Chapter 14: Protection

Chapter 14: Protection

 Goals of Protection
 Principles of Protection
 Domain of Protection
 Access Matrix
 Implementation of Access Matrix
 Access Control
 Revocation of Access Rights
 Capability-Based Systems
 Language-Based Protection

Operating System Concepts – 7th Edition, Apr 11, 2005 14.2 Silberschatz, Galvin and Gagne ©2005
 Objectives
 Discuss the goals and principles of protection in a modern
computer system
 Explain how protection domains combined with an access matrix
are used to specify the resources a process may access
 Examine capability and language-based protection systems

Operating System Concepts – 7th Edition, Apr 11, 2005 14.3 Silberschatz, Galvin and Gagne ©2005
 Goals of Protection
 Operating system consists of a collection of objects, hardware or
software

 Each object has a unique name and can be accessed through a

well-defined set of operations.

 Protection problem - ensure that each object is accessed correctly

and only by those processes that are allowed to do so.

Operating System Concepts – 7th Edition, Apr 11, 2005 14.4 Silberschatz, Galvin and Gagne ©2005
 Principles of Protection

 Guiding principle – principle of least privilege

 Programs, users and systems should be given just enough

privileges to perform their tasks

 Protected oriented system provides means to distinguish

between authorized and unauthorized usages.

Operating System Concepts – 7th Edition, Apr 11, 2005 14.5 Silberschatz, Galvin and Gagne ©2005
 Domain of protection

 An operating system is a collection of processes and objects.

 H/w objects (CPU, Memory, printers, disks ect.,) & S/w objects ( Files,
Programs, Semaphores ect.,).

 Objects are essentially abstract data types (can be accessed only

through well-defined and Meaningful operations).

 Eg: CPU – Only be executed

Memory – Read & Write

CD- ROM – Only read

 A process should be allowed to access only those resources for

which it has authorization.

Operating System Concepts – 7th Edition, Apr 11, 2005 14.6 Silberschatz, Galvin and Gagne ©2005
 Domain Structure
 To facilitate this scheme, a process operates within a Protection
Domain. (Specifies the resources the process may access).
 The ability to execute an operation on an object is an Access
Rights.
 Access-right = <object-name, rights-set>
where rights-set is a subset of all valid operations that can be
performed on the object.
 Eg: Domain D has the access rights <File F, {read, write}>,
Then the process executing in that domain can perform read &
write operation on F.

 Domain = set of access-rights

Operating System Concepts – 7th Edition, Apr 11, 2005 14.7 Silberschatz, Galvin and Gagne ©2005
 Domain Structure

 Association between a process and domain may be either static or

Dynamic

 Dynamic is more complicated

 Static - Association between the process and domain are fixed.

 Dynamic – Allows the process to switch from one domain to

another

Operating System Concepts – 7th Edition, Apr 11, 2005 14.8 Silberschatz, Galvin and Gagne ©2005
 Access Matrix
 View protection as a matrix (access matrix)

 Rows represent domains

 Columns represent objects

 Access(i, j) is the set of operations that a process executing in

Domaini can invoke on Objectj

Operating System Concepts – 7th Edition, Apr 11, 2005 14.9 Silberschatz, Galvin and Gagne ©2005
 Access Matrix

Operating System Concepts – 7th Edition, Apr 11, 2005 14.10 Silberschatz, Galvin and Gagne ©2005
 Use of Access Matrix

 If a process in Domain Di tries to do “op” on object Oj, then “op”

must be in the access matrix.

 Can be expanded to dynamic protection.

 Operations to add, delete access rights.
 Special access rights:
 owner of Oi
 copy op from Oi to Oj
 control – Di can modify Dj access rights
 transfer – switch from domain Di to Dj

Operating System Concepts – 7th Edition, Apr 11, 2005 14.11 Silberschatz, Galvin and Gagne ©2005
 Use of Access Matrix (Cont.)
 Access matrix design separates mechanism from policy.
 Mechanism
 Operating system provides access-matrix + rules.
 It ensures that the matrix is only manipulated by authorized
agents and that rules are strictly enforced.
 Policy
 User dictates policy.
 Who can access what object and in what mode.

Operating System Concepts – 7th Edition, Apr 11, 2005 14.12 Silberschatz, Galvin and Gagne ©2005
 Implementation of Access Matrix
 Each column = Access-control list for one object
Defines who can perform what operation.
Domain 1 = Read, Write
Domain 2 = Read
Domain 3 = Read


 Each Row = Capability List (like a key)
For each domain, what operations allowed on what objects.
Object 1 – Read
Object 4 – Read, Write, Execute
Object 5 – Read, Write, Delete, Copy

Operating System Concepts – 7th Edition, Apr 11, 2005 14.13 Silberschatz, Galvin and Gagne ©2005
 Access Matrix of Figure A With Domains as Objects

Figure B

Operating System Concepts – 7th Edition, Apr 11, 2005 14.14 Silberschatz, Galvin and Gagne ©2005
 Access Matrix with Copy Rights

Operating System Concepts – 7th Edition, Apr 11, 2005 14.15 Silberschatz, Galvin and Gagne ©2005
 Access Matrix With Owner Rights

Operating System Concepts – 7th Edition, Apr 11, 2005 14.16 Silberschatz, Galvin and Gagne ©2005
 Modified Access Matrix of Figure B

Operating System Concepts – 7th Edition, Apr 11, 2005 14.17 Silberschatz, Galvin and Gagne ©2005
 Crypto - Problems

1.Use the additive cipher with key =

15 to encrypt and decrypt the
message “hello world”.

Solution - ????

2.If p=3 and q=11 and d=7. How

would you encrypt & decrypt the
message“Hello” using RSA Algorithm?
Operating System Concepts – 7th Edition, Apr 11, 2005 14.18 Silberschatz, Galvin and Gagne ©2005
 Access Control
 Protection can be applied to non-file resources
 Solaris 10 provides role-based access control to implement least
privilege
 Privilege is right to execute system call or use an option within
a system call
 Can be assigned to processes
 Users assigned roles granting access to privileges and
programs

Operating System Concepts – 7th Edition, Apr 11, 2005 14.19 Silberschatz, Galvin and Gagne ©2005
 Role-based Access Control in Solaris 10

Operating System Concepts – 7th Edition, Apr 11, 2005 14.20 Silberschatz, Galvin and Gagne ©2005
 Revocation of Access Rights
 Access List – Delete access rights from access list.
 Simple
 Immediate

 Capability List – Scheme required to locate capability in the system

before capability can be revoked.
 Reacquisition
 Back-pointers
 Indirection
 Keys

Operating System Concepts – 7th Edition, Apr 11, 2005 14.21 Silberschatz, Galvin and Gagne ©2005
 Capability-Based Systems
 Hydra
 Fixed set of access rights known to and interpreted by the
system.
 Interpretation of user-defined rights performed solely by user's
program; system provides access protection for use of these
rights.

 Cambridge CAP System

 Data capability - provides standard read, write, execute of
individual storage segments associated with object.
 Software capability -interpretation left to the subsystem,
through its protected procedures.

Operating System Concepts – 7th Edition, Apr 11, 2005 14.22 Silberschatz, Galvin and Gagne ©2005
 Language-Based Protection
 Specification of protection in a programming language allows the
high-level description of policies for the allocation and use of
resources.

 Language implementation can provide software for protection

enforcement when automatic hardware-supported checking is
unavailable.

 Interpret protection specifications to generate calls on whatever

protection system is provided by the hardware and the operating
system.

Operating System Concepts – 7th Edition, Apr 11, 2005 14.23 Silberschatz, Galvin and Gagne ©2005
 Protection in Java 2
 Protection is handled by the Java Virtual Machine (JVM)

 A class is assigned a protection domain when it is loaded by the

JVM.

 The protection domain indicates what operations the class can (and
cannot) perform.

 If a library method is invoked that performs a privileged operation,

the stack is inspected to ensure the operation can be performed by
the library.

Operating System Concepts – 7th Edition, Apr 11, 2005 14.24 Silberschatz, Galvin and Gagne ©2005
 Stack Inspection

Operating System Concepts – 7th Edition, Apr 11, 2005 14.25 Silberschatz, Galvin and Gagne ©2005
End of Chapter 14