suitable for the low-level interface to guests. isolation. In this paper, we argue that the interface to In this paper, we make the observation that the level the host can be lowered for any application by moving of the interface between the guest and the host is not kernel components to userspace. We show that using a fundamentally tied to the actual mechanism used to sep- userspace network stack results in a 33% reduction in arate the guest from the host (like the virtualization or kernel code usage, which is 20% better than when re- process mechanism). In Section 3, we describe how the sorting to virtualization mechanisms and using a VM. high-level container interface can be arbitrarily lowered by introducing library OS (libOS) components to appli- cations or using userspace services in a manner we dub 1 Introduction microkernelification.
    [Show full text]
  • Leaving Legacy Behind Reducing Carbon Footprint of Network Services with Mirageos Unikernels
    Leaving legacy behind Reducing carbon footprint of network services with MirageOS unikernels Hannes Mehnert, https://hannes.nqsb.io 36c3, 27th December 2019, Leipzig 1 / 37 Stack Application Binary Configuration Files Programming language runtime • Unix applications depend on System libraries (libc) Crypto (libssl) libraries and configuration files. System calls, Sockets API • Kernel isolates processes from each other using virtual memory. File system Scheduler Network • Compromise is contained to a User Process Hardware Management Management Drivers single process. Hardware (CPU, disk, NIC, memory) • Privilege escalation by flaws in the system call API (568 in sys/syscall.h). 2 / 37 Hypervisor stack Application Binary Configuration Files Programming language runtime • The hypervisor manages the System libraries (libc) Crypto (libssl) resources, and splits them across System calls, Sockets API virtual machines. Hardware is emulated. File system Scheduler Network • Scheduling is done by the User Process Hardware Management Management Drivers hypervisor (VMs) and by each Emulated Hardware and assigned resources virtual machines (processes). • The hypervisor isolates virtual Hypervisor vmm.ko - Resource management - Scheduling of VMs machines from each other. Kernel Hardware (CPU, disk, NIC, memory) 3 / 37 . 4 / 37 . Memory corruption issues are the root-cause of 68% of listed CVEs. Ben Hawkes analysed 108 CVE since start of Google’s Project Zero in 2014, 0day "In the Wild" https://googleprojectzero.blogspot.com/p/0day.html (published 2019-05-15)
    [Show full text]
  • Real-Time Operating System Security T
    Real-Time Operating System Security Weider D. Yu (Dipti Baheti, Jeremy Wai) Computer Engineering Department, San Jose State University, San Jose, CA 95192-0180 6.0 COMMERCIAL SYSTEM DESIGN .......................... 11 Abstract — Real Time Operating Systems 6.1 GREEN HILLS SOFTWARE , INC . .................................. 11 lie at the heart of most embedded systems. 6.2 LYNUX WORKS , INC . ................................................ 12 Connectivity of these systems enable user to 6.3 WIND RIVER , INC . .................................................. 12 monitor and control these systems remotely. 6.4 MICROSOFT , INC . ................................................... 13 This report show current systems have 7.0 SOME KNOWN CASES OF SECURITY LAPSE ......... 13 many faults in which the system is connected to each other, and to the world. 7.1 SECURITY IN VEHICLE NETWORKS .............................. 13 An analysis shows these systems could be 7.2 RISKS IN SCADA SYSTEMS ....................................... 14 significantly more secure if security policies 7.3 ATTACKS ON MOBILE PHONES .................................. 14 were followed and if current computer 8.0 LESSONS LEARNED ............................................. 15 networking security techniques are applied. 9.0 CONCLUSION ..................................................... 15 10.0 REFERENCES ..................................................... 16 Index 0.0 OUR CONTRIBUTIONS .......................................... 1 0.0 OUR CONTRIBUTIONS 1.0 INTRODUCTION ...................................................
    [Show full text]
  • An X86/64 Separation Kernel for High Assurance
    Muen - An x86/64 Separation Kernel for High Assurance Reto Buerki Adrian-Ken Rueegsegger August 29, 2013 University of Applied Sciences Rapperswil (HSR), Switzerland ii Abstract Computer systems are used to store and protect highly sensitive data. At the same time the resources and determination of attackers have increased significantly. Therefore, systems capable of safeguarding critical information must conform to rigorous quality standards to establish trust in the correct functioning. Attaining high assurance for today's monolithic operating systems is exceptionally hard since they tend to be large and include complex functionality. This fact is highlighted by regular security updates provided by operating system vendors. Thus, they are a weak foundation for building secure systems. In contrast, microkernels can be well suited as a basis for systems with strict demands on robustness. They are by definition small, which is a precondition for rigorous verification of correctness. Additionally, they lend themselves to the construction of component-based systems where the incorrect behavior of one partition does not impact the whole system. A separation kernel (SK) is a specialized microkernel that provides an execution environment for multiple components that can only communicate according to a given policy and are otherwise isolated from each other. Hence, the isolation also includes the limitation of potential side- and covert channels. SKs are generally more static and smaller than dynamic microkernels, which minimizes the possibility of kernel failure and should ease the application of formal verification techniques. Recent addition of advanced hardware virtualization support for the Intel x86 architecture has the potential of greatly simplifying the implementation of a separation kernel which can support complex systems.
    [Show full text]
  • Trusted Display on Untrusted Commodity Platforms
    Trusted Display on Untrusted Commodity Platforms ∗ Miao Yu Virgil D. Gligor Zongwei Zhou ECE Department and CyLab ECE Department and CyLab ECE Department and CyLab Carnegie Mellon University Carnegie Mellon University Carnegie Mellon University [email protected] [email protected] [email protected] ABSTRACT Keywords A trusted display service assures the confidentiality and au- GPU separation kernel; Trusted display thenticity of content output by a security-sensitive applica- tion and thus prevents a compromised commodity operating 1. INTRODUCTION system or application from surreptitiously reading or mod- A trusted display service provides a protected channel ifying the displayed output. Past approaches have failed that assures the confidentiality and authenticity of content to provide trusted display on commodity platforms that use output on selected screen areas. With it users can rely modern graphics processing units (GPUs). For example, full on the information output by a security-sensitive applica- GPU virtualization encourages the sharing of GPU address tion (SecApp) without worrying about undetectable screen space with multiple virtual machines without providing ade- \scrapping" or \painting" by malicious software on commod- quate hardware protection mechanisms; e.g., address-space ity systems; i.e., the display output is surreptitiously read separation and instruction execution control. This paper or modified by a compromised commodity operating systems proposes a new trusted display service that has a minimal (OSes) or applications (Apps). trusted code base and maintains full compatibility with com- Security architectures that isolate entire SecApps from un- modity computing platforms. The service relies on a GPU trusted commodity OSes and Applications (Apps) [35] im- separation kernel that (1) defines different types of GPU plement trusted display functions via trusted path [55, 56].
    [Show full text]
  • End-To-End Verification of Memory Isolation
    Secure System Virtualization: End-to-End Verification of Memory Isolation HAMED NEMATI Doctoral Thesis Stockholm, Sweden 2017 TRITA-CSC-A-2017:18 KTH Royal Institute of Technology ISSN 1653-5723 School of Computer Science and Communication ISRN-KTH/CSC/A--17/18-SE SE-100 44 Stockholm ISBN 978-91-7729-478-8 SWEDEN Akademisk avhandling som med tillstånd av Kungl Tekniska högskolan framlägges till offentlig granskning för avläggande av teknologie doktorsexamen i datalogi fre- dagen den 20 oktober 2017 klockan 14.00 i Kollegiesalen, Kungl Tekniska högskolan, Brinellvägen 8, Stockholm. © Hamed Nemati, October 2017 Tryck: Universitetsservice US AB iii Abstract Over the last years, security kernels have played a promising role in re- shaping the landscape of platform security on today’s ubiquitous embedded devices. Security kernels, such as separation kernels, enable constructing high-assurance mixed-criticality execution platforms. They reduce the soft- ware portion of the system’s trusted computing base to a thin layer, which enforces isolation between low- and high-criticality components. The reduced trusted computing base minimizes the system attack surface and facilitates the use of formal methods to ensure functional correctness and security of the kernel. In this thesis, we explore various aspects of building a provably secure separation kernel using virtualization technology. In particular, we examine techniques related to the appropriate management of the memory subsystem. Once these techniques were implemented and functionally verified, they pro- vide reliable a foundation for application scenarios that require strong guar- antees of isolation and facilitate formal reasoning about the system’s overall security. We show how the memory management subsystem can be virtualized to enforce isolation of system components.
    [Show full text]