DMCA
Verifying Compliance of Trusted Programs (2008)
Cached
Download Links
| Venue: | CONFERENCE ON SECURITY SYMPOSIUM |
| Citations: | 10 - 7 self |
BibTeX
@INPROCEEDINGS{Rueda08verifyingcompliance,
author = {Sandra Rueda and Dave King and Trent Jaeger},
title = {Verifying Compliance of Trusted Programs},
booktitle = {CONFERENCE ON SECURITY SYMPOSIUM},
year = {2008},
pages = {321--334},
publisher = {USENIX Association}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
In this paper, we present an approach for verifying that trusted programs correctly enforce system security goals when deployed. A trusted program is trusted to only perform safe operations despite have the authority to perform unsafe operations; for example, initialization programs, administrative programs, root network daemons, etc. Currently, these programs are trusted without concrete justification. The emergence of tools for building programs that guarantee policy enforcement, such as security-typed languages (STLs), and mandatory access control systems, such as user-level policy servers, finally offers a basis for justifying trust in such programs: we can determine whether these programs can be deployed in compliance with the reference monitor concept. Since program and system policies are defined independently, often using different access control models, compliance for all program deployments may be difficult to achieve in practice, however. We observe that the integrity of trusted programs must dominate the integrity of system data, and use this insight, which we call the PIDSI approach, to infer the relationship between program and system policies, enabling automated compliance verification. We find that the PIDSI approach is consistent with the SELinux reference policy for its trusted programs. As a result, trusted program policies can be designed independently of their target systems, yet still be deployed in a manner that ensures enforcement of system security goals.
Keyphrases
trusted program system security goal pidsi approach system policy administrative program mandatory access control system policy enforcement reference monitor concept user-level policy server compliance verification unsafe operation target system safe operation program policy selinux reference policy different access control model initialization program concrete justification root network daemon program deployment building program system data security-typed language
