DOCSLIB.ORG

New Concept of the Android Keystore Service with Regard to Security and Portability

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
New Concept of the Android Keystore Service with Regard to Security and Portability University of Bremen Department of Mathematics and Computer Science New concept of the Android keystore service with regard to security and portability. Master’s Thesis by Fritjof Bornebusch reviewed by Dr. Karsten Sohr Prof. Dr. Jan Peleska supervised by Dipl. Inf. Florian Junge 2016 Confirmation I hereby confirm that I wrote this master thesis on my own and that I have used only the indicated references, resources, and aids. In German: Hiermit bestätige ich, dass ich die vorliegende Masterthesis selbstständig verfasst, und keine anderen als die angegebenen Quellen und Hilfsmittel verwendet habe. Bremen, 1/13/2016 Fritjof Bornebusch “Any fool can write code that a computer can understand. Good programmers write code that humans can understand.” – Martin Fowler – Bornebusch, Fritjof New concept of the Android keystore service with regard to security and portability. Master’s thesis, Department 3 - Mathematics / Computer Science University of Bremen, 2015 This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0). To view a copy of this license, send an email to [email protected], visit http://creativecommons.org/licenses/by-nc-sa/4.0/ or send a letter to Creative Commons, PO Box 1866, Mountain View, California, 94042, USA. Table of Contents Acknowledgements 7 List of Figures 9 List of Listings 10 Acronyms 13 Glossary 15 1 Introduction 19 2 Background 24 2.1 Android System Architecture . 24 2.1.1 Security-Enhanced Linux . 28 2.1.2 Capabilities . 31 2.2 Memory Vulnerabilities . 32 2.2.1 Buffer Overflow Protection . 33 2.2.2 Dead Store Elimination . 36 2.3 Encryption . 38 2.3.1 Symmetric-Key Algorithm . 38 2.3.2 Asymmetric-Key Algorithm . 39 2.3.3 Mode of Operation . 40 2.4 Hashing . 41 2.4.1 Secure Hash Algorithm . 42 2.4.2 Passphrase . 42 2.5 Signature . 43 5 TABLE OF CONTENTS 3 Analysis of the Android keystore service 45 3.1 Design . 46 3.1.1 The Android RPC subsystem . 47 3.1.2 Architecture of the Android keystore service . 48 3.2 Application Programming Interface . 57 3.2.1 Java . 57 3.2.2 C++ . 58 3.3 Implementation . 59 3.3.1 Coding Style . 59 3.3.2 Library Functions . 60 3.3.3 SELinux . 65 3.3.4 Compiler Flags . 67 3.3.5 Logging . 68 3.3.6 Folder structure . 71 3.4 Init subsystem . 72 3.5 Implemented hashing algorithm . 74 3.5.1 Master key generation . 77 3.6 Implemented encryption algorithm . 79 3.7 Result . 81 4 Implementation of the new keystore service 84 4.1 Design . 85 4.2 Implementation . 85 4.2.1 Compiler Flags . 87 4.2.2 Folder structure . 90 4.2.3 Application Programming Interface . 91 4.3 Security . 91 4.3.1 Hashing . 92 4.3.2 Encryption . 93 4.4 Portability . 97 4.4.1 Design . 98 4.4.2 Privilege Separation . 99 4.4.3 Implementation . 104 4.5 Result . 112 6 TABLE OF CONTENTS 5 Evaluation 114 5.1 Android . 114 5.1.1 Testing . 115 5.2 Portable version . 116 5.2.1 Testing . 118 5.3 Result . 119 6 Conclusion and Future Work 120 6.1 Conclusion . 120 6.2 Future Work . 123 Bibliography 125 Appendices 129 A Static analysing logs 131 B keystore_cli(1) usage 133 C ks(1) usage 134 D Android keystore compiler flags 135 E Portable keystore compiler flags 136 F Structures for sending and receiving 138 G Class diagram 140 7 Acknowledgements Thank you Prof. Dr. Jan Peleska, Dr. Karsten Sohr, and Florian Junge for making this thesis possible with your believing in the relevance of this topic. This document is my own work, but it would not be in this shape without the help of friends. They spotted weak arguments, linguistic and technical errors, as well as poor sentences and made this thesis comprehensive and focused. Without their help it would not be in this shape. Aaron Lye Thank you for your comments, for the discussions about the technical aspects of this document, and for checking the bibliography. Christina Plump Thank your for your comments, linguistic corrections, and the discussions about weak argumentations. Max Nitze Thank you for your comments, and the discussions about the technical aspects of this document. Kai Hillmann Thank you for the discussions about the structure of this document. Edina Alessa Staschewski Thank you for supporting me in my lazy times and pushing me back to work. At last, a big thank you to those who are not listed by name here for supporting me when I was busy. This helped me a lot to finish my study by writing this master thesis. 8 List of Figures 2.1 Android system architecture . 25 2.2 Android intents . 27 2.3 Stack layout . 34 2.4 Stack layout with canary . 34 2.5 Time to brute-force 128 bit AES key . 39 2.6 Electronic Codebook mode . 40 2.7 Cipher Block Chaining mode . 41 2.8 Keyed-Hash Message Authentication Code . 43 3.1 Android keystore service design . 46 3.2 The Android RPC subsystem . 47 3.3 Android keystore service class diagram . 49 3.4 MD5 value hashing . 76 3.5 Original plain text encryption . 81 3.6 scan-build(1) errors . 82 3.7 gcc(1) flag errors . 82 4.1 Portable keystore service design . 98 4.2 Design of the portable version . 99 G.1 Keystore transactions . 140 G.2 Class dependency diagram . 141 G.3 Class keystore . 142 G.4 Classes blob and entropy . 143 G.5 Class userstate . 144 9 List of Listings 2.1 Dead store elimination example . 36 2.2 Dead store elimination without optimizations . 37 2.3 Dead store elimination with optimizations . 37 3.1 BnKeystoreService: onTransaction method implementation . 51 3.2 grant_t type ................................... 52 3.3 Register keystore proxy . 53 3.4 BpKeystoreService: test method implementation in keystore service . 54 3.5 Accessing BpKeystoreService from the keystore client . 54 3.6 Original blob structure . 56 3.7 memcpy(3) function call . 60 3.8 malloc(3) function call . 61 3.9 malloc(3) function call in keystore service . 61 3.10 atoi(3) function call . 62 3.11 atoi(3) function call no. 1 . 63 3.12 atoi(3) function call no. 2 . 63 3.13 strtol(3) function call . 64 3.14 Convert string to int safely . 64 3.15 SELinux permissions . 65 3.16 SELinux users . 66.
Load more

Recommended publications
  • Least Privilege and Privilege Separation
    CSE 127: Computer Security Least privilege and privilege separation Deian Stefan Slides adopted from John Mitchell, Dan Boneh, and Stefan Savage This week… • How to build secure systems ➤ Least privilege and privilege separation ➤ Sandboxing and isolation • Key is underlying principles not mechanisms ➤ We’re going to look at systems techniques ➤ Other ways to achieve similar goals: language-based Principles of secure design • Principle of least privilege • Privilege separation • Defense in depth ➤ Use more than one security mechanism ➤ Fail securely/closed • Keep it simple Principles of secure design • Principle of least privilege • Privilege separation • Defense in depth ➤ Use more than one security mechanism ➤ Fail securely/closed • Keep it simple Principle of Least Privilege Defn: A system should only have the minimal privileges needed for its intended purposes • What’s a privilege? ➤ Ability to access (e.g., read or write) a resource Principle of Least Privilege Defn: A system should only have the minimal privileges needed for its intended purposes • What’s a privilege? ➤ Ability to access (e.g., read or write) a resource Principle of Least Privilege Defn: A system should only have the minimal privileges needed for its intended purposes • What’s a privilege? ➤ Ability to access (e.g., read or write) a resource What’s the problem with this defn? • Talking about a huge, monolith system is not really useful • Why? Network Network User input User device File system File system Breaking a system into components • Compartmentalization and isolation ➤ Separate the system into isolated compartments ➤ Limit interaction between compartments • Why is this more meaningful? Network Network User input User device File system File system How dow we break things apart? Map compartment to user ids! • Recall: permissions in UNIX granted according to UID ➤ A process may access files, network sockets, ….
    [Show full text]
  • Integration of Security Measures and Techniques in an Operating System (Considering Openbsd As an Example)
    Motivation Security Solutions and Techniques Summary Integration of Security Measures and Techniques in an Operating System (considering OpenBSD as an example) Igor Boehm Institute for Information Processing and Microprocessor Technology Johannes Kepler University Linz, Austria Igor Boehm Integration of Security Measures and Techniques in an OS Motivation Security Solutions and Techniques Summary Outline 1 Motivation The Basic Problem Being Studied Preliminary Solution Ideas and Goals 2 Security Solutions and Techniques Secure Software Design Techniques Memory Protection Techniques Relevance of Random Numbers for Security Igor Boehm Integration of Security Measures and Techniques in an OS Motivation The Basic Problem Being Studied Security Solutions and Techniques Preliminary Solution Ideas and Goals Summary Outline 1 Motivation The Basic Problem Being Studied Preliminary Solution Ideas and Goals 2 Security Solutions and Techniques Secure Software Design Techniques Memory Protection Techniques Relevance of Random Numbers for Security Igor Boehm Integration of Security Measures and Techniques in an OS Motivation The Basic Problem Being Studied Security Solutions and Techniques Preliminary Solution Ideas and Goals Summary The Basic Problem Being Studied The Clever Attacker: . finds a bug . knows how to craft an exploit . the exploit grants the attacker an advantage . the exploit is likely to work on many systems because of the strict regularity of the system environment Is there a way to solve this problem? Igor Boehm Integration of Security
    [Show full text]
  • Z/OS Openssh User's Guide
    z/OS Version 2 Release 4 z/OS OpenSSH User's Guide IBM SC27-6806-40 Note Before using this information and the product it supports, read the information in “Notices” on page 503. This edition applies to Version 2 Release 4 of z/OS (5650-ZOS) and to all subsequent releases and modifications until otherwise indicated in new editions. Last updated: 2020-11-16 © Copyright International Business Machines Corporation 2015, 2019. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Figures................................................................................................................. ix Tables.................................................................................................................. xi About this document...........................................................................................xiii Who should use this document?............................................................................................................... xiii z/OS information........................................................................................................................................xiii Discussion list...................................................................................................................................... xiii How to send your comments to IBM......................................................................xv If you have a technical problem.................................................................................................................xv
    [Show full text]
  • VULNERABLE by DESIGN: MITIGATING DESIGN FLAWS in HARDWARE and SOFTWARE Konoth, R.K
    VU Research Portal VULNERABLE BY DESIGN: MITIGATING DESIGN FLAWS IN HARDWARE AND SOFTWARE Konoth, R.K. 2020 document version Publisher's PDF, also known as Version of record Link to publication in VU Research Portal citation for published version (APA) Konoth, R. K. (2020). VULNERABLE BY DESIGN: MITIGATING DESIGN FLAWS IN HARDWARE AND SOFTWARE. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal ? Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. E-mail address: [email protected] Download date: 07. Oct. 2021 VULNERABLE BY DESIGN: MITIGATING DESIGN FLAWS IN HARDWARE AND SOFTWARE PH.D. THESIS RADHESH KRISHNAN KONOTH VRIJE UNIVERSITEIT AMSTERDAM, 2020 Faculty of Science The research reported in this dissertation was conducted at the Faculty of Science — at the Department of Computer Science — of the Vrije Universiteit Amsterdam This work was supported by the MALPAY consortium, consisting of the Dutch national police, ING, ABN AMRO, Rabobank, Fox-IT, and TNO.
    [Show full text]
  • Free, Functional, and Secure
    Free, Functional, and Secure Dante Catalfamo What is OpenBSD? Not Linux? ● Unix-like ● Similar layout ● Similar tools ● POSIX ● NOT the same History ● Originated at AT&T, who were unable to compete in the industry (1970s) ● Given to Universities for educational purposes ● Universities improved the code under the BSD license The License The license: ● Retain the copyright notice ● No warranty ● Don’t use the author's name to promote the product History Cont’d ● After 15 years, the partnership ended ● Almost the entire OS had been rewritten ● The university released the (now mostly BSD licensed) code for free History Cont’d ● AT&T launching Unix System Labories (USL) ● Sued UC Berkeley ● Berkeley fought back, claiming the code didn’t belong to AT&T ● 2 year lawsuit ● AT&T lost, and was found guilty of violating the BSD license History Cont’d ● BSD4.4-Lite released ● The only operating system ever released incomplete ● This became the base of FreeBSD and NetBSD, and eventually OpenBSD and MacOS History Cont’d ● Theo DeRaadt ○ Originally a NetBSD developer ○ Forked NetBSD into OpenBSD after disagreement the direction of the project *fork* Innovations W^X ● Pioneered by the OpenBSD project in 3.3 in 2002, strictly enforced in 6.0 ● Memory can either be write or execute, but but both (XOR) ● Similar to PaX Linux kernel extension (developed later) AnonCVS ● First project with a public source tree featuring version control (1995) ● Now an extremely popular model of software development anonymous anonymous anonymous anonymous anonymous IPSec ● First free operating system to implement an IPSec VPN stack Privilege Separation ● First implemented in 3.2 ● Split a program into processes performing different sub-functions ● Now used in almost all privileged programs in OpenBSD like httpd, bgpd, dhcpd, syslog, sndio, etc.
    [Show full text]
  • Make Least Privilege a Right
    Make Least Privilege a Right (Not a Privilege) Maxwell Krohn∗, Petros Efstathopoulosy, Cliff Frey∗, Frans Kaashoek∗, Eddie Kohlery, David Mazieres` z, Robert Morris∗, Michelle Osbornez, Steve VanDeBogarty and David Ziegler∗ ∗MIT yUCLA zNYU [email protected] ABSTRACT ized mandatory access control [17]. The end result is a Though system security would benefit if programmers new operating system called Asbestos. routinely followed the principle of least privilege [24], 2 LESSONS FROM CURRENT SYSTEMS the interfaces exposed by operating systems often stand in the way. We investigate why modern OSes thwart se- Administrators and programmers can achieve POLP by cure programming practices and propose solutions. pushing the features in modern Unix-like operating sys- tems, but only partially, and with important practical 1 INTRODUCTION drawbacks. Though many software developers simultaneously revere 2.1 chrooting or jailing Greedy Applications and ignore the principles of their craft, they reserve spe- cial sanctimony for the principle of least privilege, or Because Unix grants privilege with coarse granularity, POLP [24]. All programmers agree in theory: an applica- many Unix applications acquire more privileges than tion should have the minimal privilege needed to perform they require. These “greedy applications” can be tamed its task. At the very least, five POLP requirements must with the chroot or jail system calls. Both calls con- be followed: (1) split applications into smaller protec- fine applications to jails, areas of the file system that tion domains, or “compartments”; (2) assign exactly the administrators can configure to exclude setuid executa- right privileges to each compartment; (3) engineer com- bles and sensitive files.
    [Show full text]
  • Privilege Separation Made Easy
    Privilege separation made easy Trusting small libraries not big processes Derek G. Murray Steven Hand University of Cambridge Computer Laboratory University of Cambridge Computer Laboratory Cambridge, United Kingdom Cambridge, United Kingdom [email protected] [email protected] ABSTRACT practices” for security. Therefore, we present a new ap- At the heart of a secure software system is a small, trustwor- proach, based on the well-understood and commonly-used thy component, called the Trusted Computing Base (TCB). concept of dynamic libraries. However, developers persist in building monolithic systems Several researchers have discussed the problem of divid- that force their users to trust the entire system. We posit ing a monolithic piece of software into several smaller pieces, that this is due to the lack of a straightforward mechanism of each of which runs with the least necessary privilege. Disag- partitioning – or disaggregating – systems into trusted and gregation [16], partitioning [8], privilege separation [17] and untrusted components. We propose to use dynamic libraries TCB-reduction [13, 21] are simply different names for the as the unit of disaggregation, because these are a familiar process of dividing software into a small trusted computing abstraction, which is commonly used in mainstream software base (TCB), and a larger untrusted part. However, existing development. solutions to this problem either use ad hoc techniques or In this paper, we present our early ideas on the disag- source code annotation to split the code. gregated library approach, which can be applied to existing Dynamic libraries – i.e. collections of executable code and applications that run on commodity operating systems.
    [Show full text]
  • LIBRARIES Building a Global Information Assurance Program.Pdf
    Building a Global Information Assurance Program OTHER AUERBACH PUBLICATIONS The ABCs of IP Addressing Information Security Management Gilbert Held Handbook, 4th Edition, Volume 4 ISBN: 0-8493-1144-6 Harold F. Tipton and Micki Krause, Editors The ABCs of TCP/IP ISBN: 0-8493-1518-2 Gilbert Held Information Security Policies, ISBN: 0-8493-1463-1 Procedures, and Standards: Building an Information Security Guidelines for Effective Information Awareness Program Security Management Mark B. Desman Thomas R. Peltier ISBN: 0-8493-0116-5 ISBN: 0-8493-1137-3 Building a Wireless Office Information Security Risk Analysis Gilbert Held Thomas R. Peltier ISBN: 0-8493-1271-X ISBN: 0-8493-0880-1 The Complete Book of Middleware A Practical Guide to Security Engineering Judith Myerson and Information Assurance ISBN: 0-8493-1272-8 Debra Herrmann ISBN: 0-8493-1163-2 Computer Telephony Integration, 2nd Edition The Privacy Papers: William A. Yarberry, Jr. Managing Technology and Consumers, ISBN: 0-8493-1438-0 Employee, and Legislative Action Rebecca Herold Cyber Crime Investigator’s Field Guide ISBN: 0-8493-1248-5 Bruce Middleton ISBN: 0-8493-1192-6 Secure Internet Practices: Best Practices for Securing Systems in Cyber Forensics: A Field Manual for the Internet and e-Business Age Collecting, Examining, and Preserving Patrick McBride, Jody Patilla, Evidence of Computer Crimes Craig Robinson, Peter Thermos, Albert J. Marcella and Robert S. Greenfield, and Edward P. Moser Editors ISBN: 0-8493-1239-6 ISBN: 0-8493-0955-7 Securing and Controlling Cisco Routers Global Information Warfare: Peter T. Davis How Businesses, Governments, and ISBN: 0-8493-1290-6 Others Achieve Objectives and Attain Competitive Advantages Securing E-Business Applications and Andy Jones, Gerald L.
    [Show full text]
  • Scalar I3 and I6 Open Source Software Licenses
    Tape Automation Scalar i3 & Scalar i6, Firmware Release 1.1 (110G) Open Source Software Licenses Open Source Software (OSS) Licenses for: • Scalar i3 & Scalar i6 Firmware Release 1.1 (110G). The firmware/software contained in the Scalar i3 & Scalar i6 is an aggregate of vendor proprie- tary programs as well as third party programs, including Open Source Software (OSS). Use of OSS is subject to designated license terms and the following OSS license disclosure lists all open source components and applicable licenses that are part of the tape library firmware. All software that is designated as OSS may be copied, distributed, and/or modified in accordance with the terms and conditions of its respective license(s). Additionally, for some OSS you are entitled to obtain the corresponding OSS source files as required by the respective and applicable license terms. While GNU General Public License ("GPL") and GNU Lesser General Public Li- cense ("LGPL") licensed OSS requires that the sources be made available, Quantum makes all tape library firmware integrated OSS source files, whether licensed as GPL, LGPL or otherwise, available upon request. Please refer to the Scalar i3 & Scalar i6 Open Source License CD (part number 3-07787-01) when making such request. For contact information, see Getting More In- formation. LTO tape drives installed in the library may also include OSS components. For a complete list- ing of respective OSS packages and applicable OSS license information included in LTO tape drives, as well as instructions to obtain source files pursuant to applicable license requirements, please reference the Tape Automation disclosure listings under the Open Source Information link at www.quantum.com/support.
    [Show full text]
  • Writing Exploit-Resistant Code with Openbsd Lawrence Teo Lteo Openbsd.Org @Lteo
    Writing Exploit-Resistant Code with OpenBSD Lawrence Teo lteo openbsd.org @lteo Slides and references at: https://lteo.net/carolinacon15 CarolinaCon 15 - Charlotte, NC - April 27, 2019 A question Innovation’s Black Hole Security vulnerabilities Image Credit: EHT Collaboration https://www.eso.org/public/images/eso1907a/ What is OpenBSD? • Free, multi-platform UNIX-liKe operating system • Founded by Theo de Raadt in 1995 • Secure by default • A research operating system • Two releases per year • You’re very liKely using OpenBSD code everyday • OpenSSH • LibreSSL • tmux • More: openbsd.org/innovations.html • Coolest mascot ever whoami • OpenBSD developer since 2012 • Primarily areas related to networking • PF, networK stacK, libpcap, tcpdump, etc. • Userland stuff, ports, man pages, etc • Co-founder, Calyptix Security • Shipping thousands of OpenBSD-based firewalls from Charlotte since 2006! • Ph.D. from UNC Charlotte (2006) • Research area: Info sharing for intrusion detection Auditing Software vulnerabilities How OpenBSD attacks the software vulnerability problem (my view) Auditing Exploit Software Mitigation vulnerabilities Techniques How OpenBSD attacks the software vulnerability problem (my view) Auditing Exploit Software Mitigation vulnerabilities Techniques Rigorous Development Process How OpenBSD attacks the software vulnerability problem (my view) Licensing Auditing Exploit Software Mitigation vulnerabilities Techniques Rigorous Development Process How OpenBSD attacks the software vulnerability problem (my view) Licensing Education
    [Show full text]
  • Pledge and Privsep
    Pledge: where did it come from? Was pledge invented in a light happy dream? „ We stood beneath an amber moon Where hearts were entertaining June And softly whispered "someday soon" We kissed and clung together … “ No, it is the outcome of nightmares. My nightmares ● When Good Instructions go Bad: Generalizing return- oriented programming to RISC – Buckanan, Roemer, Shacham, Savage. 2008. ● Hacking Blind (BROP) – Bittau, Belay, Mashtizadeh, Mazières, Boneh. 2014. ROP – Return Oriented Programming Hijack control-flow with false return frames, running gadgets, combining artifacts effects Gadget is any sequence of register/memory transfer above a true ret (or polymorphic ret) instruction Attacker needs to know where gadgets are, and address of the new-stack Also JOP, SROP, etc. BROP – Blind ROP An address-space oracle Repeated probes against reused address-space learns enough to perform minimum ROP operations Then uses various ROP methods. (Large) software will never be perfect Erroneous condition logic fails, then cascades through successive failures, often externally controllable Results in illegal access/control of the program & libraries, or toying with kernel surface Attacker tools and knowledge are improving, faster than developers can cope I work on mitigations Mitigations are inexpensive tweaks which impact attack methods – trying to diminishing their effectiveness Some mitigations expose use of un-standardized behaviours Defect detected ―> Fail Closed Pressure towards robustness in software. Robust (adj.) „ When used to describe software or computer systems, robust can describe one or more of several qualities: – a system that does not break down easily or is not wholly affected by a single application failure – a system that either recovers quickly from or holds up well under exceptional circumstances – a system that is not wholly affected by a bug in one aspect of it “ On the way to the lush valley of robust, we must first cross the wilderness of fail-closed.
    [Show full text]
  • Principle of Least Privilege
    CSMC 412 Operating Systems Prof. Ashok K Agrawala Set 19 Protection • Goals of Protection • Principles of Protection • Protection Rings • Domain of Protection • Access Matrix • Implementation of Access Matrix • Revocation of Access Rights • Role-based Access Control • Mandatory Access Control (MAC) • Capability-Based Systems • Other Protection Implementation Methods • Language-based Protection Copyright 2018 Silberschatz, Galvin and Gagne Objectives • Discuss the goals and principles of protection in a modern computer system • Explain how protection domains combined with an access matrix are used to specify the resources a process may access • Examine capability and language-based protection systems • Describe how protection mechanisms can mitigate system attacks Copyright 2018 Silberschatz, Galvin and Gagne Security Vs. Protection • Security – • Guarding computer resources against unauthorized access, malicious destruction or alteration, and accidental introduction of inconsistency. • Protection – • Controlling the access of processes and users to the resources defined by a computer system. • System is secure if resources used and accessed as intended under all circumstances • Unachievable Copyright 2018 Silberschatz, Galvin and Gagne Goals of Protection • In one protection model, computer consists of a collection of objects, hardware or software • Each object has a unique name and can be accessed through a well- defined set of operations • Protection problem - ensure that each object is accessed correctly and only by those processes
    [Show full text]