Lecture Operating System: Chapter 09 - University of Technology

Lecture Operating System: Chapter 09 - Security presented The security environment, Basics of cryptography, User authentication, Attacks from inside the system, Attacks from outside the system, Protection mechanisms, Trusted systems.
Nội dung trích xuất từ tài liệu:
Lecture Operating System: Chapter 09 - University of Technology Chapter 9 Security9.1 The security environment9.2 Basics of cryptography9.3 User authentication9.4 Attacks from inside the system9.5 Attacks from outside the system9.6 Protection mechanisms9.7 Trusted systems 1The Security Environment Threats Security goals and threats 2 IntrudersCommon Categories1. Casual prying by nontechnical users2. Snooping by insiders3. Determined attempt to make money4. Commercial or military espionage 3 Accidental Data LossCommon Causes1. Acts of God - fires, floods, wars1. Hardware or software errors - CPU malfunction, bad disk, program bugs1. Human errors - data entry, wrong tape mounted 4 Basics of CryptographyRelationship between the plaintext and the ciphertext 5 Secret-Key Cryptography• Monoalphabetic substitution – each letter replaced by different letter• Given the encryption key, – easy to find decryption key• Secret-key crypto called symmetric-key crypto 6 Public-Key Cryptography• All users pick a public key/private key pair – publish the public key – private key not published• Public key is the encryption key – private key is the decryption key 7 One-Way Functions• Function such that given formula for f(x) – easy to evaluate y = f(x)• But given y – computationally infeasible to find x 8 Digital Signatures (b)• Computing a signature block• What the receiver gets 9 User AuthenticationBasic Principles. Authentication must identify:1. Something the user knows2. Something the user has3. Something the user isThis is done before user can use the system 10 Authentication Using Passwords(a) A successful login(b) Login rejected after name entered(c) Login rejected after name and password typed 11Authentication Using Passwords• How a cracker broke into LBL – a U.S. Dept. of Energy research lab 12 Authentication Using Passwords , , , , Salt PasswordThe use of salt to defeat precomputation ofencrypted passwords 13Authentication Using a Physical Object • Magnetic cards – magnetic stripe cards – chip cards: stored value cards, smart cards 14Authentication Using Biometrics A device for measuring finger length. 15 Countermeasures• Limiting times when someone can log in• Automatic callback at number prespecified• Limited number of login tries• A database of all logins• Simple login name/password as a trap – security personnel notified when attacker bites 16 Operating System Security Trojan Horses• Free program made available to unsuspecting user – Actually contains code to do harm• Place altered version of utility program on victims computer – trick user into running that program 17 Login Spoofing(a) Correct login screen(b) Phony login screen 18 Logic Bombs• Company programmer writes program – potential to do harm – OK as long as he/she enters password daily – ff programmer fired, no password and bomb explodes 19 Trap Doors(a) Normal code.(b) Code with a trapdoor inserted 20