Reducing Security Policy Size for Internet Servers in Secure Operating Systems

スポンサーリンク

概要

• 論文の詳細を見る

• Secure operating systems (secure OSes) are widely used to limit the damage caused by unauthorized access to Internet servers. However, writing a security policy based on the principle of least privilege for a secure OS is a challenge for an administrator. Considering that remote attackers can never attack a server before they establish connections to it, we propose a novel scheme that exploits phases to simplify security policy descriptions for Internet servers. In our scheme, the entire system has two execution phases: an initialization phase and a protocol processing phase. The initialization phase is defined as the phase before the server establishes connections to its clients, and the protocol processing phase is defined as the phase after it establishes connections. The key observation is that access control should be enforced by the secure OS only in the protocol processing phase to defend against remote attacks. Since remote attacks cannot be launched in the initialization phase, a secure OS is not required to enforce access control in this phase. Thus, we can omit the access-control policy in the initialization phase, which effectively reduces the number of policy rules. To prove the effectiveness of our scheme, we wrote security policies for three kinds of Internet servers (HTTP, SMTP, and POP servers). Our experimental results demonstrate that our scheme effectively reduces the number of descriptions; it eliminates 47.2%, 27.5%, and 24.0% of policy rules for HTTP, SMTP, and POP servers, respectively, compared with an existing SELinux policy that includes the initialization of the server.

著者

• YOKOYAMA Toshihiro

  School for Open and Envionmental Systems, Graduate School of Science and Technology, Keio University

• HANAOKA Miyuki

  School for Open and Envionmental Systems, Graduate School of Science and Technology, Keio University

• SHIMAMURA Makoto

  School for Open and Envionmental Systems, Graduate School of Science and Technology, Keio University

• KONO Kenji

  Department of Information and Computer Science, Faculty of Science and Technology, Keio University

• SHINAGAWA Takahiro

  Department of Computer Science, Graduate School of Systems and Information Engineering, University o

関連論文

• Reducing Security Policy Size for Internet Servers in Secure Operating Systems
• Reducing Security Policy Size for Internet Servers in Secure Operating Systems
• Filtering False Positives Based on Server-Side Behaviors
• TCP Reassembler for Layer7-Aware Network Intrusion Detection/Prevention Systems(Dependable Computing)

スポンサーリンク