We present a taxonomy and an algebra for attack patterns on component-based operating systems. In a multilevel security scenario, where isolation of partitions containing data at different security classifications is the primary security goal and security breaches are mainly defined as undesired disclosure or modification of classified data, strict control of information flows is the ultimate goal. In order to prevent undesired information flows, we provide a classification of information flow types in a component-based operating system and, by this, possible patterns to attack the system. The systematic consideration of informations flows reveals a specific type of operating system covert channel, the covert physical channel, which connects two former isolated partitions by emitting physical signals into the computer's environment and receiving them at another interface.
Storage channels are also defined by Lampson @cite_16 , who notes that data is written by the service and read by an unconfined program, either shortly after it is written or at some later time'', describing a storage channel between a confined and an unconfined program. Corrupt policy channels that are present due to a misconfigured access control policy have been addressed by Agreiter @cite_26 , proposing automatic generation of an operating system's MAC policy, and @cite_31 , presenting a new method for automatic analysis of an operating system's MAC policy. Finally, exploiting illegitimate access to components would be a special case of a flawed system policy, where a policy circumvents an operating system guard @math that protects access to a component @math , managing a shared resource, and allows @math and @math to exchange messages via @math . The use of operating system guards to handle shared resources to protect applications from untrusted components has been described by @cite_9 , @cite_6 @cite_4 , @cite_40 , and Hanspach and Keller @cite_41 .
@cite_26 @cite_4 @cite_41 @cite_9 @cite_6 @cite_40 @cite_31 @cite_16
2138837863 2211831180 1970816336 2112826387
In this paper, different control channel (CC) implementations for multichannel medium access control (MAC) algorithms are compared and analyzed in the context of opportunistic spectrum access (OSA) as a function of spectrum-sensing performance and licensed user activity. The analysis is based on a discrete Markov chain model of a subset of representative multichannel OSA MAC classes that incorporates physical layer effects, such as spectrum sensing and fading. The analysis is complemented with extensive simulations. The major observations are given as follows: 1) When the CC is implemented through a dedicated channel, sharing such dedicated channel with the licensed user does not significantly decrease the throughput achieved by the OSA network when the data packet sizes are sufficiently large or the number of considered data channels is small. 2) Hopping OSA MACs, where the CC is spread over all channels, are less susceptible to licensed user activity than those with a dedicated CC (in terms of both average utilization and on off times). 3) Scanning efficiency has a large impact on the achievable performance of licensed and OSA users for all analyzed protocols. 4) The multiple rendezvous MAC class, which has yet to be proposed in OSA literature, outperforms all the multichannel MAC designs analyzed in this paper. Suppose that Alice wishes to send messages to Bob through a communication channel C1, but her transmissions also reach an eavesdropper Eve through another channel C2. This is the wiretap channel model introduced by Wyner in 1975. The goal is to design a coding scheme that makes it possible for Alice to communicate both reliably and securely. Reliability is measured in terms of Bob's probability of error in recovering the message, while security is measured in terms of the mutual information between the message and Eve's observations. Wyner showed that the situation is characterized by a single constant Cs, called the secrecy capacity, which has the following meaning: for all e >; 0, there exist coding schemes of rate R ≥ Cs-e that asymptotically achieve the reliability and security objectives. However, his proof of this result is based upon a random-coding argument. To date, despite consider able research effort, the only case where we know how to construct coding schemes that achieve secrecy capacity is when Eve's channel C2 is an erasure channel, or a combinatorial variation thereof. Polar codes were recently invented by Arikan; they approach the capacity of symmetric binary-input discrete memoryless channels with low encoding and decoding complexity. In this paper, we use polar codes to construct a coding scheme that achieves the secrecy capacity for a wide range of wiretap channels. Our construction works for any instantiation of the wiretap channel model, as long as both C1 and C2 are symmetric and binary-input, and C2 is degraded with respect to C1. Moreover, we show how to modify our construction in order to provide strong security, in the sense defined by Maurer, while still operating at a rate that approaches the secrecy capacity. In this case, we cannot guarantee that the reliability condition will also be satisfied unless the main channel C1 is noiseless, although we believe it can be always satisfied in practice. We generalize the Gel'fand-Pinsker model to encompass the setup of a memoryless multiple-access channel (MAC). According to this setup, only one of the encoders knows the state of the channel (noncausally), which is also unknown to the receiver. Two independent messages are transmitted: a common message and a message transmitted by the informed encoder. We find explicit characterizations of the capacity region with both noncausal and causal state information. Further, we study the noise-free binary case, and we also apply the general formula to the Gaussian case with noncausal channel state information, under an individual power constraint as well as a sum power constraint. In this case, the capacity region is achievable by a generalized writing-on-dirty-paper scheme. Covert channels have traditionally been categorized as either storage channels or timing channels. The author questions this categorization, and discusses channels that cannot be clearly identified as either storage or timing channels, but have aspects of both. A new model of timing channels is presented, which allows for channels that have characteristics of both storage channels and timing channels, and a method is given for constructing all channels in a computer system that have timing channel characteristics. Since R.A. Kemmerer's (1982) shared resource matrix methodology has the potential to detect all channels that have storage characteristics, the two methods jointly have the capability to construct all channels in a computer system. The approach to timing channels provides a justification of specific mechanisms for reducing their bandwidth which were employed in the VAX Virtual Machine Monitor. >