Operating System Access Control

Research Areas: Assured Identity and Privacy,

Principal Investigator: Ninghui Li

Most of today’s operating systems use Discretionary Access Control (DAC) as their primary access control mechanism. One key weakness of DAC is that it is susceptible to the trojan horse attack. An attacker can create a malicious program as a trojan horse, and a process running the trojan horse program will have the privileges of the user who runs it; thus the process can abuse these privileges and violate the intended DAC policy. For similar reasons, existing DAC mechanisms provide inadequate protection when softwares are buggy. When attackers are able to feed malicious inputs to buggy softwares, they may be able to exploit the bugs and take control of the process. From this point of view, buggy softwares become trojan horses when the attacker is able to feed inputs to them. Exploiting this weakness of DAC, attackers are able to execute malicious code under the privileges of legitimate users, compromising end hosts. Host compromise further leads to a wide range of other computer security problems. Computer worms propagate by first compromising vulnerable hosts and then propagating to other hosts. Compromised hosts may be organized under a common command and control infrastructure, forming botnets. Botnets can then be used for carrying out attacks such as phishing, spamming, and distributed denial of service.

This project aims at developing Mandatory Access Control (MAC) techniques to enhance existing DAC mechanism to prevent host compromise. This project has several important differences from previous projects with a similar goal. First, usability is treated as a top priority. The usability goals are as follows: Configuring such a MAC system should not be more difficult than installing and configuring an operating system; and existing applications and common usage practices can still be used. This resulted in design choices that trade off security for simplicity and the introduction of novel exception mechanisms to the MAC rules. Second, the security objective is clearly defined and limited. The goal is to protect end host and user files against network attackers, malicious websites, and user errors. Third, the project closely integrates DAC and MAC, rather than viewing them as disjoint components. For example, MAC labels for files are inferred from their DAC permissions.

Personnel

  • Ziqing Mao
  • Hong Chen

Keywords: access control, security, usability