Simplifying security policy descriptions for internet servers in secure operating systems

Toshihiro Yokoyama, Miyuki Hanaoka, Makoto Shimamura, Kenji Kono

研究成果: Conference contribution

2 被引用数 (Scopus)

抄録

Secure operating systems (secure OSes) are widely used to limit the damage caused by unauthorized access to Internet servers. However, writing a security policy based on the principle of least privilege for a secure OS is a challenge for an administrator. Considering that remote attackers can never attack a server before they establish connections to it, we propose a novel scheme that exploits phases to simplify security policy descriptions for Internet servers. In our scheme, the entire system has two execution phases: an initialization phase and a protocol processing phase. The initialization phase is defined as the phase before the server establishes connections to its clients, and the protocol processing phase is defined as the phase after it establishes connections. The key observation is that access control should be enforced by the secure OS only in the protocol processing phase to defend against remote attacks. Thus, we can omit the access-control policy in the initialization phase, which effectively reduces the number of policy rules. Our experimental results demonstrate that our scheme effectively reduces the number of descriptions; it eliminates 47.2%, 27.5%, and 24.0% of policy rules for HTTP, SMTP, and POP servers respectively, compared with an existing SELinux policy that includes the initialization of the server.

本文言語English
ホスト出版物のタイトル24th Annual ACM Symposium on Applied Computing, SAC 2009
ページ326-333
ページ数8
DOI
出版ステータスPublished - 2009 12 1
イベント24th Annual ACM Symposium on Applied Computing, SAC 2009 - Honolulu, HI, United States
継続期間: 2009 3 82009 3 12

出版物シリーズ

名前Proceedings of the ACM Symposium on Applied Computing

Other

Other24th Annual ACM Symposium on Applied Computing, SAC 2009
国/地域United States
CityHonolulu, HI
Period09/3/809/3/12

ASJC Scopus subject areas

  • ソフトウェア

フィンガープリント

「Simplifying security policy descriptions for internet servers in secure operating systems」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル