Taking the Open
Source Road
Raising the Bar in
Operating System
Security
Cryptographic Binding of
Metadata
Providing a Secure
Foundation with CLIP
Open Source—Setting
Software Free
NSA’s Review of Emerging Technologies
Letter from the Editor
2SHQ VRXUFH VRIWZDUH 266 LV D JURZLQJ SDUW RI WKH VRIWZDUH PDUNHW $OWKRXJK PXFK 266 LV ORZ FRVW HYHQ IUHH D JUHDW GHDO RI LWV JURZLQJ SRSXODULW\ LV EDVHG QRW RQ FRVW EXW RQ WKH DELOLW\ WR VHH DQG PDQLSXODWH WKH VRIWZDUH LQWHUQDOV 7KLV DELOLW\ HQDEOHV JUHDW ÁH[LELOLW\ DOORZLQJ SURJUDPPHUV WR HDVLO\ EXLOG XSRQ RU H[WHQG VRIWZDUH WR PHHW VSHFLÀF PLVVLRQ QHHGV ,QFUHDVLQJ LQWHUHVW LQ 266 LV QRW OLPLWHG WR FRPPHUFLDO PDUNHWV WKH 86 'HSDUWPHQW RI 'HIHQVH 'R' LV ORRNLQJ IRU ZD\V WR KDUQHVV WKH FRPPXQLW\ GHYHORSPHQW PRGHO ZLWKLQ LQWHUQDO SURMHFWV 'R' KDV HYHQ FUHDWHG LWV RZQ FRPPXQLW\ VRIWZDUH VLWH PLOIRUJHPLO WR PLPLF WKH SXEOLF RSHQ VRXUFH FRPPXQLW\ ,Q WKLV LVVXH RI 7KH 1H[W :DYH 71: ZH KDYH D VHULHV RI DUWLFOHV DERXW LPSRUWDQW SURMHFWV WKDW ZHUH HQDEOHG E\ RSHQ VRXUFH VRIWZDUH
7KH DUWLFOH ´5DLVLQJ WKH %DU LQ 2SHUDWLQJ 6\VWHP 6HFXULW\ 6(/LQX[ DQG 2SHQ6RODULV )0$&µ ZULWWHQ E\ 6WHYH 6PDOOH\ SUHVHQWV DQ XSGDWH RQ 6HFXULW\(QKDQFHG /LQX[ DQG LQWURGXFHV D SURMHFW WR EULQJ VLPLODU VHFXULW\ HQKDQFHPHQWV WR 6XQ·V 2SHQ6RODULV RSHUDWLQJ V\VWHP 7KH QH[W DUWLFOH ´3URYLGLQJ D 6HFXUH )RXQGDWLRQ IRU $SSOLFDWLRQV ZLWK WKH &HUWLÀDEOH /LQX[ ,QWHJUDWLRQ 3ODWIRUPµ E\ 7RGG 3DLVOH\ %UDQGRQ :KDOHQ DQG 6WHSKHQ /DZUHQFH LQWURGXFHV DQ 16$ SURMHFW WR HQDEOH TXLFNHU DQG FKHDSHU GHSOR\PHQW RI VHFXUH V\VWHP VROXWLRQV WR PHHW PLVVLRQ QHHGV 7KH DUWLFOH ´&U\SWRJUDSKLF %LQGLQJ RI 0HWDGDWDµ E\ &DOYLQ 0DVRQ FDOOV DWWHQWLRQ WR WKH LPSRUWDQFH RI WUXVWZRUWK\ PHWDGDWD DQG SUHVHQWV D VXPPDU\ RI WZR 16$ SURMHFWV WR SURWHFW PHWDGDWD )LQDOO\ RXU IRFXV DUWLFOH ´2SHQ 6RXUFH 6RIWZDUH³$ *URZLQJ 7UHQGµ E\ 5XVV 6XWFOLIIH DQG 5D\ <RXQJ H[SODLQV WKH LPSDFW RSHQ VRXUFH LV KDYLQJ RQ WKH JOREDO VRIWZDUH PDUNHW
7X[ WKH FUHDWLRQ RI /DUU\ (ZLQJ OHZLQJ#LVFWDPXHGX KDV UHSUHVHQWHG /LQX[ VLQFH 7KH RULJLQDO 7X[ ORJR ZDV FUHDWHG ZLWK *,03³WKH *18 ,PDJH 0DQLSXODWLRQ 3URJUDP &XVWRP YHUVLRQV RI 7X[ ZLOO VHUYH DV WKH JXLGH WKURXJK WKLV RSHQ VRXUFH HGLWLRQ RI 7KH 1H[W :DYH
7KH /LQX[ SHQJXLQ DQG *,03 DUH WZR H[DPSOHV RI RSHQ VRXUFH SURGXFWV DYDLODEOH IUHH WR WKH SXEOLF IRU XVH DQG PRGLÀFDWLRQ
The Next Wave is published to disseminate technical advancements and research activities in telecommunications and information technologies. Mentions of company names or commercial products do not imply endorsement by the US Government.
For more information, please contact us at [email protected]
F E AT U R E S
7DNLQJWKH2SHQ6RXUFH5RDG
5DLVLQJWKH%DULQ2SHUDWLQJ6\VWHP6HFXULW\
6(/LQX[DQG2SHQ6RODULV)0$&
3URYLGLQJD6HFXUH)RXQGDWLRQIRU$SSOLFDWLRQV
ZLWK WKH &HUWLÀDEOH /LQX[ ,QWHUJUDWLRQ 3ODWIRUP
&U\SWRJUDSKLF%LQGLQJRI0HWDGDWD
F O C U S
2SHQ6RXUFH³6HWWLQJ6RIWZDUH)UHH
The direction is clear. Open-source software is paving a path to the information-centric future envisioned by the U.S. Department of Defense (DoD).
In an address to Department personnel, the Pentagon’s deputy chief information offi cer (DCIO), David M. Wennergren, explained the reason for taking this new direction.
“In today’s world we have to share information with people we never even dreamed of, using tools and means we never thought of before, [in]
non-traditional ways with non-traditional
organizations. And that’s the power of the information world.”
Taking the Open
Source Road
The Next Wave Vol 18 No 2 2009 5
2
SHQVRXUFHVRIWZDUH 266 KDVSURYHQWR EH D SRZHUIXO WRRO IRU GLVWULEXWLQJ LPSURYLQJ DQG H[WHQGLQJ QHZ SURJUDPV 266 OLFHQVLQJ LV JDLQLQJ DFFHSWDQFH E\ LQGXVWU\ DQG JRYHUQPHQWV ZRUOGZLGH ,W LV WKH SRZHU RI RSHQQHVV GHULYHG IURP FROODERUDWLRQ DQG LQQRYDWLRQWKDW'R'LQWHQGVWRKDUQHVV
)RU QHDUO\ WZR GHFDGHV 16$·V 5HVHDUFK 'LUHFWRUDWH 5' KDV EHHQ H[SORULQJ WKH UROH 266 FDQSOD\LQKHOSLQJWKH'R'DFKLHYHLWVPLVVLRQV (IIRUWV E\ 5' UHVHDUFKHUV OHG WR WKH SXEOLF UHOHDVH LQ 'HFHPEHU RI VHFXULW\HQKDQFHG 6( /LQX[ 6LQFH WKHQ GHYHORSHUV IURP +3 +LWDFKL 6RIWZDUH ,%0 1(& 5HG +DW DQG RWKHU FRPPHUFLDO DV ZHOO DV SULYDWH LQVWLWXWLRQV KDYH FRQWULEXWHG WR H[WHQGLQJ WKH SURJUDP·V IHDWXUHV DQG PDWXULQJ LWV IXQFWLRQDOLW\ )RU DQ LQGHSWK ORRN DW 6(/LQX[ VHH ´5DLVLQJWKH%DULQ2SHUDWLQJ6\VWHP6HFXULW\µLQ WKLVLVVXHRI7KH1H[W:DYH
0RUH UHFHQWO\ 'R' GHYHORSHUV FRQWULEXWHG RYHU D PLOOLRQ OLQHV RI FRGH WR WKH RSHQVRXUFH 26 FRPPXQLW\ KHOSLQJ H[SDQG WKH IHGHUDO 26 KLJKZD\ 2QH PLOOLRQ OLQHV LV DERXW WKH VL]H RI WKH &RUSRUDWH 0DQDJHPHQW ,QIRUPDWLRQ 6\VWHP &0,6 GHYHORSHG LQWHUQDOO\ E\ WKH 86 'HIHQVH ,QIRUPDWLRQ 6\VWHPV $JHQF\ ',6$ ',6$ VSHQW DOPRVW D GHFDGH EXLOGLQJ WKH ZHEEDVHG IHGHUDO ZRUNIRUFH PDQDJHPHQW ZRUNÁRZ DQG DGPLQLVWUDWLYH VRIWZDUH VXLWH IRU XVH E\ PRUH WKDQ PLOLWDU\ SHUVRQQHO
:KHQ RWKHU JRYHUQPHQW GHSDUWPHQWV ZDQWHG WR DGRSW WKH &0,6 VXLWH RI PRUH WKDQ DSSOLFDWLRQV ',6$·V GLUHFWRU RI PDQSRZHU SHUVRQQHO DQG VHFXULW\ -DFN 3HQNRVNH DVNHG ´:K\ QRW OHW WKHP"µ $QG LI VKDULQJ &0,6 ZLWK RWKHU IHGHUDO DJHQFLHV ZDV D JRRG LGHD ZK\ QRW LQFOXGH DFDGHPLD LQGXVWU\ DQG WKH HQWLUH 26 FRPPXQLW\"
',6$ GLG MXVW WKDW ,Q 0DUFK WKH 3HQWDJRQ·V LQIRUPDWLRQ WHFKQRORJ\ XQLW DQQRXQFHG DFRRSHUDWLYHUHVHDUFKDQGGHYHORSPHQWDJUHHPHQW &5$'$ ZLWK WKH 2SHQ 6RXUFH 6RIWZDUH ,QVWLWXWH WR PDNH DQ 26 YHUVLRQ RI &0,6 DYDLODEOH WR RWKHU IHGHUDO DJHQFLHV DFDGHPLD QRQSURÀW RUJDQL]DWLRQV DQG LQGXVWU\ WR UHXVH DQG LPSURYH ',6$ XVHG $GREH &ROG )XVLRQ DQG 0LFURVRIW 64/ 6HUYHU WR EXLOG 26&0,6 7KH GHSDUWPHQW·V HIIRUW ZDV UHFRJQL]HG E\ *RYHUQPHQW &RPSXWHU 1HZV *&1 DV RQH RI WKH ´ JUHDW JRYHUQPHQW ,7 SURMHFWVµ IRU
2WKHU IHGHUDO 26 SURMHFWV KDYH DOVR FRPH RQ OLQH UHFHQWO\ RU DUH LQ WKH ZRUNV ,Q -XQH WKH 86 $LU )RUFH UHOHDVHG D IUHH DQG RSHQVRXUFH YHUVLRQ RI )DOFRQ9LHZ D SHUVRQDO FRPSXWHU EDVHG PDSSLQJ DSSOLFDWLRQ GHYHORSHG IRU WKH 'R' E\ *HRUJLD 7HFK 5HVHDUFK ,QVWLWXWH (YHQ WKH :KLWH +RXVH KDV HQWHUHG WKH 266 DUHQD 7KH SRSXODU :KLWH+RXVHJRY ZHE VLWH VZLWFKHG IURP DSURSULHWDU\FRQWHQWPDQDJHPHQWV\VWHPWRRSHQ VRXUFH 'UXSOH LQ 2FWREHU &LWLQJ WKH SRWHQWLDO IRU HYHU\GD\ FLWL]HQV FRQWULEXWLQJ WR WKH HYROXWLRQ RI WKH ZHE VLWH :KLWH +RXVH PHGLD GLUHFWRU 0DFRQ 3KLOOLSV VDLG ´:H·UH ORRNLQJ IRUZDUG WR JHWWLQJ WKH EHQHÀW RI WKHLU HQHUJ\ DQG LQQRYDWLRQµ
7KH RSHQVRXUFH URDG DW WLPHV KDV EHHQ D EXPS\ RQH QRW MXVW IRU WKH 'R' DV ,7 SODQQHUV DWWHPSW WR VWHHU D FRXUVH VWUDGGOLQJ WKH EHQHÀWV RI RSHQQHVV ZLWK WKH GHPDQGV RI VHFXULW\ %XW :HQQHUJUHQ ZKR DOVR VHUYHV DV 'HSXW\ $VVLVWDQW 6HFUHWDU\ RI 'HIHQVH IRU ,QIRUPDWLRQ 0DQDJHPHQW 7HFKQRORJ\ DUJXHV WKDW WKLV LV WKH ZURQJ ZD\ WR ORRN DW WKH FKDOOHQJH +H SURSRVHV D GLIIHUHQW PRGHO LQZKLFKRSHQQHVVDQGVHFXULW\DUHJRDOVWKDWFDQ UHLQIRUFHHDFKRWKHU
7KH 'R' KDV RIÀFLDOO\ HQGRUVHG WKH XVH RI 266 VWDWLQJ DV PXFK LQ JXLGHOLQHV SXEOLVKHG LQ $ PHPRUDQGXP UHOHDVHG 2FWREHU E\ WKH &,2 WHDP SURYLGHV ´FODULI\LQJ JXLGDQFHµ LQWHQGHG WR RYHUFRPH ´PLVFRQFHSWLRQV DQG PLVLQWHUSUHWDWLRQV RI WKH H[LVWLQJ ODZV SROLFLHV DQGUHJXODWLRQVWKDWGHDOZLWKVRIWZDUHDQGDSSO\ WR 266µ '&,2 :HQQHUJUHQ VWDWHV LQ WKH PHPR WKDW WKHVH PLVFRQFHSWLRQV DQG PLVLQWHUSUHWDWLRQV KDYH KDPSHUHG 'R' HIIRUWV WR HIIHFWLYHO\ GHYHORS DQG XVH266
266 KDV DOUHDG\ EHHQ DGRSWHG E\ VHYHUDO 'R' DJHQFLHV ZLWK LWV H[WHQVLYH XVH FLWHG DV HDUO\ DV ,Q D VWXG\ SUHSDUHG IRU WKH 'R' ´8VH RI)UHHDQG2SHQ6RXUFH6RIWZDUH )266 LQWKH 86 'HSDUWPHQW RI 'HIHQVHµ 0,75( &RUSRUDWLRQ IRXQGWKDW´)266VRIWZDUHSOD\VDIDUPRUHFULWLFDO UROH LQ WKH 'R' WKDQ KDV EHHQ JHQHUDOO\ UHFRJQL]HGµ 1RZ WKH PHPRUDQGXP ZKLFK VXSHUVHGHV 'R' JXLGHOLQHV RI VHYHQ \HDUV DJR RSHQV WKH GRRU WRHYHQJUHDWHUSUROLIHUDWLRQRI266SURGXFWVLQWKH IXWXUH
2QH IRUFH DFFHOHUDWLQJ WKH 'R'·V DGRSWLRQ RI 266 PD\ FRPH IURP WKH PHPR·V DIÀUPDWLRQ WKDW ´LQ DOPRVW DOO FDVHV 266 PHHWV WKH GHÀQLWLRQ RI ¶FRPPHUFLDO FRPSXWHU VRIWZDUH·µ DQG QHHGV WR EH
6 Taking the Open Source Road
WUHDWHGDVVXFK&ODVVLI\LQJ266DVDFRPPHUFLDO LWHP JUDQWV LW VSHFLDO FRQWUDFWXDO FRQVLGHUDWLRQ 86 ODZ 86& FDOOV IRU JRYHUQPHQW SURFXUHPHQW WR IDYRU FRPPHUFLDO VXSSOLHV DQG VHUYLFHV 7KH ODZ UHTXLUHV KHDGV RI DJHQFLHV WR HQVXUH WKDW SURFXUHPHQW RIÀFLDOV DUH WUDLQHG LQ WKHDFTXLVLWLRQRIFRPPHUFLDOSURGXFWV(YHU\RQH LQYROYHG LQ WKH SURFXUHPHQW SURFHVV PXVW E\ ODZ PDNH HYHU\ HIIRUW WR DFTXLUH FRPPHUFLDO SURGXFWV DQG UHTXLUH FRQWUDFWRUV WR LQFRUSRUDWH FRPPHUFLDO SURGXFWV ZKHQ SRVVLEOH $GGLWLRQDOO\ VSHFLÀFDWLRQV IRU FRQWUDFW UHTXLUHPHQWV VKRXOG EH VWDWHG LQ WHUPV WKDW HQFRXUDJH ELGGHUV WR VXSSO\ FRPPHUFLDO SURGXFWV DQG SURFXUHPHQW SROLFLHV SUDFWLFHV DQG SURFHGXUHV DUH WR EH ZULWWHQ RU UHYLVHGWRUHGXFHLPSHGLPHQWVWRWKHLUDFTXLVLWLRQ 3ROLFLHV VHW RXW LQ )HGHUDO $FTXLVLWLRQ 5HJXODWLRQ )$5 DQG WKH 'R' VXSSOHPHQW ')$56 VSHFLÀFDOO\ UHTXLUH H[HFXWLYHDJHQFLHVWRLQFOXGH266ZKHQFRQGXFWLQJ PDUNHW UHVHDUFK IRU VRIWZDUH SURFXUHPHQWV 7KLV REOLJDWLRQ SODFHV 266 SURGXFWV RQ HTXDO IRRWLQJ ZLWKDOORWKHUFRPPHUFLDOSURGXFWV
6WLOO PLVFRQFHSWLRQV DQG PLVLQWHUSUHWDWLRQV VWDQGLQWKHZD\RIJRYHUQPHQWDJHQFLHVDGRSWLQJ 266 DFFRUGLQJ WR '&,2 :HQQHUJUHQ $PELJXRXV WHUPLQRORJ\ DVVRFLDWHG ZLWK 266 KDV OHG LQ SDUW WRVRPHRIWKHVHPLVFRQFHSWLRQV&RPPRQXVDJH RI WKH ZRUG IUHH KDV FRQWULEXWHG WR WKH PLVWDNHQ XQGHUVWDQGLQJ WKDW IUHHZDUH GRHV QRW TXDOLI\ DV D FRPPHUFLDO SURGXFW 7KH UHIHUHQFH WR ´IUHHµ LQ )266 RU ´OLEUHµ LQ )/266 IUHHOLEUH RSHQ VRXUFHVRIWZDUH DSSOLHVWRIUHHRUOLEUHDFFHVVWR XVH PRGLI\ DQG H[WHQG D SURGXFW·V XQGHUO\LQJ FRGH DQG QRW WR WKH FRVW RI WKH VRIWZDUH %RWK WKH )UHH 6RIWZDUH 'HÀQLWLRQ )6' DQG WKH 2SHQ 6RXUFH 'HÀQLWLRQ 26' WKH WZR PDLQ GRFXPHQWV JRYHUQLQJ 266 GHYHORSPHQW DQG XVH VXSSRUW WKLV LQWHUSUHWDWLRQ
%\ 86 *RYHUQPHQW VWDQGDUGV RSHQVRXUFH VRIWZDUH LV QRW QHFHVVDULO\ IUHH VRIWZDUH HYHQ ZKHQ LW LV DYDLODEOH IUHH RI FKDUJH :KHQ &RQJUHVV HQDFWHG WKH 1R (OHFWURQLF 7KHIW $FW 1(7 RI +5 WR FULPLQDOL]H FRS\ULJKW LQIULQJHPHQW GRQH ´ZLOOIXOO\ DQG IRU SXUSRVHV RI FRPPHUFLDO DGYDQWDJH RU SULYDWH ÀQDQFLDO JDLQµ WKH GHÀQLWLRQ IRU ´ÀQDQFLDO JDLQµ ZDV DGGHG WR 6HFWLRQ RI 86 FRS\ULJKW ODZ 7KH 86 3DWHQW 2IÀFH QRZ FRQVLGHUV WKH ´UHFHLSW RU H[SHFWDWLRQ RI UHFHLSW RI DQ\WKLQJ RI YDOXH LQFOXGLQJ WKH UHFHLSW RI RWKHU FRS\ULJKWHG
ZRUNVµ ÀQDQFLDO JDLQ %\ DSSO\LQJ WKLV GHÀQLWLRQ WR 266 VLPSO\ LPSURYLQJ FRGH³VRPHWKLQJ HQFRXUDJHG E\ WKH RSHQVRXUFH FRPPXQLW\ DQG H[SUHVVHGLQWKH26'DQGWKH)6'³LVDIRUPRI ÀQDQFLDO JDLQ PDNLQJ WKH VRIWZDUH FRPPHUFLDO
0RUH REYLRXV HIIRUWV WR FRPPHUFLDOL]H 266 DUH JDLQLQJ PRPHQWXP DV ZHOO 5HVHDUFK ÀUP ,'& IRUHFDVWVDSHUFHQWFRPSRXQGDQQXDOJURZWK UDWH &$*5 IRU 266 UHYHQXH ZRUOGZLGH RYHU WKH QH[W ÀYH \HDUV 7KDW JDLQ ZRXOG SXVK UHYHQXH IURP 266 SDVW ELOOLRQ E\ ,Q DGGLWLRQ WR HVWDEOLVKHG 266 YHQGRUV OLNH 5HG +DW DQG 1RYHOO VHUYLFHEDVHG ,7 EXVLQHVVHV VXFK DV ,%0 DQG 2UDFOH KDYH EHHQ WDSSLQJ WKH RSHQVRXUFH PDUNHW E\ RIIHULQJ 266 VXSSRUW *RRJOH·V 266 VWUDWHJ\ KDV EHHQ WR VKLIW HPSKDVLV DZD\ IURP WKH FRGH LQ IDYRURIWUDQVSDUHQF\DQGDSSOLFDWLRQSURJUDPPLQJ LQWHUIDFHV $3,V (YHQ 0LFURVRIW LV SURPRWLQJ HIIRUWV WR VXSSRUW LQWHURSHUDELOLW\ EHWZHHQ WKH FRPSDQ\·V SURSULHWDU\ OLQH RI SURGXFWV DQG 266
,Q DGGLWLRQ WR DVVXULQJ 'R' DJHQFLHV LW·V 2. WR XVH 266 DQG UHTXLULQJ WKHP WR LQFOXGH 266 VROXWLRQV LQ WKH SURFXUHPHQW SURFHVV '&,2 :HQQHUJUHQ OLVWHG VHYHQ ´SRVLWLYH DVSHFWVµ RI 266WKDW'R'GHSDUWPHQWVVKRXOGFRQVLGHUZKHQ FRQGXFWLQJPDUNHWUHVHDUFKIRUVHOHFWLQJVRIWZDUH
The Next Wave Vol 18 No 2 2009 7 5HGXFHGFRVWRIRZQHUVKLS $OOXVHUVRI266
VKDUH WKH UHVSRQVLELOLW\ IRU LWV PDLQWHQDQFH 7KH RYHUDOO FRVW RI VRIWZDUH RZQHUVKLS LV WKHUHIRUHUHGXFHGIRUDOOSDUWLHV
5DSLG SURWRW\SLQJ DQG H[SHULPHQWDWLRQ 266 LV SDUWLFXODUO\ VXLWDEOH IRU VRIWZDUH GHYHORSPHQW 7KH DELOLW\ WR ´WHVW GULYHµ WKH VRIWZDUH ZLWK PLQLPDO FRVWV DQG DGPLQLVWUDWLYH GHOD\V SURYLGHV DGGHG EHQHÀWV +RZ ZHOO FRPPHUFLDO VRIWZDUH PHDVXUHV XS DJDLQVW WKHVH VHYHQ FULWHULD VKRXOG EH FDOFXODWHG LQ WKH HYDOXDWLRQ RI DQ\ VRIWZDUH DFTXLVLWLRQ ZKHWKHULWLVSURSULHWDU\RURSHQVRXUFH$OWKRXJK WKHVHSRVLWLYHDVSHFWVRI266DUHGHHPHGUHOHYDQW IRU D PDUNHW VXUYH\ WKH &,2 PHPR FDXWLRQV WKH\ VKRXOGQ·W EH LQWHUSUHWHG DV RYHUULGLQJ IDFWRUV IRU PDNLQJ SURFXUHPHQW GHFLVLRQV ´8OWLPDWHO\ WKH VRIWZDUH WKDW EHVW PHHWV WKH QHHGV DQG PLVVLRQ RI WKH 'HSDUWPHQW VKRXOG EH XVHG UHJDUGOHVV RI ZKHWKHUWKHVRIWZDUHLVRSHQVRXUFHµ
+RZHYHU D YDULHW\ RI PLVFRQFHSWLRQV DERXW 266 DUH LGHQWLÀHG E\ '&,2 :HQQHUJUHQ DV FRQVWUDLQLQJ WKH DGRSWLRQ RI 266 VROXWLRQV LQ VRPH 'R' GHSDUWPHQWV 7KHVH PLVFRQFHSWLRQV LQFOXGH FRQFHUQV DERXW UHYLHZLQJ FRGH VXSSRUWLQJ WKH VRIWZDUH DQG PDNLQJ WKH VRXUFH FRGH SXEOLFO\ DYDLODEOH %XW QRQH RI WKHVH FRQFHUQV DUH ZDUUDQWHG WKHPHPRDVVHUWV
)RU H[DPSOH 3XEOLF 'RPDLQ 6RIWZDUH &RQWURO '&3' LQ 'R' ,QVWUXFWLRQ ´,QIRUPDWLRQ $VVXUDQFH ,$ ,PSOHPHQWDWLRQµ LV VRPHWLPHVFLWHGDVUHVWULFWLQJWKHXVHRI2667KH FRQWURO VWDWHV 7KLVFRQWUROSURWHFWVDJDLQVWWKHSURFXUHPHQW RI VRIWZDUH ZKHQ WKH *RYHUQPHQW GRHV QRW KDYH DFFHVV WR WKH RULJLQDO VRXUFH FRGH PDNLQJ LW GLIÀFXOW RU LPSRVVLEOH WR UHYLHZ UHSDLU RU H[WHQG WKH VRIWZDUH %XW &,2 JXLGDQFH SRLQWV RXW WKDW EHFDXVH WKH JRYHUQPHQW GRHV KDYH DFFHVV WR WKH RULJLQDO VRXUFH FRGH RI RSHQ VRXUFH VRIWZDUH WKHVH WHUPV GR QRW DSSO\ )RU WKLV UHDVRQ WKH 'R' 2SHQ
6RXUFH 6RIWZDUH )$4 DYDLODEOH WKURXJK WKH 'R' ZHE VLWH DQG ,QWHOLQN VWDWHV ´«GR QRW XVH WKH WHUPV ¶IUHHZDUH· RU ¶VKDUHZDUH· DV D V\QRQ\P IRU ¶RSHQ VRXUFH VRIWZDUH·µ
$QRWKHU FRQFHUQ DERXW 266 LV WKDW D ODFN RI DSSURSULDWH PDLQWHQDQFH DQG VXSSRUW SUHVHQWV DQ LQIRUPDWLRQDVVXUDQFHULVN%XWWKLVLVWUXHIRUDOO VRIWZDUH RSHQ VRXUFH RU FORVHG VRXUFH 6\VWHP DQG SURJUDP PDQDJHUV DQG XOWLPDWHO\ GHVLJQDWHG DSSURYLQJ DXWKRULWLHV '$$V DUH UHVSRQVLEOH IRU HQVXULQJWKDWDSODQIRUVRIWZDUHVXSSRUWLVLQSODFH DQG DGHTXDWH IRU PLVVLRQ QHHGV EHIRUH DSSURYLQJ WKHXVHRIDQ\VRIWZDUH
7KH PLVFRQFHSWLRQ WKDW 266 VKRXOG QRW EH LQWHJUDWHG RU PRGLÀHG IRU XVH LQ FODVVLÀHG RU RWKHU VHQVLWLYH 'R' V\VWHPV LV DOVR FKDOOHQJHG 7KH PHPR QRWHV ´«PDQ\ RSHQ VRXUFH OLFHQVHV SHUPLW WKHXVHUWRPRGLI\266IRULQWHUQDOXVH>HPSKDVLV SURYLGHG@ ZLWKRXW EHLQJ REOLJDWHG WR GLVWULEXWH VRXUFH FRGH WR WKH SXEOLFµ
6WLOO IHGHUDO DJHQFLHV DUH UHTXLUHG WR GLVVHPLQDWH QHZ VRIWZDUH DV ZLGHO\ DV SRVVLEOH %HFDXVHVRIWZDUHVRXUFHFRGHDQGDVVRFLDWHGGHVLJQ GRFXPHQWV DUH GHÀQHG DV ´GDWDµ E\ 'R' 'LUHFWLYH WKH\ DUH WR EH VKDUHG DFURVV WKH 'R' WR VXSSRUWPLVVLRQQHHGV266OLFHQVHVDFWXDOO\PDNH LW HDVLHU WR VKDUH WKHVH FRPSRQHQWV SURYLGLQJ HYHQ EHWWHU VXSSRUW IRU WKH 'R'·V QHWZRUNFHQWULF GDWD VWUDWHJ\ 7KHUHIRUH LW LV XS WR WKH SURMHFW PDQDJHU SURJUDP PDQDJHU RU RWKHU FRPSDUDEOH RIÀFLDO WRXQGHUVWDQGKRZWKH'HSDUWPHQWLQWHQGVWRXVH DQG UHGLVWULEXWH DQ\ 'R'PRGLÀHG FRGH DQG WKH VSHFLÀF UHTXLUHPHQWV RI WKH JRYHUQLQJ 266 OLFHQVH $FWLQJ $VVLVWDQW 6HFUHWDU\ RI 'HIHQVH IRU 1HWZRUNV DQG ,QIRUPDWLRQ ,QWHJUDWLRQ $6' 1,, DQG 'R' &,2 &KHU\O 5RE\ FDOOV LQIRUPDWLRQ ´RXU JUHDWHVWVWUDWHJLFDVVHWµ7RWUDQVIRUPWKH'R'LQWR D QHWZRUNFHQWULF RUJDQL]DWLRQ URDGEORFNV WR WKDW LQIRUPDWLRQ PXVW FRPH GRZQ '&,2 :HQQHUJUHQ EHOLHYHV DFKLHYLQJ D QHWFHQWULF IRUFH LV ´PXFK PRUH DERXW FXOWXUH FKDQJH WKDQ WHFKQRORJLFDO FKDQJHµ 3DUW RI WKDW FXOWXUH FKDQJH PHDQV DFFHSWLQJ 266 DV D YLDEOH VRIWZDUH VROXWLRQ IRU PHHWLQJ PLVVLRQ QHHGV7KHDGRSWLRQRIPRUHRSHQVRXUFHVRIWZDUH SURMHFWV E\ IHGHUDO DJHQFLHV FRXOG PDUN DQ LPSRUWDQW VWHSDORQJWKHURDGWRDQLQIRUPDWLRQFHQWULFIXWXUH IRUWKH'R'
The Next Wave Vol 18 No 2 2009 9 VXPPLW LQ 0DUFK 7KH UHVXOWLQJ
GLVFXVVLRQ DW WKDW VXPPLW OHG WR WKH FUHDWLRQ RI WKH /LQX[ 6HFXULW\ 0RGXOHV /60 SURMHFWDQRSHQVRXUFHSURMHFWWR FUHDWHDFRPPRQVHFXULW\IUDPHZRUNLQWKH /LQX[NHUQHOWKDWFRXOGVXSSRUWDYDULHW\ RIVHFXULW\PRGHOV'XULQJWKHQH[WFRXSOH RI \HDUV WKH 6(/LQX[ GHYHORSHUV VHUYHG DV FRUH FRQWULEXWRUV WR WKH GHYHORSPHQW RIWKH/60IUDPHZRUNDQGUHDUFKLWHFWHG 6(/LQX[WRXVHWKH/60IUDPHZRUN7KH /60IUDPHZRUNEHJDQWREHPHUJHGLQWR WKHPDLQOLQH/LQX[NHUQHOLQDQGWKH UHPDLQLQJSRUWLRQVRIWKHIUDPHZRUNDQG WKH6(/LQX[VHFXULW\PRGXOHZHUHPHUJHG LQWRWKHPDLQOLQH/LQX[NHUQHOVHULHV E\WKHHQGRI
(YHQ SULRU WR LWV LQWHJUDWLRQ LQWR WKH PDLQOLQH /LQX[ NHUQHO DGYDQFHG /LQX[ XVHUV KDG EHJXQ SDFNDJLQJ 6(/LQX[ NHUQHO SROLF\
DQG DSSOLFDWLRQ VXSSRUW IRU PXOWLSOH/LQX[GLVWULEXWLRQV VR WKDW WKH\ FRXOG XVH 6(/LQX[ IRU SURWHFWLQJ WKHLURZQV\VWHPV6(/LQX[ SDFNDJHV IRU WKH 'HELDQ *18/LQX[ GLVWULEXWLRQ ZHUH PDGH DYDLODEOH DV HDUO\ DV DQG WKH +DUGHQHG*HQWRRSURMHFW D VHFXULW\IRFXVHG VXESURMHFW RI WKH *HQWRR /LQX[
GLVWULEXWLRQ EHJDQ LQFOXGLQJ 6(/LQX[ VXSSRUW LQ 7KH JURZLQJ GHYHORSHU DQG XVHU FRPPXQLW\ DURXQG 6(/LQX[ DQGWKHHIIRUWVWREULQJ6(/LQX[VXSSRUW LQWR WKH PDLQOLQH /LQX[ NHUQHO GUHZ WKH LQWHUHVW RI 5HG +DW ,QF ZKLFK EHJDQ ZRUN WR IXOO\ LQWHJUDWH 6(/LQX[ VXSSRUW LQWR LWV /LQX[ GLVWULEXWLRQV LQ VWDUWLQJZLWKWKHLUQHZFRPPXQLW\EDVHG )HGRUD GLVWULEXWLRQ 7KH 6(/LQX[ FRGH ZDV ÀUVW LQFOXGHG LQ WKH )HGRUD &RUH UHOHDVHLQ0D\HOLPLQDWLQJWKHQHHG IRU VHSDUDWH SDWFKHV IRU WKH NHUQHO DQG DSSOLFDWLRQV7KHLQWURGXFWLRQRIDVHFXULW\ SROLF\ FRQÀJXUDWLRQ IRFXVHG RQ FRQÀQLQJ VSHFLÀF QHWZRUNIDFLQJ VHUYLFHV VXFK DVWKH$SDFKHZHEVHUYHUDQGWKH%,1' GRPDLQ QDPH VHUYHU PDGH LW SRVVLEOH WR HQDEOH6(/LQX[E\GHIDXOWLQWKH)HGRUD
&RUH UHOHDVH LQ 1RYHPEHU 7KLV VHFXULW\ SROLF\ FRQÀJXUDWLRQ ZDV FDOOHG WKH ´WDUJHWHGµ VHFXULW\ SROLF\ EHFDXVH LW DSSOLHG 6(/LQX[ WR SURWHFWLQJ VSHFLÀF VHUYLFHV LH WKH ´WDUJHWVµ WKDW ZHUH OLNHO\SRLQWVRIDWWDFNLQWRWKHV\VWHP 7KH )HGRUD 6(/LQX[ LQWHJUDWLRQ ZRUN DQG WKH UHVXOWLQJ FRPPXQLW\ WHVW LQJ DQG UHÀQHPHQW RI 6(/LQX[ IRUPHG WKH EDVLVIRULQFOXGLQJ6(/LQX[LQWKHFRP PHUFLDOO\VXSSRUWHG5HG+DW(QWHUSULVH /LQX[SURGXFW5HG+DW(QWHUSULVH/LQX[ UHOHDVHGLQ)HEUXDU\VKLSSHGZLWK 6(/LQX[ DV D GHIDXOWHQDEOHG VHFXULW\ IHDWXUH SURYLGLQJ RXWRIWKHER[ FRQÀQH PHQWRIRYHUDGR]HQV\VWHPVHUYLFHV7KLV UHOHDVH UHSUHVHQWHG WKH ÀUVW LQFOXVLRQ DQG XVHRI0$&LQDPDLQVWUHDPFRPPHUFLDO RSHUDWLQJ V\VWHP 0$& ZDV QR ORQJHU OLPLWHGWRVHSDUDWH´WUXVWHGµRSHUDWLQJV\V
WHPV DQG KDG EHFRPH D JHQHUDOSXUSRVH VHFXULW\IHDWXUH7KHLQFOXVLRQRI0$&LQ D PDLQVWUHDP FRPPHUFLDO RSHUDWLQJ V\V WHPVHWWKHVWDJHIRUWKHUDSLGDGYDQFHVLQ 6(/LQX[WKDWKDYHRFFXUUHGVLQFH
SELinux: 2005–present
Policy technology advances2YHU WKH SDVW VHYHUDO \HDUV D QHZ JHQHUDWLRQRISROLF\WHFKQRORJ\KDVEHHQ GHYHORSHG DQG GHSOR\HG IRU 6(/LQX[ 7KH DGYDQFHV LQ SROLF\ WHFKQRORJ\ KDYH LQFOXGHGWKHLQWURGXFWLRQRIWKHUHIHUHQFH SROLF\ WKH GHYHORSPHQW RI ORDGDEOH SROLF\ PRGXOH VXSSRUW WKH FUHDWLRQ RI SROLF\PDQDJHPHQWLQIUDVWUXFWXUHDQGWKH FRQYHUJHQFHRIVWULFWDQGWDUJHWHGSROLFLHV
6(/LQX[ ZDV RULJLQDOO\ UHOHDVHG E\ 16$ ZLWK D VPDOO H[DPSOH SROLF\
FRQÀJXUDWLRQ WR GHPRQVWUDWH WKH FRQFHSWV DQG WKH YDOXH RI ÁH[LEOH 0$& (DUO\ DGRSWHUV RI 6(/LQX[ XVHG WKDW H[DPSOH SROLF\ DV D EDVH DQG EHJDQ FRQWULEXWLQJ FKDQJHV DQG DGGLWLRQV WR LW OHDGLQJ WR YHU\ UDSLG JURZWK LQ LWV FRYHUDJH RI GLIIHUHQW DSSOLFDWLRQV EXW DW D FRVW LQ WHUPV RI XQGHUVWDQGDELOLW\ DQG HDVH RI FXVWRPL]DWLRQ 16$ VSRQVRUHG ZRUN E\ 7UHV\V 7HFKQRORJ\ WR XQGHUWDNH D UH GHVLJQRIWKHEDVHSROLF\IRU6(/LQX[ZLWK D IRFXV RQ PRGXODULW\ XQGHUVWDQGDELOLW\ WRROVXSSRUWDQGFXVWRPL]DWLRQ7KLVZRUN KDV\LHOGHGWKH6(/LQX[UHIHUHQFHSROLF\ ZKLFKKDVVXSSODQWHGWKHRULJLQDOH[DPSOH SROLF\DVWKHVWDQGDUGEDVHSROLF\IRUDOO PRGHUQ /LQX[ GLVWULEXWLRQ UHOHDVHV WKDW VXSSRUW6(/LQX[VWDUWLQJZLWKWKH)HGRUD &RUHUHOHDVHLQ0DUFK
7KH UHIHUHQFH SROLF\ ZDV DOVR GHVLJQHGWRWDNHDGYDQWDJHRI DQHZIHDWXUHLQWKH6(/LQX[ SROLF\ WRROFKDLQ WKDW ZDV DOVR EHLQJ GHYHORSHG E\ 7UHV\V 7HFKQRORJ\ LQ WKH VDPH WLPHIUDPH VXSSRUW IRU ORDGDEOH SROLF\ PRGXOHV 7KH RULJLQDO 6(/LQX[ SROLF\ FRQÀJXUDWLRQ DQG FRPSLOHU ZHUH ´PRQROLWKLFµ 7KDW LV LQ RUGHU WR PDNH DQ\ VXEVWDQWLYH FKDQJH WR SROLF\ EH\RQG D IHZ VSHFLÀF IRUPV RI FXVWRPL]DWLRQ HJ ERROHDQV ORFDO ÀOH FRQWH[WV RQHQHHGHGWRREWDLQDFRPSOHWH SROLF\ VRXUFH WUHH PDNH FRUUHVSRQGLQJ FKDQJHV WR WKH VRXUFH ÀOHV DQG UHEXLOG WKH HQWLUH SROLF\ LQWR WKH ELQDU\ IRUP UHTXLUHG E\ WKH NHUQHO /RDGDEOH SROLF\ PRGXOHVXSSRUWZDVGHYHORSHGWRHQDEOH LQGLYLGXDOSROLF\PRGXOHVWREHEXLOWDQG SDFNDJHG VHSDUDWHO\ IURP RQH DQRWKHU 7KLV PHFKDQLVP KDV HQDEOHG XVHUV WR HDVLO\ FUHDWH ORFDO SROLF\ PRGXOHV DV QHHGHGIRUVLWHFXVWRPL]DWLRQDQGLWKDV HQDEOHG VRIWZDUH GHYHORSHUV WR HDVLO\ SDFNDJH SROLF\ IRU WKHLU DSSOLFDWLRQV /RDGDEOHSROLF\PRGXOHVXSSRUWZDVDOVR ÀUVW GHSOR\HG LQ )HGRUD &RUH
:KLOH WKH ORDGDEOH SROLF\ PRGXOH VXSSRUW ZDV EHLQJ PHUJHG LQWR WKH XSVWUHDP 6(/LQX[ XVHUODQG D QHZ
“Linux security experts are reporting
a growing list of real-world security
situations in which the US National
Security Agency’s SELinux security
framework
contains
the
damage
resulting from a flaw in other software.”
10 Raising the Bar in Operating System Security VRIWZDUH OLEUDU\ OLEVHPDQDJH ZDV GHYHORSHGMRLQWO\E\5HG+DWDQGE\7UHV\V 7HFKQRORJ\WRSURYLGHDVWDQGDUG$3,DQG LQIUDVWUXFWXUH IRU PDQDJLQJ SROLF\ 7KLV OLEUDU\SURYLGHVDSURJUDPPDWLFLQWHUIDFH IRUPDNLQJFKDQJHVWRSROLF\DVRSSRVHG WR KDYLQJ WR PDQXDOO\ HGLW WH[W ÀOHV DQG SURYLGHVVXSSRUWIRUDZLGHUDQJHRIORFDO FXVWRPL]DWLRQVWRSROLF\)URQWHQGWRROV VXFK DV VHPRGXOH DQG VHPDQDJH ZHUH FUHDWHG WR HQDEOH XVHUV DQG KLJKHU OHYHO WRROVWRSHUIRUPSROLF\PDQDJHPHQWWDVNV 7KLVOLEUDU\DQGWKHLQLWLDOIURQWHQGWRROV DOVR ÀUVW DSSHDUHG LQ )HGRUD &RUH
$SUDFWLFDOFRPSURPLVHPDGHHDUO\ LQ WKH )HGRUD 6(/LQX[ LQWHJUDWLRQ ZDV WR FUHDWH D VHSDUDWH ´WDUJHWHGµ SROLF\ FRQÀJXUDWLRQ WKDW IRFXVHG RQ SURWHFWLQJ QHWZRUNIDFLQJVHUYLFHVDQGOHIWRUGLQDU\ XVHU VHVVLRQV XQUHVWULFWHG DQG XVH WKDW SROLF\ DV WKH GHIDXOW VR WKDW 6(/LQX[ FRXOG EH HQDEOHG E\ GHIDXOW ZLWKRXW GLVUXSWLQJ XVHUV 7KH FRPSOHWH H[DPSOH SROLF\ ZLWK VLJQLÀFDQWO\ PRUH FRYHUDJH RI VHUYLFHVDQGDSSOLFDWLRQVDQGVXSSRUWIRU XVHU UROHV EHFDPH NQRZQ DV WKH ´VWULFWµ SROLF\ FRQÀJXUDWLRQ DQG WKLV VWULFW SROLF\ FRQÀJXUDWLRQ ZDV QRW ZHOO VXSSRUWHG DQG UHTXLUHG VLJQLÀFDQW H[SHUWLVH WR VXFFHVVIXOO\ LQVWDOO DQG XVH +RZHYHU WKLV FRPSURPLVH PDGH LW SRVVLEOH WR LQFUHPHQWDOO\ H[SDQG WKH FRYHUDJH RI WKH WDUJHWHG SROLF\ LQ HDFK QHZ UHOHDVH WKURXJK WKH FRPPXQLW\ WHVWLQJ DQG IHHGEDFN SURFHVV VLQFH 6(/LQX[ ZDV HQDEOHGE\GHIDXOW:LWKWKHLQWURGXFWLRQ RIWKHUHIHUHQFHSROLF\ERWKWKHVWULFWDQG WDUJHWHG SROLF\ YDULDQWV ZHUH EXLOW IURP WKH UHIHUHQFH SROLF\ VRXUFHV EDVHG RQ D VLQJOHWXQDEOHVHWWLQJ
$V D UHVXOW WKH WDUJHWHG SROLF\ KDV JURZQ IURP FRYHULQJ RYHU D GR]HQ VHUYLFHVLQWKHHDUOLHVWUHOHDVHWRFRYHULQJ RYHUWZRKXQGUHGDSSOLFDWLRQVLQPRGHUQ UHOHDVHV 7KH ODVW VLJQLÀFDQW GLIIHUHQFH EHWZHHQ WKH WDUJHWHG DQG VWULFW SROLFLHV ZDVHOLPLQDWHGVWDUWLQJZLWKWKH)HGRUD UHOHDVHLQ1RYHPEHUZKHQVXSSRUW IRU FRQÀQLQJ XVHUV ZDV LQWURGXFHG LQ WDUJHWHG SROLF\ 7KH )HGRUD UHOHDVH LQ 0D\ XVHG WKLV VXSSRUW WR GHÀQH VHYHUDO XVHU UROHV DYDLODEOH E\ GHIDXOW
DQGWRVXSSRUWDNLRVNPRGHRIRSHUDWLRQ ZKHUHWKHXVHUVHVVLRQLVKLJKO\UHVWULFWHG DQGLVFRPSOHWHO\SXUJHGRIVWDWHDIWHUHDFK VHVVLRQ $V D UHVXOW WKH WDUJHWHG SROLF\ DQGWKHVWULFWSROLF\KDYHFRQYHUJHGDQG WKHUHLVQRORQJHUDVHSDUDWHVWULFWSROLF\ $GPLQLVWUDWRUV FDQ ODUJHO\ REWDLQ WKH EHKDYLRURIWKHVWULFWSROLF\E\PDSSLQJ XVHUV WR FRQÀQHG UROHV DQG WKH\ FDQ RSWLRQDOO\ UHPRYH WKH XQFRQÀQHG SROLF\ PRGXOHHQWLUHO\DOWKRXJKWKLVODVWVWHSFDQ EH GHVWUXFWLYH WR UXQQLQJ SURFHVVHV DQG UHTXLUHVVRPHFDUHWRGRVDIHO\
Improved usability
%DVHG RQ XVHU IHHGEDFN WKH DGYDQFHV LQ SROLF\ WHFKQRORJ\ GHVFULEHG DERYH KDYH JUHDWO\ LPSURYHG WKH XVHU H[SHULHQFH RI 6(/LQX[ E\ HQDEOLQJ XVHUV WR VROYH PDQ\ RI WKH SUREOHPV WKDW WKH\ HQFRXQWHU ,Q SDUWLFXODU WKH ORDGDEOH SROLF\ PRGXOH VXSSRUW DQG WKH PDQDJHPHQW WRROV KDYH HQDEOHG XVHUV WR SHUIRUPORFDOFXVWRPL]DWLRQVRISROLF\WR ÀW WKHLU SDUWLFXODU QHHGV DQG KDYH HQDEOHG GHYHORSHUVWRVKLSFXVWRPL]DWLRQVIRUWKHLU DSSOLFDWLRQV
Figure 2: setroubleshoot screenshot Figure 1: system-config-selinux screenshot
The Next Wave Vol 18 No 2 2009 11 6HYHUDO JUDSKLFDO WRROV KDYH DOVR
EHHQ GHYHORSHG LQ UHFHQW \HDUV WR DVVLVW XVHUV ZLWK GLIIHUHQW DVSHFWV RI 6(/LQX[ 7KHVHWRROVLQFOXGHV\VWHPFRQÀJVHOLQX[ VHWURXEOHVKRRWDQGWKH6(/LQX[,QWHJUDWHG 'HYHORSPHQW(QYLURQPHQW 6/,'( 7KH ÀUVW WZR WRROV ZHUH GHYHORSHG E\ 5HG +DW DQG ÀUVW LQFOXGHG LQ )HGRUD &RUH LQ 2FWREHU 7KH 6/,'( WRRO FDQ EH IUHHO\ GRZQORDGHG IURP WKH 7UHV\V 7HFKQRORJ\ RSHQ VRXUFH VHUYHU KWWS RVVWUHV\VFRP DQG ZDV LQFOXGHG LQ WKH )HGRUD UHOHDVHLQ0D\ $ JUDSKLFDO IURQWHQG WR WKH VHPDQDJH IXQFWLRQDOLW\ V\VWHPFRQÀJ VHOLQX[DOORZVWKHDGPLQLVWUDWRUWRHDVLO\ VHHDQGPRGLI\WKHFXUUHQWHQIRUFLQJVWDWXV SROLF\ ERROHDQV ODEHO DVVLJQPHQWV IRU ÀOHV DQG SRUWV DQG XVHU DXWKRUL]DWLRQV ,W DOVRSURYLGHVVLPSOHVXSSRUWIRUPDQDJLQJ WKHVHWRIORDGHGSROLF\PRGXOHV5HFHQW YHUVLRQV RI WKH WRRO VHH )LJXUH DOVR LQFOXGHDSROLF\ZL]DUGIRUFUHDWLQJQHZ SROLF\PRGXOHV
$ VHUYLFH IRU QRWLI\LQJ XVHUV RI 6(/LQX[ GHQLDOV VHWURXEOHVKRRW KHOSV XVHUVWRGLDJQRVHGHQLDOVDQGUHVROYHWKHP ,WKDVLQFUHDVHGXVHUDZDUHQHVVRI6(/LQX[ DQG HQDEOHG XVHUV WR LGHQWLI\ DQG VROYH FRPPRQ NLQGV RI FRQÀJXUDWLRQ HUURUV 7KH WRRO FDQ EH FRQÀJXUHG WR GLVSOD\ DOHUW SRSXSVWRWKHXVHURQWKHGHVNWRSRUDOHUWV FDQEHKDQGOHGYLDV\VWHPORJVRUHPDLO QRWLÀFDWLRQV 6HH )LJXUH IRU D VFUHHQVKRW RIVHWURXEOHVKRRW
6/,'( LV DQ (FOLSVH SOXJLQ WR SURYLGH D JUDSKLFDO XVHU LQWHUIDFH IRU SROLF\ GHYHORSHUV ZLWK WKH FRQYHQWLRQDO IHDWXUHV RI DQ LQWHJUDWHG GHYHORSPHQW HQYLURQPHQW VXFK DV SROLF\ FUHDWLRQ ZL]DUGV LQWHUIDFH FRPSOHWLRQ DQG VHDUFKLQJDQGSROLF\V\QWD[KLJKOLJKWLQJ 5HFHQW YHUVLRQV RI 6/,'( VHH )LJXUH KDYH LQFRUSRUDWHG VXSSRUW IRU UHPRWH SROLF\ GHEXJJLQJ DQG LQWHJUDWLRQ ZLWK SROLF\DQDO\VLVWRROV
Enhanced security functionality 7KH FRUH VHFXULW\ IXQFWLRQDOLW\ RI 6(/LQX[ KDV XQGHUJRQH VLJQLÀFDQW HQKDQFHPHQWV DQG LPSURYHPHQWV VLQFH 7KHVHHQKDQFHPHQWVKDYHLQFOXGHG H[WHQGHG VHFXULW\ DXGLW IXQFWLRQDOLW\ HQKDQFHG 0XOWL/HYHO 6HFXULW\ 0/6 VXSSRUWQHZQHWZRUNDFFHVVFRQWUROVDQG ODEHOHG QHWZRUNLQJ VXSSRUW DORQJ ZLWK QXPHURXVRWKHUVPDOOHUFKDQJHV
$VSDUWRIWKHZRUNWRHQDEOH/LQX[ WR PHHW WKH /DEHOHG 6HFXULW\ 3URWHFWLRQ 3URÀOH UHTXLUHPHQWV 6(/LQX[ ZDV IXOO\ LQWHJUDWHG ZLWK WKH /LQX[ DXGLW VXEV\VWHPHQDEOLQJDXGLWWRLQFOXGHDQG ÀOWHU EDVHG RQ VHFXULW\ FRQWH[WV /LNHZLVH WKHRSWLRQDO0/6PRGHORIWKH6(/LQX[ VHFXULW\VHUYHUZDVHQKDQFHGDQGHQDEOHG E\GHIDXOWDQGXVHUVSDFHVXSSRUWIRU0/6 UHTXLUHPHQWV ZDV GHYHORSHG 7KLV ZRUN ZDVGRQHZLWKWKHKHOSRIDZLGHUDQJHRI FRQWULEXWRUVIURP+3,%05HG+DWDQG 7UXVWHG&RPSXWHU6ROXWLRQV 7&6
5HG+DWGHYHORSHGDQHZPHFKDQLVP IRU ÁH[LEOH QHWZRUN DFFHVV FRQWUROV FDOOHG 6(&0$5.ZKLFKFRPELQHGWKHSRZHURI WKH /LQX[ SDFNHW ÀOWHULQJ IUDPHZRUN ZLWK 6(/LQX[ SROLF\ 'HYHORSHUV IURP ,%0 7&6DQG+3FUHDWHGDQGLQWHJUDWHGWZR LQGHSHQGHQW LPSOHPHQWDWLRQV RI ODEHOHG QHWZRUNLQJ PHFKDQLVPV ODEHOHG ,36(& DQG1HW/DEHO&,3627KHVHPHFKDQLVPV HQDEOH6(/LQX[SURWHFWLRQVWREHDSSOLHG DFURVVQHWZRUNFRPPXQLFDWLRQV
Improved performance and scalability
7KH RULJLQDO 6(/LQX[ LPSOHPHQ WDWLRQ LQFOXGHG DQ $FFHVV 9HFWRU &DFKH
$9& WR PLQLPL]H WKH QHHG WR SHUIRUP H[SHQVLYHVHFXULW\FRPSXWDWLRQVRQHDFK RSHUDWLRQ DQG VRXJKW WR NHHS RYHUKHDGV WR UHDVRQDEO\ ORZ SHUFHQWDJHV EXW GLG QRW VSHFLÀFDOO\ HQJDJH LQ DQ\ GHWDLOHG SHUIRUPDQFH RSWLPL]DWLRQV 7KH RULJLQDO 6(/LQX[ LPSOHPHQWDWLRQ DOVR RQO\ GHDOW ZLWKHQVXULQJVDIHW\RQV\VWHPVXVLQJDQ 603 V\PPHWULFPXOWLSURFHVVLQJ YHUVLRQ RI WKH /LQX[ NHUQHO WKURXJK WKH XVH RI FRDUVHJUDLQHGORFNLQJ7KLVDSSURDFKGLG QRWVFDOHZHOORQODUJH603V\VWHPV6LQFH WKHRULJLQDOLQFOXVLRQRI6(/LQX[LQ/LQX[ GLVWULEXWLRQV D QXPEHU RI SHUIRUPDQFH DQG VFDODELOLW\ LPSURYHPHQWV KDYH EHHQ GHYHORSHGDQGLQWHJUDWHG $QHQJLQHHUIURP1(&&RUSRUDWLRQ XQGHUWRRNZRUNWRHQDEOH6(/LQX[WRVFDOH ZHOORQODUJH603V\VWHPV+HUHSODFHG WKHFRDUVHJUDLQHGORFNRIWKH$9&ZLWK D VFKHPH NQRZQ DV 5HDG&RS\8SGDWH 5&8 HQDEOLQJ 6(/LQX[ WR DFKLHYH QHDUSHUIHFW VFDODELOLW\ 7KLV PDGH WKH GHSOR\PHQWRI6(/LQX[SUDFWLFDORQODUJH V\VWHPV
$VWKHGHIDXOWWDUJHWHGSROLF\JUHZ LQ LWV FRYHUDJH RI VHUYLFHV WKH DPRXQW RI NHUQHO PHPRU\ XVHG E\ WKH SROLF\ ZDV LQFUHDVLQJO\ EHFRPLQJ WRR KLJK DQG EHJLQQLQJ WR FDXVH SUREOHPV IRU XVHUV $VDUHVXOWWKH6(/LQX[FRUHGHYHORSHUV GLVFXVVHGDSSURDFKHVWRLPSURYHPHPRU\
12 Raising the Bar in Operating System Security XVH DQG D VHW RI PHPRU\ RSWLPL]DWLRQV ZHUHLPSOHPHQWHGE\16$WKDWUDGLFDOO\ UHGXFHGWKHNHUQHOPHPRU\XVHE\DIDFWRU RI;
$ QXPEHU RI PHPRU\ DQG SHUIRU PDQFHRSWLPL]DWLRQVKDYHEHHQGHYHORSHG LQ UHFHQW \HDUV E\ FRQWULEXWRUV IURP WKH -DSDQHVH 6(/LQX[ FRPPXQLW\ ZRUNLQJ RQXVLQJ6(/LQX[RQHPEHGGHGV\VWHPV LQFOXGLQJ FRQWULEXWLRQV IURP 1(& DQG +LWDFKL 6RIWZDUH DPRQJ RWKHUV )XUWKHU RSWLPL]DWLRQVWRWKHSROLF\GDWDVWUXFWXUHV KDYH \LHOGHG VLJQLÀFDQW LPSURYHPHQWV LQ NHUQHO PHPRU\ XVH 7KH UHYDOLGDWLRQ RI UHDG DQG ZULWH SHUPLVVLRQ RQ LQGLYLGXDO UHDGDQGZULWHV\VWHPFDOOVZDVRSWLPL]HG WR GHDO ZLWK VLJQLÀFDQW RYHUKHDGV RQ WKH 6XSHU+DUFKLWHFWXUHLPSURYLQJRYHUKHDG E\DIDFWRURIDURXQG;
Meeting security criteria
,Q 5HG +DW (QWHUSULVH /LQX[ ZDV YDOLGDWHG DJDLQVW WKH &RQWUROOHG $FFHVV 3URWHFWLRQ 3URÀOH &$33 WKH /DEHOHG 6HFXULW\ 3URWHFWLRQ 3URÀOH /633 DQG WKH 5ROH%DVHG $FFHVV &RQWURO 3URWHFWLRQ 3URÀOH 5%$&33 DW (YDOXDWLRQ $VVXUDQFH /HYHO RQ +3 DQG ,%0 KDUGZDUH 7KLV ZDV WKH UHVXOW RI D FROODERUDWLYH HIIRUW DPRQJ +3 ,%0 5HG +DW DQG 7&6 WKDW OHYHUDJHG 6(/LQX[ WR SURYLGH WKH ODEHOHG VHFXULW\ DQG UROHEDVHG VXSSRUW 7KLV ZRUN OHG WR VHYHUDO LPSURYHPHQWV WR 6(/LQX[ LQFOXGLQJ LPSURYHG DXGLW 0/6 DQG ODEHOHGQHWZRUNLQJ6*,KDVDOVRDFKLHYHG YDOLGDWLRQRI5HG+DW(QWHUSULVH/LQX[ RQLWVKDUGZDUHLQ7KHVHYDOLGDWLRQV UHSUHVHQW WKH ÀUVW WLPH WKDW D PDLQVWUHDP FRPPHUFLDORSHUDWLQJV\VWHPSURGXFWKDV EHHQYDOLGDWHGDJDLQVWVXFKFULWHULDZKLFK LQWKHSDVWKDYHEHHQOLPLWHGWRVHSDUDWH ´WUXVWHGµ RSHUDWLQJ V\VWHP SURGXFWV 7KHVH HYDOXDWLRQV ZHUH DOVR GLVWLQFWLYH LQWKDWWKHFRPSDQLHVWKDWVSRQVRUHGWKH HYDOXDWLRQV ZRUNHG WRJHWKHU WR GHYHORS WKHQHFHVVDU\IXQFWLRQDOLW\DQGVKDUHGWKH UHVXOWLQJ GRFXPHQWDWLRQ DQG WHVW VXLWHV GHVSLWHEHLQJFRPSHWLWRUV
7KH6\VWHPVDQG1HWZRUN$QDO\VLV &HQWHU 61$& RI 16$ GHYHORSHG DQG UHOHDVHG WKHLU ÀUVWHYHU VHFXULW\
FRQÀJXUDWLRQ JXLGH IRU /LQX[ LQ WKH *XLGH WR WKH 6HFXUH &RQÀJXUDWLRQ RI 5HG +DW (QWHUSULVH /LQX[ $ORQJ ZLWK PDQ\ RWKHU WRSLFV WKH JXLGH GHVFULEHV WKH EHQHÀWV RI 6(/LQX[ IRU VHFXULW\ DQG H[SODLQV KRZ WR SHUIRUP EDVLF FRQÀJXUDWLRQ DQG WURXEOHVKRRWLQJ RI 6(/LQX[ 7KLV JXLGH MRLQV WKH RWKHU FRQÀJXUDWLRQ JXLGHV SURGXFHG E\ WKH 61$& RYHU WKH \HDUV IRU D ZLGH YDULHW\ RIRSHUDWLQJV\VWHPVDQGLVDYDLODEOHIURP KWWS ZZZQVDJRYLDJXLGDQFH
7KH &HUWLÀDEOH /LQX[ ,QWHJUDWLRQ 3ODWIRUP &/,3 LV D VSHFLÀF FRQÀJXUDWLRQ RI/LQX[DQGDVVRFLDWHGHYLGHQFHGHVLJQHG WR PHHW VHYHUDO HVWDEOLVKHG VHFXULW\ UHTXLUHPHQWV LQFOXGLQJ WKH 3URWHFWLRQ /HYHO 3/ UHTXLUHPHQWVIURPWKH'LUHFWRU RI&HQWUDO,QWHOOLJHQFH'LUHFWLYH '&,' ´3URWHFWLQJ6HQVLWLYH&RPSDUWPHQWHG ,QIRUPDWLRQZLWKLQ,QIRUPDWLRQ6\VWHPVµ DQG WKH +LJK ,PSDFW UHTXLUHPHQWV IURP WKH 1DWLRQDO ,QVWLWXWH RI 6WDQGDUGV DQG 7HFKQRORJ\ 1,67 6SHFLDO 3XEOLFDWLRQ ´5HFRPPHQGHG6HFXULW\&RQWUROV IRU )HGHUDO ,QIRUPDWLRQ 6\VWHPVµ &/,3 GHÀQHV D VSHFLÀF FRQÀJXUDWLRQ RI 6(/LQX[ WR SURYLGH WKH IRXQGDWLRQ IRU KRVWLQJ VHFXULW\UHOHYDQW DSSOLFDWLRQV E\ HQVXULQJWKDWWKHXQGHUO\LQJDVVXPSWLRQV PDGHE\WKRVHDSSOLFDWLRQVDUHHQIRUFHGE\ WKHRSHUDWLQJV\VWHP,QSDUWLFXODU&/,3 OHYHUDJHV6(/LQX[LQRUGHUWRHQIRUFHWKH VWURQJ VHSDUDWLRQ RI SURFHVVHV DQG GDWD VXSSRUW GLIIHUHQW XVHU UROHV DQG HQVXUH WKDW DSSOLFDWLRQ VHFXULW\ PHFKDQLVPV DUH WDPSHUSURRI DQG FDQQRW EH E\SDVVHG 7KH&/,3SURMHFWLVVSRQVRUHGE\16$·V &XVWRP 6ROXWLRQV *URXS DQG LV EHLQJ GHYHORSHG E\ 7UHV\V 7HFKQRORJ\ &/,3 FDQEHGRZQORDGHGIURPKWWS RVVWUHV\V FRPSURMHFWVFOLS
Growing adoption, use, and community
)RUWKHSDVWIRXU\HDUV6(/LQX[KDV EHHQ D GHIDXOWHQDEOHG VHFXULW\ IHDWXUH LQWKH)HGRUDDQGWKH5HG+DW(QWHUSULVH /LQX[ GLVWULEXWLRQV SURYLGLQJ RXWRI WKHER[ FRQÀQHPHQW RI DQ LQFUHDVLQJ QXPEHURIV\VWHPVHUYLFHV7KHLPSURYHG XVDELOLW\ RI 6(/LQX[ KDV HQDEOHG XVHUV
WR H[SDQG WKHLU XVH RI LW DQG WR GLUHFWO\ VROYH SUREOHPV 7KH DQHFGRWDO HYLGHQFH RI LPSURYHG XVHU H[SHULHQFH IURP SXEOLF PDLOLQJ OLVW GLVFXVVLRQV LV IXUWKHU UHLQIRUFHGE\VWDWLVWLFVEHLQJFROOHFWHGE\ WKH)HGRUDSURMHFWZKLFKEHJDQWRFROOHFW LQIRUPDWLRQDERXW6(/LQX[VWDWXVVWDUWLQJ ZLWKWKH)HGRUDUHOHDVH7KHPDMRULW\RI )HGRUDV\VWHPVUHSRUWLQJLQWRWKH)HGRUD SURMHFW VKRZ WKDW XVHUV NHHS 6(/LQX[ HQDEOHG ,Q DGGLWLRQ WR )HGRUD DQG 5HG +DW GLVWULEXWLRQV 6(/LQX[ KDV FRQWLQXHG WR PDNH DGYDQFHV LQ DGRSWLRQ LQ RWKHU /LQX[GLVWULEXWLRQV7KH+DUGHQHG*HQWRR SURMHFWKDVFRQWLQXHGWRVXSSRUW6(/LQX[ LQ WKH *HQWRR /LQX[ GLVWULEXWLRQ DQG WR LQWHJUDWH QHZHU 6(/LQX[ IHDWXUHV 7KH 'HELDQ *18/LQX[ GLVWULEXWLRQ EHJDQ LQFOXGLQJ6(/LQX[VXSSRUWLQWKH'HELDQ UHOHDVH7KH8EXQWXGLVWULEXWLRQEHJDQ LQFOXGLQJ PLQLPDO 6(/LQX[ VXSSRUW LQ WKH8EXQWXUHOHDVHZKLFKZDVWKHQ IXUWKHU HQKDQFHG LQ WKH 8EXQWX UHOHDVH 1RYHOO EHJDQ LQFOXGLQJ EDVLF 6(/LQX[VXSSRUWDVDQRSWLRQDOIHDWXUHLQ 686(/LQX[
7KH EHQHÀWV RI 6(/LQX[ IRU PLWLJDWLQJ YXOQHUDELOLWLHV LQ VRIWZDUH DUH LQFUHDVLQJO\EHLQJUHFRJQL]HG$QDUWLFOH E\'RQ0DUWLSXEOLVKHGRQ/LQX[:RUOG FRP LQ )HEUXDU\ VWDWHG ´/LQX[ VHFXULW\ H[SHUWV DUH UHSRUWLQJ D JURZLQJ OLVW RI UHDOZRUOG VHFXULW\ VLWXDWLRQV LQ ZKLFKWKH861DWLRQDO6HFXULW\$JHQF\·V 6(/LQX[ VHFXULW\ IUDPHZRUN FRQWDLQV WKH GDPDJH UHVXOWLQJ IURP D ÁDZ LQ RWKHU VRIWZDUH>@µ,QGLVFXVVLQJWKHPLJUDWLRQ RI WKHLU PLVVLRQFULWLFDO WUDGLQJ SODWIRUP WR /LQX[ 6WHYH 5XELQRZ WKH &KLHI ,QIRUPDWLRQ 2IÀFHU &,2 RI WKH 1HZ<RUN 6WRFN ([FKDQJH 1<6( (XURQH[W ZDV TXRWHG DV VD\LQJ ´:H DUH YHU\ VHFXULW\ FRQVFLRXV EHFDXVH ZH KDYH WR EH«:H PDLQWDLQ WKH VHFXULW\ RI RXU V\VWHPV E\ UHO\LQJ RQ WKH 6(/LQX[ IHDWXUHV ZLWKLQ 5HG+DW(QWHUSULVH/LQX[>@µ
6(/LQX[ KDV DOVR VHUYHG DV D VHFXUHIRXQGDWLRQIRUDQXPEHURIVHFXUH VROXWLRQV GHYHORSHG IRU WKH JRYHUQPHQW 7KHVH V\VWHPV LQFOXGH WKH 1HW7RS V\VWHP RULJLQDOO\ SURWRW\SHG E\ 1,$5/
The Next Wave Vol 18 No 2 2009 13 DQG ODWHU SURGXFWL]HG E\ +3 DORQJ
ZLWK VHYHUDO GHULYDWLYH V\VWHPV ,W DOVR LQFOXGHVWKH7&66HFXUH2IÀFH7UXVWHG 7KLQ &OLHQW V\VWHP $ QXPEHU RI &URVV 'RPDLQ 6ROXWLRQ &'6 V\VWHPV KDYH EHHQ GHYHORSHG E\ 16$ DQG E\ RWKHU RUJDQL]DWLRQV WKDW OHYHUDJH 6(/LQX[ WR HQIRUFH VHSDUDWLRQ DQG WR HQVXUH WKH DVVXUHGLQYRFDWLRQRIWKH&'6DSSOLFDWLRQ $V PHQWLRQHG HDUOLHU 6(/LQX[ LV DOVR EHLQJOHYHUDJHGE\WKH&/,3SURMHFW
$ORQJ ZLWK JURZWK LQ LWV XVHU FRPPXQLW\ 6(/LQX[ KDV H[SHULHQFHG VLJQLÀFDQW JURZWK LQ LWV GHYHORSHU FRPPXQLW\VLQFH'HYHORSHUVIURP +3 +LWDFKL 6RIWZDUH ,%0 1(& 16$ 5HG +DW 7UHV\V 7HFKQRORJ\ DQG 7&6 DORQJ ZLWK PDQ\ LQGLYLGXDO GHYHORSHUV KDYH ZRUNHG FROODERUDWLYHO\ WR HQDEOH 6(/LQX[WRDGYDQFHUDSLGO\LQLWVIHDWXUH VHWDQGPDWXULW\
Platform for advanced R&D
,QDGGLWLRQWRVHUYLQJDVDWHFKQRORJ\ WUDQVIHUYHKLFOHIRUHQFRXUDJLQJDGRSWLRQ RI ÁH[LEOH 0$& E\ LQGXVWU\ 6(/LQX[ KDV DOVR VHUYHG DV D XVHIXO SODWIRUP IRU DGYDQFHG UHVHDUFK DQG GHYHORSPHQW %\ SURYLGLQJ D EDVH V\VWHP WKDW VXSSRUWV ÁH[LEOH 0$& DQG H[SRUWV LQWHUIDFHV WR VXSSRUW VHFXULW\DZDUH DSSOLFDWLRQV 6(/LQX[ HQDEOHV UHVHDUFK WR SURFHHG LQ XQGHUVWDQGLQJ0$&LQDFRPSOHWHV\VWHP IURP WKH ORZOHYHO RSHUDWLQJ V\VWHP XS WKURXJK LQIUDVWUXFWXUH OD\HUV WR WKH HQG XVHUDSSOLFDWLRQV
6HFXULQJ WKH GHVNWRS HQYLURQPHQW H[SHULHQFHG E\ W\SLFDO XVHUV LV RQH DUHD RIDFWLYHUHVHDUFK7KLVDUHDLVSDUWLFXODUO\ FKDOOHQJLQJ WR VHFXUH GXH WR WKH WLJKW FRXSOLQJ RI DSSOLFDWLRQV W\SLFDO LQ VXFK HQYLURQPHQWVDQGWKHODFNRIFRQVLGHUDWLRQ WRDQ\VHFXULW\ERXQGDU\EHWZHHQSURFHVVHV ZLWKLQDGHVNWRSVHVVLRQ$GGUHVVLQJWKHVH FKDOOHQJHV LV FULWLFDO LQ RUGHU WR EH DEOH WRSURWHFWDJDLQVWH[SORLWDWLRQRIÁDZVLQ FRPPRQO\XVHGGHVNWRSDSSOLFDWLRQVVXFK DVEURZVHUVDQGPDLOFOLHQWVVRWKDWDÁDZ LQ D VLQJOH SURJUDP GRHV QRW H[SRVH DOO RI WKH XVHU·V GDWD WR ULVN7R GDWH ZRUN KDV EHHQ GRQH E\ 16$ WR LPSOHPHQW WKH '%86 PHVVDJH VHUYLFH WKH *&RQI FRQÀJXUDWLRQV\VWHPDQGWKH;:LQGRZ 6\VWHPVHUYHUZLWKWKHQHFHVVDU\VXSSRUW IRUDSSO\LQJÁH[LEOH0$&WRWKHLUREMHFWV DQGRSHUDWLRQV>@:RUNLVRQJRLQJE\ 16$WRGHYHORSOLEUDU\VXSSRUWIRUWKHVH H[WHQVLRQV DGGUHVV RWKHU FRPSRQHQWV RI WKH GHVNWRS LQIUDVWUXFWXUH DQG DVVLVW LQ GHYHORSLQJ SROLF\ IRU WKH ; VHUYHU WKDW VXSSRUWV VLPSOH VHFXULW\ JRDOV )XWXUH ZRUN LQFOXGHV DGGUHVVLQJ SHUIRUPDQFH FKDOOHQJHVUHÀQLQJWKHFRQWUROVEDVHGRQ H[SHULHQFHZLWKUHDODSSOLFDWLRQVVHFXULQJ WKH GLUHFW UHQGHULQJ LQWHUIDFH SURYLGLQJ WUXVWHGLQSXWDQGGLVSOD\DQGLQWHJUDWLQJ ZLWKGHVNWRSDSSOLFDWLRQV
%H\RQGWKHGHVNWRSDZLGHUDQJHRI DSSOLFDWLRQVHFXULW\UHVHDUFKLVOHYHUDJLQJ 6(/LQX[ DV D EDVH SODWIRUP DQG DV DQ DUFKLWHFWXUH IRU SURYLGLQJ ÁH[LEOH 0$& VHUYLFHVWRKLJKHUOD\HUV7KLVLQFOXGHVWKH 6(3RVWJUH64/SURMHFWDQHIIRUWE\1(& &RUSRUDWLRQWRGHYHORSÁH[LEOH0$&IRU GDWDEDVH REMHFWV DQG WUDQVDFWLRQV LQ WKH 3RVWJUHV GDWDEDVH PDQDJHPHQW V\VWHP 5HVHDUFK KDV DOVR EHHQ SHUIRUPHG E\ 16$LQWRHQIRUFLQJ5LVN$GDSWLYH$FFHVV &RQWURO 5$G$& E\ OHYHUDJLQJ WKH 6(/LQX[ RSHUDWLQJ V\VWHP IXQFWLRQDOLW\ WR SURWHFW DQG LVRODWH DQ DSSOLFDWLRQ SROLF\ HQIRUFHU DQG E\ XVLQJ WKH )ODVN DUFKLWHFWXUHDQGXVHUVSDFHVHFXULW\VHUYHU WRSURYLGHSROLF\GHFLVLRQVDQGUHYRFDWLRQ VXSSRUW>@
(QDEOLQJVHFXUHÀOHVKDULQJDPRQJ QHWZRUNHG RU GLVWULEXWHG V\VWHPV LV DQRWKHUDUHDRIDFWLYHUHVHDUFKEHLQJOHG E\16$ZLWKVXSSRUWIURP63$57$,QF 7KLVHIIRUWUHTXLUHVDGGUHVVLQJFKDOOHQJHV SRVHGE\V\VWHPVZLWKSRWHQWLDOO\GLIIHUHQW VHFXULW\ SROLFLHV WKDW QHHG WR VKDUH GDWD VHFXUHO\ DV ZHOO DV SURYLGLQJ WKH EDVLF PHFKDQLVPV IRU FRQYH\LQJ VHFXULW\ DWWULEXWHV IRU SURFHVVHV DQG ÀOHV DFURVV WKH QHWZRUN *LYHQ WKH FRPPRQ XVH RI VXFKQHWZRUNHGÀOHV\VWHPVLQHQWHUSULVH HQYLURQPHQWVHQDEOLQJÁH[LEOH0$&WREH HIIHFWLYHO\DSSOLHGWRVXFKÀOHV\VWHPVLV OLNHZLVHDFUXFLDOFKDOOHQJH([SHULPHQWDO H[WHQVLRQV WR WKH 1)6Y SURWRFRO KDYH EHHQSURSRVHGDQGSURWRW\SHGDQGZRUN LV RQJRLQJ WR VWDQGDUGL]H WKH SURWRFRO FKDQJHVDQGWRJHWWKHLPSOHPHQWDWLRQLQWR
DIRUPDFFHSWDEOHWRWKH/LQX[GHYHORSHU FRPPXQLW\ )XWXUH ZRUN ZLOO LQFOXGH GHDOLQJZLWKKHWHURJHQHRXVSROLFLHV
:KLOH ÁH[LEOH 0$& SURYLGHV QHZ FDSDELOLWLHVIRULPSURYHGVHFXULW\LWDOVR LQWURGXFHV LWV RZQ VHW RI FKDOOHQJHV LQFOXGLQJSROLF\VFDODELOLW\DQGXVDELOLW\ +HQFHUHVHDUFKE\16$ZLWKVXSSRUWIURP 7UHV\V 7HFKQRORJ\ LV RQJRLQJ LQWR KRZ WRFUHDWHDQDEVWUDFWOD\HUIRUSROLF\DQG KRZWRPRUHFORVHO\OLQNWKHHQIRUFHPHQW GHEXJJLQJDQGGHYHORSPHQWRISROLF\WR HQDEOHXVHUVWRPRUHHIIHFWLYHO\GHYHORS GHEXJDQGXQGHUVWDQGSROLF\5HVHDUFKLV DOVRXQGHUZD\DW16$LQWRPRUHDGYDQFHG SROLF\ ODQJXDJH IHDWXUHV WR IDFLOLWDWH SROLF\FXVWRPL]DWLRQDQGH[WHQVLRQ
3ROLF\ PDQDJHPHQW FRQWLQXHV WR EH DQ DUHD RI DFWLYH LQYHVWLJDWLRQ (DUO\ ZRUN LQ WKLV DUHD E\ 7UHV\V 7HFKQRORJ\ DQG 5HG +DW KDV \LHOGHG WKH FXUUHQW SROLF\ PDQDJHPHQW LQIUDVWUXFWXUH DQG WRROV VXFK DV VHPDQDJH 5HVHDUFK E\ 7UHV\V7HFKQRORJ\ZKLFKZDVVSRQVRUHG E\ 16$ KDV DOVR \LHOGHG H[SHULPHQWDO SURWRW\SHV RI D SROLF\ PDQDJHPHQW VHUYHU WR VXSSRUW ÀQHJUDLQHG DFFHVV FRQWURORYHUWKHSROLF\LWVHOIDQGRISROLF\ PDQDJHPHQW LQIUDVWUXFWXUH WR VXSSRUW PDQDJHPHQW RI FROOHFWLRQV RI V\VWHPV :RUN KDV UHFHQWO\ VWDUWHG DW 3HQQ 6WDWH 8QLYHUVLW\WRLQYHVWLJDWHKRZWRPDQDJH SROLF\ IRU YLUWXDOL]HG HQYLURQPHQWV ZLWK GLIIHUHQW FROOHFWLRQV RI SROLF\ HQIRUFLQJ FRPSRQHQWV
Influencing other systems
7KH )ODVN VHFXULW\ DUFKLWHFWXUH GHPRQVWUDWHG LQ 6(/LQX[ KDV VWURQJO\ LQÁXHQFHG WKH VHFXULW\ RI D QXPEHU RI RWKHU V\VWHPV DQG VRIWZDUH FRPSRQHQWV ,QWKHDSSOLFDWLRQDUHQDWKLVKDVLQFOXGHG WKH '%XV PHVVDJH EXV VRIWZDUH WKH ; :LQGRZ 6\VWHP DQG 3RVWJUH64/ DV SUHYLRXVO\QRWHGHDFKRIZKLFKQRZKDVD VHWRIÁH[LEOH0$&FRQWUROVLPSOHPHQWHG WKDW FDQ H[WHQG WKH UHDFK RI WKH SROLF\ HQIRUFHPHQWWRWKHLUKLJKHUOHYHOREMHFWV DQGRSHUDWLRQV,QWKHYLUWXDOL]DWLRQDUHQD WKH )ODVN DUFKLWHFWXUH KDV EHHQ DSSOLHG WR WKH ;HQ K\SHUYLVRU \LHOGLQJ WKH ;HQ 6HFXULW\ 0RGXOHV ;60 IUDPHZRUN
14 Raising the Bar in Operating System Security DQG WKH ;HQ )ODVN VHFXULW\ PRGXOH GHYHORSHGE\16$HQDEOLQJHQIRUFHPHQW RISROLF\RYHUYLUWXDOPDFKLQHVDQGWKHLU LQWHUDFWLRQV 7KH 6HFXULW\(QKDQFHG %6' 6(%6' DQG6HFXULW\(QKDQFHG'DUZLQ 6('DUZLQ SURMHFWVGHPRQVWUDWHGWKDWWKH )ODVN DUFKLWHFWXUH FRXOG DOVR EH DSSOLHG WR RWKHU RSHUDWLQJ V\VWHPV $OWKRXJK 6(%6'DQG6('DUZLQDUHQRWLQWHJUDWHG LQWRWKHLUUHVSHFWLYHPDLQVWUHDPRSHUDWLQJ V\VWHPGLVWULEXWLRQVWKH\KHOSHGWRGULYH WKHUHTXLUHPHQWVIRUWKH0$&IUDPHZRUN WKDW FDQ EH IRXQG WRGD\ LQ PDLQVWUHDP )UHH%6' DQG LQ 0DF26 ; RSHUDWLQJ V\VWHPV 7KH\ DOVR SURYHG WKDW WKH DUFKLWHFWXUH ZDV DSSOLFDEOH WR D YDULHW\ RI RSHUDWLQJ V\VWHPV DQG SURYLGHG DQ DOWHUQDWLYHUHIHUHQFHLPSOHPHQWDWLRQIURP ZKLFKRWKHUVFDQOHDUQ
OpenSolaris FMAC: origin and goals
,Q ODWH 16$ DQG 6XQ 0LFURV\VWHPV ,QF EHJDQ D GLDORJXH DERXW LQWHJUDWLQJ VXSSRUW IRU WKH )ODVN DUFKLWHFWXUH LQWR WKH 6RODULV RSHUDWLQJ V\VWHP7KLVGLDORJXHOHGWRWKHODXQFKLQJ RIWKH)OH[LEOH0DQGDWRU\$FFHVV&RQWURO )0$& SURMHFW RQ 2SHQ6RODULVRUJ LQ 0DUFK7KHSURMHFWLVDMRLQWHIIRUW DPRQJ 16$ 6XQ DQG WKH 2SHQ6RODULV GHYHORSHUFRPPXQLW\WREULQJVXSSRUWIRU ÁH[LEOH 0$& WR WKH 2SHQ6RODULV RSHUDWLQJ V\VWHPHQYLURQPHQW
8QOLNH /LQX[ ZKHUH WKHUH ZDV QR VXSSRUW IRU 0$& DW DOO SULRU WR WKH LQWHJUDWLRQ RI 6(/LQX[ WKH 6RODULV RSHUDWLQJ V\VWHP KDV DQ H[LVWLQJ 0$& VROXWLRQ 3ULRU WR 6RODULV WKLV IXQFWLRQDOLW\ ZDV SURYLGHG E\ 6XQ YLD D VHSDUDWH SURGXFW WKH 7UXVWHG 6RODULV RSHUDWLQJ V\VWHP /LNH RWKHU WUXVWHG RSHUDWLQJ V\VWHPV RI LWV JHQUH 7UXVWHG 6RODULV ZDV OLPLWHG WR D À[HG 0/6 VHFXULW\ PRGHODQGWHQGHGWRODJEHKLQGWKHODWHVW UHOHDVH RI 6RODULV GXH WR WKH DGGLWLRQDO HQJLQHHULQJDQGHYDOXDWLRQUHTXLUHPHQWV ,Q 6RODULV VRPH RI WKH VHFXULW\ IXQFWLRQDOLW\ RI 7UXVWHG 6RODULV VXFK DV VXSSRUW IRU UROHV DQG SULYLOHJHV ZDV
LQWHJUDWHG LQWR WKH PDLQ 6RODULV SURGXFW DQGUHOHDVHGDVSDUWRI2SHQ6RODULV7KH 0/6VXSSRUWZDVUHGHVLJQHGDURXQGWKH 6RODULV´]RQHVµPHFKDQLVPDQGSURYLGHG DVDQRSWLRQDOVHWRIH[WHQVLRQVWR6RODULV NQRZQDV7UXVWHG([WHQVLRQV 7; ZKLFK KDYH DOVR EHHQ VXEVHTXHQWO\ LQWHJUDWHG LQWR2SHQ6RODULV
6RODULV ]RQHV DUH D PHFKDQLVP IRU OLJKWZHLJKW YLUWXDOL]DWLRQ WKH\ SURYLGH DQ LOOXVLRQ RI PXOWLSOH YLUWXDO RSHUDWLQJ V\VWHP LQVWDQFHV ZKLOH VKDULQJ D VLQJOH NHUQHOE\SODFLQJJURXSVRISURFHVVHVDQG REMHFWVLQWRVHSDUDWH´]RQHVµDQGLVRODWLQJ WKHP IURP RQH DQRWKHU 6LQFH 7; UHOLHV RQWKH]RQHVPHFKDQLVPLWLVOLPLWHGWR SHU]RQHVHFXULW\ODEHOV LHDOOSURFHVVHV DQGREMHFWVZLWKLQD]RQHVKDUHWKHVDPH VHFXULW\ ODEHO 7KLV UHSUHVHQWV D FKDQJH IURPWKHSULRU7UXVWHG6RODULVSURGXFWDQG DGLIIHUHQFHIURP6(/LQX[ERWKRIZKLFK VXSSRUWSHUSURFHVVDQGSHUREMHFWVHFXULW\ ODEHOLQJ7;LVDOVRSUHVHQWO\OLPLWHGWRD À[HG 0/6 PRGHO OLNH LWV SUHGHFHVVRUV
)0$& DLPV WR DGGUHVV WKHVH OLPLWDWLRQVE\VXSSRUWLQJSHUSURFHVVDQG SHUREMHFWODEHOLQJDQGSHUPLVVLRQFKHFNV DQG E\ LQWURGXFLQJ ÁH[LEOH 0$& VXSSRUW WR 2SHQ6RODULV WKDW FDQ VXSSRUW D ZLGH UDQJHRIVHFXULW\PRGHOV7KH]RQHEDVHG PHFKDQLVP ZLOO VWLOO EH XVHIXO DV D ZD\ RISURYLGLQJFRDUVHJUDLQHGLVRODWLRQDQG QDPHVSDFHVHSDUDWLRQZKLOH)0$&ZLOO EH XVHG LQ D FRPSOHPHQWDU\ IDVKLRQ WR SURYLGH LQWUD]RQH SURWHFWLRQ KDUGHQLQJ RIWKHJOREDO]RQHDQGFRQWURORYHUFURVV ]RQHFKDQQHOV,QWKLVPDQQHU)0$&DQG 7; VKRXOG EH DEOH WR FRPSOHPHQW RQH DQRWKHUDQGXOWLPDWHO\IRUPDQLQWHJUDWHG VROXWLRQ )0$&DOVRDLPVWRFRPSOHPHQWWKH H[LVWLQJ6RODULVSULYLOHJHDQG5ROH%DVHG $FFHVV&RQWURO 5%$& PHFKDQLVPV-XVW DV6(/LQX[SURYLGHVDZD\WRFRQWUROWKH XVHRI/LQX[VXSHUXVHUFDSDELOLWLHVEDVHG RQ SROLF\ )0$& ZLOO SURYLGH D ZD\ WR FRQWURO WKH XVH RI 6RODULV SULYLOHJHV EDVHGRQSROLF\7KLVFRQWUROZLOOLQFOXGH WKH DELOLW\ WR ELQG SULYLOHJHV WR VSHFLÀF SURFHVVHV DQG SURJUDPV WR OLPLW WKH XVH RI SULYLOHJHV E\ D JLYHQ SURFHVV WR
VSHFLÀFREMHFWVDQGWRSURWHFWSULYLOHJHG SURFHVVHV IURP XQWUXVWZRUWK\ LQSXWV MXVWDVLQ6(/LQX[8QOLNH/LQX[SULRUWR 6(/LQX[ 6RODULV KDV DQ H[LVWLQJ 5%$& PHFKDQLVP EXW DW WKH SUHVHQW WLPH WKH 6RODULV 5%$& PHFKDQLVP LV SULPDULO\ HQIRUFHG E\ WUXVWHG DSSOLFDWLRQV ZLWK WKH NHUQHO RQO\ DZDUH RI WKH SULYLOHJH PRGHO)0$&RIIHUVDPHDQVRIELQGLQJ WKH 6RODULV UROH FRQVWUXFW WR SURFHVVHV DQGGLUHFWO\HQIRUFLQJ5%$&UHVWULFWLRQV LQ WKH NHUQHO VWUHQJWKHQLQJ WKH H[LVWLQJ PHFKDQLVP
:KLOHFRPSOHPHQWLQJWKHVHH[LVWLQJ 6RODULVVHFXULW\PHFKDQLVPV)0$&ZLOO SUHVHUYH H[LVWLQJ 6RODULV LQWHUIDFHV DQG SURYLGHIXOOFRPSDWLELOLW\IRUDSSOLFDWLRQV MXVWDV6(/LQX[SURYLGHGIXOOFRPSDWLELOLW\ IRU /LQX[ DSSOLFDWLRQV )0$& ZLOO DOVR SURYLGHDVHWRIQHZ$3,VWKDWZLOOVXSSRUW VHFXULW\DZDUH DSSOLFDWLRQV DQG WKHVH $3,VZLOOSURYLGHWKHVDPHVHPDQWLFVDV WKH FRUUHVSRQGLQJ 6(/LQX[$3,V VR WKDW VHFXULW\DZDUHDSSOLFDWLRQVFDQEHZULWWHQ SRUWDEO\ WR UXQ RQ HLWKHU 6(/LQX[ RU 2SHQ6RODULV)0$&
8OWLPDWHO\ WKH 2SHQ6RODULV )0$& SURMHFW ZLOO SURYLGH D ZLGHU VHW RI SODWIRUPV WKDW VXSSRUW WKH )ODVN DUFKLWHFWXUH IRU ÁH[LEOH 0$& DQG ZLOO H[SDQGWKHGHYHORSHUDQGXVHUFRPPXQLW\ IRU )ODVN ,W VKRXOG DOVR KHOS HQFRXUDJH LQGHSHQGHQW VRIWZDUH YHQGRUV ,69V WR LPSURYH DSSOLFDWLRQOHYHO VXSSRUW IRU ÁH[LEOH 0$& DQG WR SURYLGH SROLFLHV IRU WKHLUDSSOLFDWLRQV
FMAC status
7KH LQLWLDO )0$& FRGH EDVH ZDV FRQWULEXWHGE\16$WR2SHQ6RODULVEDVHG RQDYHUVLRQRIWKH)ODVNFRGHWKDWSUHGDWHG DQ\LQYROYHPHQWE\WKH/LQX[FRPPXQLW\ 7KLV FRGH ZDV WKHQ LQWHJUDWHG LQWR WKH 2SHQ6RODULV FRGH DQG DGDSWHG E\ -RKQ :HHNVD6XQHQJLQHHUZKRLVWKHFROHDG RI WKH )0$& SURMHFW 7KLV FRGH ZDV ÀUVW UHOHDVHGSXEOLFO\DVDQ$OSKDUHOHDVHRQ WKH)0$&SURMHFWZHEVLWHLQ0D\ :KHQEXLOWLWSURGXFHGDSROLF\FRPSLOHU DQG D NHUQHO FDSDEOH RI ORDGLQJ WKH UHVXOWLQJSROLF\LQWRWKHVHFXULW\VHUYHU
The Next Wave Vol 18 No 2 2009 15 6LQFH WKDW ÀUVW UHOHDVH RI )0$&
MRLQW GHYHORSPHQW E\ 16$ DQG 6XQ 0LFURV\VWHPV KDV SURFHHGHG UDSLGO\ 6XSSRUWIRUQHZV\VWHPFDOOVDQGXWLOLWLHV DQGIRUSHUSURFHVVVHFXULW\ODEHOLQJZDV LQWURGXFHG GXULQJ WKH VXPPHU RI OHDGLQJ WR DQ $OSKD UHOHDVH LQ HDUO\ 6HSWHPEHU 6KRUWO\ WKHUHDIWHU SURWRW\SH VXSSRUW IRU SHUÀOH VHFXULW\ ODEHOLQJ LQ WKH =)6 ÀOH V\VWHP ZDV LQWURGXFHG ZKLFK SDYHG WKH ZD\ IRU VXSSRUWLQJ VHFXULW\ FRQWH[WWUDQVLWLRQVXSRQSURJUDPH[HFXWLRQ DQGIRUSHUIRUPLQJDEDVLFVHWRISURFHVV DQG ÀOH PDQGDWRU\ DFFHVV FRQWURO FKHFNV 7KLV ZRUN SURGXFHG D EDVLF ZRUNLQJ H[DPSOH RI KRZ ÁH[LEOH PDQGDWRU\ DFFHVV FRQWUROV FRXOG EH DSSOLHG WR DQ 2SHQ6RODULV V\VWHP 7KLV IXQFWLRQDOLW\ DORQJ ZLWK VXEVHTXHQW HQKDQFHPHQWV WR VXSSRUW ODEHOLQJ LQ WKH 703)6 ÀOH V\VWHP DQG LPSURYH WKH $FFHVV 9HFWRU &DFKH $9& LQWHUIDFHV DQG LPSOHPHQWDWLRQ LQ )0$&ZDVLQFOXGHGLQWKH$OSKDUHOHDVH PDGHLQODWH2FWREHU
7KH QH[W WZR PDMRU DUHDV RI IRFXV IRU)0$&LQWHJUDWLRQDUHSULYLOHJHVDQG 5%$& 6LJQLÀFDQW ZRUN DOVR UHPDLQV WR ODEHO DQG FRQWURO RWKHU REMHFWV DQG RSHUDWLRQV SURYLGHG E\ WKH 6RODULV NHUQHOFUHDWHDFRPSOHWHH[DPSOHSROLF\ FRQÀJXUDWLRQ DQG LQWHJUDWH VXSSRUW IRU )0$& IXOO\ LQWR XVHU VSDFH 0RUH DGYDQFHG GHYHORSPHQW DQG FROODERUDWLRQ ZLWKWKH6(/LQX[SURMHFWLQDUHDVVXFKDV VHFXULQJWKHGHVNWRSSROLF\XVDELOLW\DQG PDQDJHPHQWDQGODEHOHG1)6ZLOOOLNHO\ IROORZDV)0$&PDWXUHV
Conclusion
7KH 6(/LQX[ SURMHFW KDV EURXJKW ÁH[LEOH 0$& LQWR WKH PDLQVWUHDP DFKLHYLQJ VXFFHVV ERWK DV D WHFKQRORJ\ WUDQVIHU YHKLFOH DQG DV D SODWIRUP IRU DGYDQFHG UHVHDUFK DQG GHYHORSPHQW ,W KDV LQÁXHQFHG D ZLGH UDQJH RI V\VWHPV DQGVRIWZDUHFRPSRQHQWVDVVKRZQPRVW UHFHQWO\LQWKH2SHQ6RODULV)0$&SURMHFW 7KH GHYHORSHU DQG XVHU FRPPXQLW\ WKDW KDVDULVHQDURXQGWKHFRUHLGHDVHPERGLHG LQ6(/LQX[DQG2SHQ6RODULV)0$&JLYHV FRQÀGHQFH WKDW WKLV WHFKQRORJ\ ZLOO FRQWLQXHWREHSUHVHUYHGDQGEXLOWXSRQLQ IXWXUH FRPSXWLQJ V\VWHPV SURYLGLQJ D VROLGIRXQGDWLRQIRUDGGUHVVLQJWKHWKUHDWV SRVHG E\ ÁDZHG DQG PDOLFLRXV DSSOLFDWLRQV 7KH DGYDQFHV LQ XVDELOLW\ SHUIRUPDQFH DQG IXQFWLRQDOLW\ RYHU WKH SDVW VHYHUDO \HDUV KDYH PDGH WKHVH EHQHÀWV IDUPRUHDFFHVVLEOHWRHQGXVHUVResources
NSA SELinux web site, http://www.nsa.gov/ research/selinux
SELinux project wiki, http://selinuxproject.org Tresys Open Source Server, http://oss. tresys com
OpenSolaris FMAC web site, http:// opensolaris.org/os/project/fmac
References
[1] Loscocco P, Smalley S. Integrating Flexible Support for Security Policies into the Linux Operating System. In: Proceedings of the FREENIX Track: 2001 USENIX Annual Technical Conference; June 2001. [2] Marti D. A seatbelt for server software: SELinux blocks real-world exploits.
Available from: http://www.linuxworld. comnews/2008/022408-selinux.html [3] Red Hat. NYSE Euronext Chooses Red Hat Solutions for Flexibility and Reliable, Fast-Paced Performance. Available from: http://customers.press.redhat. com/2008/05/12/nyse/
[4] Walsh E. Application of the Flask Architecture to the X Window System Server. In: Proceedings of the 2007 SELinux Symposium; March 2007.
[5] Carter J. Using GConf as an Example of How to Create an Userspace Object Manager. In: Proceedings of the 2007 SELinux Symposium; March 2007. [6] Gregory M. Using the Flask Security Architecture to Facilitate Risk Adaptable Access Controls. In: Proceedings of the 2007 SELinux Symposium; March 2007.
Trademarks
FreeBSD® is a registered trademark of the FreeBSD Foundation.
Linux® is a registered trademark of Linus Torvalds.
Red Hat® Enterprise Linux® is a registered trademark of Red Hat, Inc.
NetTop® is a registered trademark of the National Security Agency.
Secure Office® is a registered trademark of Trusted Computer Systems, Inc.
Solaris™ and OpenSolaris™ are trademarks of Sun Microsystems, Inc.
The Next Wave Vol 18 No 2 2009 17
What is CLIP?
&/,3LVDQHIIRUWSLRQHHUHGE\WKH1DWLRQDO 6HFXULW\ $JHQF\·V $VVXUHG ,QIRUPDWLRQ 6KDULQJ 7HFKQRORJLHV DQG 3URGXFWV 2IÀFH ZLWK WKH JRDO RI GHFUHDVLQJ WKH WLPH DQG FRVW DVVRFLDWHG ZLWK FHUWLI\LQJ DQG GHSOR\LQJ WUXVWHG VROXWLRQV 7KLV SURMHFW KHOSV DFKLHYH 1HW&HQWULF 6HFXULW\ 7HFKQRORJLHV· PLVVLRQ WR SURYLGH WHFKQLFDO LQIRUPDWLRQDVVXUDQFH ,$ JXLGDQFHDQGWRVXSSRUW WKHV\VWHPVHFXULW\HQJLQHHULQJSURFHVV7KH&/,3 SURMHFWSURYLGHVDQRSHQVRXUFHEDVHWKDWPXOWLSOH SURMHFWV FDQ HDVLO\ XWLOL]H DV D UHVRXUFH 0RUH VSHFLÀFDOO\ &/,3 SURYLGHV
8QGHUO\LQJ V\VWHP FRQÀJXUDWLRQ ,QLWLDO DSSOLFDWLRQ FRQÀJXUDWLRQ 8SGDWHG 6HFXULW\(QKDQFHG /LQX[
6(/LQX[ SROLF\ ZLWK WKH JRDO RI FUHDWLQJ D PRUH VHFXUH HQYLURQPHQW
8SGDWHV DQG DGGLWLRQDO SDFNDJHV QHFHVVDU\ WR PHHW FHUWDLQ UHTXLUHPHQW VHWV DQG $UWLIDFWV GHVFULELQJ KRZ WKH V\VWHP PDSV
WRUHTXLUHPHQWVHWVWKDWFDQEHXVHGDVSDUW RI WKH HYLGHQFH IRU FHUWLÀFDWLRQ
Need for a secure foundation
:KHQ FRQVWUXFWLQJ VROXWLRQV YLWDO WR QDWLRQDO VHFXULW\ V\VWHP GHYHORSHUV VKRXOG HQVXUH FRPSDWLELOLW\ E\ SURSHUO\ FRQÀJXULQJ WKHLU FXVWRP DSSOLFDWLRQV ZLWK DOO RWKHU DSSOLFDWLRQV UXQQLQJ RQ WKH RSHUDWLQJ V\VWHP DQG ZLWK WKH RSHUDWLQJ V\VWHP LWVHOI +RZHYHU GHYHORSHUV IUHTXHQWO\ KDYH QHLWKHU WKH WLPH QRU WKH RSHUDWLQJ V\VWHP H[SHUWLVH WR SURSHUO\ FRQÀJXUH DOO SDUWV RI WKH V\VWHP $QG HYHQ ZKHQ SURSHUO\ FRQÀJXUHG HDFK V\VWHP LV RIWHQFUHDWHGDQGXVHGIRUDVLQJOHSURMHFWDQGUDUHO\ VKDUHG DPRQJ SHHUV 7KLV ODFN RI VKDULQJ FUHDWHV DQ HQYLURQPHQW ZKHUH WLPH HIIRUW DQG PRQH\ PXVWEHVSHQWGXULQJHYHU\GHYHORSPHQWWRUHSHDW WKH SURFHGXUH RI ORFNLQJ GRZQ WKH V\VWHP DQG LWV DSSOLFDWLRQV
Certification and Accreditation
&HUWLÀFDWLRQ DQG $FFUHGLWDWLRQ & $ LV DQ LPSRUWDQW DQG QHFHVVDU\ SDUW RI WKH GHSOR\PHQW
RI DQ\ VHFXULW\ V\VWHP (YHU\ WLPH D V\VWHP LV DFFUHGLWHG LW PXVW JR WKURXJK WKH FHUWLÀFDWLRQ SURFHVV WR YHULI\ WKDW LW PHHWV DOO RI LWV VHFXULW\ DQGIXQFWLRQDOUHTXLUHPHQWV7KLVSURFHVVUHTXLUHV WKDW GHYHORSHUV VSHQG WLPH FUHDWLQJ V\VWHP GRFXPHQWDWLRQ DQG PDSSLQJ WKH GRFXPHQWDWLRQ WR UHTXLUHPHQW VHWV 7KH FHUWLÀFDWLRQ WHDPV PXVW DOVR FUHDWH WHVWV WKDW DUH WKHQ XVHG WR YHULI\ WKH GHYHORSHUV· FODLPV 7HVWLQJ DQG YHULÀFDWLRQ LV FXUUHQWO\SHUIRUPHGIRUHDFKDQGHYHU\V\VWHPWKDW JRHV WKURXJK WKH & $ SURFHVV EHFDXVH QR FRPPRQ FRQÀJXUDWLRQ LV XVHG IRU DOO V\VWHPV
Reliance on proprietary hardware and software
:KHQ FUHDWLQJ DQ\ FXVWRP VROXWLRQ WKH GHYHORSHU IDFHV WKH KXUGOH RI REWDLQLQJ DFFHVV WR WKH RSHUDWLQJ V\VWHP VRXUFH FRGH ,Q WKH SDVW PDQ\ VROXWLRQVZHUHFUHDWHGRQFORVHGVRXUFHRSHUDWLQJ V\VWHPV WKDW OLPLWHG WKH GHYHORSHU·V DFFHVV WR WKH VRXUFH ÀOHV 7KH GHYHORSHU ZDV VXEVHTXHQWO\ OLPLWHG WR RQO\ WKH OLVW RI GRFXPHQWHG FDOOV ZKLFK PD\ RU PD\ QRW KDYH EHHQ WKH IXOO VHW RI DFWXDO FDOOV ,Q WKLV PRGHO LI GHYHORSHUV IRXQG D SUREOHP WKH\KDGWRUHO\RQWKHYHQGRUWRSURYLGHDVROXWLRQ 7KH XVH RI SURSULHWDU\ KDUGZDUH LV DQRWKHU OLPLWLQJ IDFWRU LQ WRGD\·V VROXWLRQV &XVWRP VROXWLRQV XVH RSHUDWLQJ V\VWHPV WKDW PXVW UXQ RQ SURSULHWDU\KDUGZDUHDQGFDQQRWHDVLO\EHSRUWHG $V WKH KDUGZDUH DJHV SDUWV WKDW DUH QR ORQJHU PDQXIDFWXUHGPXVWEHUHSODFHG7KLVHQYLURQPHQW IRUFHVWKHGHYHORSHUWRSXUFKDVHGXSOLFDWHVHWVRI KDUGZDUH WR HQVXUH ORQJWHUP VXSSRUW
CLIP explained
CLIP toolkit
7KH &/,3 WRRONLW FDQ EH XVHG E\ V\VWHP GHYHORSHUV WR FUHDWH D VHFXUH VWDUWLQJ SRLQW ZKHQ EXLOGLQJ VROXWLRQV (DFK WRRONLW LV VSHFLÀF WR D SDUWLFXODU UHOHDVH RI D FRPPHUFLDOO\ VXSSRUWHG RSHUDWLQJ V\VWHP 7RRONLWV KDYH EHHQ FUHDWHG IRU 5HG +DW (QWHUSULVH /LQX[ 5+(/ YHUVLRQV DQG WKURXJK 7KH WRRONLW IRU 5+(/ LV FXUUHQWO\XQGHUGHYHORSPHQW
7KH WRRONLWV YDU\ LQ WKH VSHFLÀF SDFNDJHV WKH\ SURYLGH EXW DW PLQLPXP HDFK RQH SURYLGHV D NLFNVWDUW ÀOH WKDW FRQWUROV WKH LQLWLDO V\VWHP
18 Providing A Secure Foundation
FRQÀJXUDWLRQ D &/,3 SDFNDJH PDQDJHU 530 WKDW LQVWDOOV &/,3 VSHFLÀF XWLOLWLHV DQG DQ XSGDWHG 6(/LQX[ SROLF\ 530 WKDW KDUGHQV WKH VWDQGDUG UHIHUHQFH SROLF\ SDFNDJH 7KH 5+(/ WRRONLW SURYLGHV V\VWHP XSGDWHV WR HQDEOH WUXH UROH VHSDUDWLRQ 7KH 5+(/ UHOHDVH DGGV WR WKH SUHYLRXV UHOHDVH ZLWK VXSSRUW IRU ODEHOLQJ SDFNHWV
(DFK SLHFH RI WKH WRRONLW FDQ EH XVHG VHSDUDWHO\ LI D GHYHORSHU FKRRVHV WR GR VR DOORZLQJ &/,3WRPHHWWKHQHHGVRIWKHG\QDPLFHQYLURQPHQW LQZKLFKV\VWHPVDUHGHSOR\HG
SELinux as a basis
$W D PLQLPXP D VHFXUH IRXQGDWLRQ UHTXLUHV VHFXULW\ PHFKDQLVPV HQIRUFHG E\ WKH RSHUDWLQJ V\VWHP 6(/LQX[ SURYLGHV WKH EDVLV IRU WKLV VHFXUH IRXQGDWLRQ
6(/LQX[ >@ LV DQ LPSOHPHQWDWLRQ RI )ODVN >@ D ÁH[LEOH DQG ÀQHJUDLQHG PDQGDWRU\ DFFHVV FRQWURO 0$& DUFKLWHFWXUH LQ WKH /LQX[ NHUQHO 7KH DUFKLWHFWXUH VHSDUDWHV WKH SROLF\ GHFLVLRQ SRLQW SURYLGHG E\ WKH VHFXULW\ VHUYHU IURP WKH SROLF\ HQIRUFHPHQW SRLQW LPSOHPHQWHG E\ WKH /60 /LQX[ 6HFXULW\ 0RGXOHV IUDPHZRUN >@
7KH )ODVN DUFKLWHFWXUH >@ SURYLGHV ÁH[LELOLW\ LQ LWV VXSSRUW IRU VHFXULW\ SROLFLHV WKHUHE\ SURYLGLQJ PHFKDQLVPV WR VXSSRUW D ZLGH YDULHW\ RI UHDOZRUOG VHFXULW\ SROLFLHV $ VHFXULW\ FRQWH[W LV DWWDFKHG WR HYHU\ REMHFW RQ D V\VWHP HJ ÀOHV SURFHVVHV QHWZRUN SDFNHWV 7KH VHFXULW\ SROLF\ GHÀQHV DOORZHG DFFHVV E\ VXEMHFW VHFXULW\ FRQWH[WV WR REMHFW VHFXULW\ FRQWH[WV ZLWK VHWV RI SHUPLVVLRQVVWRUHGLQDFFHVVYHFWRUV7RPLQLPL]H WKHSHUIRUPDQFHLPSDFWRIFRQVXOWLQJWKHVHFXULW\ SROLF\ D VHFXULW\ GHFLVLRQ FDFKLQJ PHFKDQLVP FDOOHGWKHDFFHVVYHFWRUFDFKH $9& LVXVHG
6(/LQX[ LPSOHPHQWV D FRPELQDWLRQ RI PDQGDWRU\ DFFHVV FRQWURO PHFKDQLVPV WR SURYLGH PD[LPXP ÁH[LELOLW\ DQG XVDELOLW\ W\SH HQIRUFHPHQW 7( UROHEDVHG DFFHVV FRQWURO 5%$& DQG PXOWLOHYHO VHFXULW\ 0/6 7\SH HQIRUFHPHQW >@ KDV EHHQ H[SORUHG IRU PDQ\ \HDUV HJ 'RPDLQ DQG 7\SH (QIRUFHPHQW > @ DQG 'LVWULEXWHG 7UXVWHG 2SHUDWLQJ 6\VWHP '726 >@ DV DQ HIIHFWLYH DQG ÁH[LEOH 0$& PHFKDQLVP ,Q W\SH HQIRUFHPHQW DOO HQWLWLHV RQ D V\VWHP DUH
JLYHQ D W\SH DQG HYHU\ REMHFW RU VXEMHFW ZLWK WKH VDPH W\SH LV WUHDWHG LGHQWLFDOO\$FFHVV GHFLVLRQV DUHPDGHEDVHGRQWKHSHUPLVVLRQVJUDQWHGWRHDFK W\SH 5ROHEDVHG DFFHVV FRQWURO >@ SURYLGHV D FRPSOHPHQWDU\ PHFKDQLVP WR W\SH HQIRUFHPHQW LQZKLFKDFFHVVLVJUDQWHGEDVHGRQUROHVDVVLJQHG WR XVHUV 0XOWLOHYHO VHFXULW\ SURYLGHV D PHDQV WR SURFHVV GDWD ZLWK GLIIHUHQW VHQVLWLYLWLHV RU OHYHOV XVLQJ WKH %HOO/D3DGXOD %/3 PRGHO >@
6(/LQX[ LV DYDLODEOH LQ D QXPEHU RI /LQX[ GLVWULEXWLRQV LQFOXGLQJ )HGRUD *HQWRR DQG 'HELDQ DV ZHOO DV WKH FRPPHUFLDOO\ DYDLODEOH /DEHOHG 6HFXULW\ 3URWHFWLRQ 3URÀOH /633 (YDOXDWLRQ $VVXUDQFH /HYHO ($/ 5HG +DW (QWHUSULVH /LQX[ 5+(/ ,W DOVR KDV EHHQ SRUWHG WR RWKHU RSHUDWLQJ V\VWHPV LQFOXGLQJ )UHH%6' 6HFXULW\ (QKDQFHG %6' >@ DQG $SSOH·V 'DUZLQ RSHUDWLQJ V\VWHP 6HFXULW\ (QKDQFHG 'DUZLQ >@ 7KH 6(/LQX[ 5HIHUHQFH 3ROLF\ >@ SURYLGHV WKH EDVLVIRUVHFXULW\SROLF\RQPRVWRIWKHVHV\VWHPV
System configuration
7KH &/,3 LQVWDOODWLRQ FRQÀJXUHV WKH V\VWHP WR PHHW WKH 'LUHFWRU RI &HQWUDO ,QWHOOLJHQFH 'LUHFWLYH '&,' 3URWHFWLRQ /HYHO UHTXLUHPHQWV DQG WKH 'HIHQVH ,QIRUPDWLRQ 6\VWHPV $JHQF\ ',6$ 8QL[ 6HFXULW\ 7HFKQLFDO ,PSOHPHQWDWLRQ *XLGH 67,* YU 7KHVH FRQÀJXUDWLRQV IDOO LQWR WKUHH PDLQ FDWHJRULHV DSSOLFDWLRQ DQG VHUYLFH LQVWDOODWLRQ DFFHVV FRQWURO DQG DXGLWLQJ
7R LQFUHDVH VHFXULW\ DQG WKH HDVH RI DGPLQLVWUDWLRQ &/,3 LQVWDOOV RQO\ WKH EDVH DSSOLFDWLRQV QHHGHG WR UXQ DQG DGPLQLVWHU WKH V\VWHP %\ GHIDXOW LW H[FOXGHV PDQ\ EDVH DSSOLFDWLRQV QRW UHTXLUHG IRU D IXQFWLRQLQJ V\VWHP LQFOXGLQJ DSSOLFDWLRQV VXFK DV ZHE WRROV RIÀFH WRROV DQG GHVNWRS HQYLURQPHQWV 6RPH VHUYLFHV DUHLQFOXGHGLQWKHEDVHLQVWDOODWLRQEHFDXVHRIWKHLU FRPPRQ XVDJH EXW DUH QRW QHHGHG IRU WKH V\VWHP WR IXQFWLRQ 7KHVH VHUYLFHV DUH GLVDEOHG OHDYLQJ RQO\ DKDQGIXOUXQQLQJE\GHIDXOW
&/,3 LV DOVR FRQÀJXUHG WR JUHDWO\ UHVWULFW XVHU DFFHVV WR WKH V\VWHP 8QQHHGHG GHIDXOW DFFRXQWV DUH HLWKHU UHPRYHG RU GLVDEOHG 'LUHFW DGPLQLVWUDWLYH URRW DFFHVV WR WKH V\VWHP LV GLVDEOHG UHTXLULQJ ORJJLQJLQDVDQXQSULYLOHJHGXVHUEHIRUHSULYLOHJH HVFDODWLRQ $GGLWLRQDOO\ DOO QHWZRUN DFFHVV LV
The Next Wave Vol 18 No 2 2009 19 GHQLHG DQG QHWZRUN SDUDPHWHUV DUH PRGLÀHG WR
SUHYHQW UHPRWH DWWDFNV $Q\ VHUYLFHV UHTXLULQJ D QHWZRUN FRQQHFWLRQ PXVW EH H[SOLFLWO\ DOORZHG DFFHVV RQ D FDVHE\FDVH EDVLV
,Q DGGLWLRQ WR XVHU DFFHVV WR WKH V\VWHP &/,3 XVHV ERWK GLVFUHWLRQDU\ DFFHVV FRQWURO '$& DQG PDQGDWRU\ DFFHVV FRQWURO 0$& PHFKDQLVPV WR UHVWULFW DOO DFFHVV WR ÀOHV DQG GLUHFWRULHV WR RQO\ WKH PLQLPDO VHW UHTXLUHG WR PHHW WKH EDVH UHTXLUHPHQWV &/,3 PRGLÀHV WKH '$& SHUPLVVLRQV RI PDQ\ LPSRUWDQW V\VWHP ÀOHV VXFK DV ORJ ÀOHV FRQÀJXUDWLRQ ÀOHV DQG UXQ FRQWURO VFULSWV WR HQVXUH RQO\ SULYLOHJHG XVHUV PD\ DFFHVV WKHP 8VLQJ WKH 6(/LQX[ SROLF\ IRU 0$& HQIRUFHPHQW &/,3 IXUWKHU OLPLWV DQG FRQÀQHV D XVHU·V DELOLW\ WR YLHZ DQG HGLW VHFXULW\UHOHYDQW ÀOHV
7R WUDFN DOO FKDQJHV WR WKH V\VWHP &/,3 HQDEOHV DXGLWLQJ DQG DGGV PDQ\ DXGLW UXOHV WR UHFRUG D FRPSOHWH KLVWRU\ RI DOO VHFXULW\UHOHYDQW V\VWHP DFWLRQV 7KLV KLVWRU\ LQFOXGHV XVHU ORJLQV DQG ORJRXWV FKDQJHV WR '$& SHUPLVVLRQV DQG 6(/LQX[ ODEHOV XQDXWKRUL]HG ÀOH DFFHVV DWWHPSWV XVH RI SULYLOHJHG FRPPDQGV DQG PRGLÀFDWLRQ RI LPSRUWDQW V\VWHP ÀOHV 7R HQVXUH D IXOO DXGLW KLVWRU\ LV DOZD\V PDLQWDLQHG DQ\ FULWLFDO HUURU RI WKH DXGLW VXEV\VWHP ZLOO FDXVH DQ LPPHGLDWH VKXWGRZQ WR SUHYHQWDQ\SRVVLEOHEUHDFKRILQIRUPDWLRQ
New packages
7RSURYLGHWKHIRXQGDWLRQWKDWPHHWVPXOWLSOH UHTXLUHPHQW VHWV WKH &/,3 SURMHFW LQFOXGHV XSGDWHG DQG QHZ SDFNDJHV DV SDUW RI LWV WRRONLW 7KHVH SDFNDJHV DXJPHQW WKH EDVH V\VWHP DQG SURYLGH WKH GHYHORSHUDGGLWLRQDOVHFXULW\IHDWXUHV
$XWKHQWLFDWLRQ
7KH 1DWLRQDO 6HFXULW\ 6\VWHPV ,QVWUXFWLRQ 166, UHTXLUHPHQW $& FDOOV IRU HQIRUFHG OLPLWVIRUXVHUVDFFHVVLQJQDWLRQDOVHFXULW\V\VWHPV DQG LQIRUPDWLRQ 7KHVH OLPLWV LQFOXGH D PD[LPXP QXPEHU RI FRQVHFXWLYH IDLOHG ORJRQ DWWHPSWV WR DFFHVV D QHWZRUN GXULQJ D VHW SHULRG RI WLPH DQG KRZORQJWKHXVHUKDVWRZDLWEHIRUHWU\LQJWRORJ RQ DIWHU EHLQJ ORFNHG RXW
7KH FXUUHQW GHIDXOW PRGXOH XVHG E\ WKH /LQX[ DXWKHQWLFDWLRQ V\VWHP GRHV QRW VXSSRUW DOO WKH UHTXLUHG IXQFWLRQDOLW\ )XUWKHUPRUH WKH PRGXOH
FRXOG QRW EH H[WHQGHG WR VXSSRUW WKLV UHTXLUHPHQW &/,3 FUHDWHG WKH SDPBWDOO\ PRGXOH WR UHSODFH WKH FXUUHQW PRGXOH PDNLQJ LW SRVVLEOH IRU GHYHORSHUV WRVDWLVI\WKHUHTXLUHPHQW
$UFKLYLQJ
7KH '&,' UHTXLUHV WKDW D V\VWHP FUHDWH EDFNXSV RI WKH VHFXULW\ ODEHOV VHSDUDWHO\ IURP WKH REMHFWV RQ WKH V\VWHP > @ $ PHFKDQLVP WR DFFRPSOLVK WKLV W\SH RI EDFNXS GLG QRW H[LVW IRU 6(/LQX[ EDVHG V\VWHPV 7KH &/,3 SURMHFW FUHDWHG WKH H[WHQGHG DWWULEXWH UHFRYHU\ [DU XWLOLW\ WR VDWLVI\ WKLV UHTXLUHPHQW 7KH [DU XWLOLW\ SURYLGHV DQ HDV\ ZD\ WR EDFNXS DQG UHVWRUH WKH VHFXULW\ ODEHOV RI REMHFWV RQ DQ 6(/LQX[ V\VWHP
1HWZRUNLQJ
5+(/ KDV WKH DELOLW\ WR ODEHO QHWZRUN SDFNHWV XVLQJ ODEHOHG ,36HF RU &,362 :KHQ RSHUDWLQJLQDQHQYLURQPHQWWKDWGRHVQRWVXSSRUW ODEHOHG QHWZRUNLQJ LW LV XVHIXO IRU D V\VWHP WR EH DEOH WR G\QDPLFDOO\ ODEHO SDFNHWV EDVHG XSRQ D VHW RI UXOHV VXFK DV WKH QHWZRUN WKH SDFNHW ZDV UHFHLYHG IURP RU WKH SURWRFRO RI WKH SDFNHW /LQX[ XVHV WKH VHFXULW\ PDUNLQJV 6(&0DUN IHDWXUH WR ODEHO SDFNHWV XVLQJ ,37DEOHV ÀUHZDOO UXOHV 7KLV VXSSRUW ZDV QRW LQFOXGHG LQ 5+(/ EXW ZDV EDFN SRUWHG E\WKH&/,3SURMHFWWRHQDEOHGHYHORSHUVWRFKDQJH WKH ODEHO DSSOLHG WR D SDFNHW DW UXQWLPH RQ D V\VWHP
Future directions
$V WKH ODQGVFDSH RI & $ FKDQJHV WKH &/,3 SURMHFWPXVWFKDQJHZLWKLW7KHFXUUHQWWUHQGLVWR SURYLGH D PHFKDQLVP WR YHULI\ WKDW \RXU FXUUHQW V\VWHP PDWFKHV WKH FHUWLÀHG FRQÀJXUDWLRQ 7KLV YHULÀFDWLRQ LV GRQH XVLQJ WKH 6HFXUH &RQWHQW $XWRPDWLRQ 3URWRFRO 6&$3 DQG KDV EHHQ GHSOR\HG RQ DOO IHGHUDO QRQQDWLRQDO VHFXULW\ V\VWHPV )XWXUH HIIRUWV ZLOO H[WHQG WKH &/,3 SURMHFW WR SURYLGH XSGDWHV WR WKH 6(/LQX[ SROLF\ DQG WKH 6&$3FRQWHQWQHFHVVDU\WRYHULI\WKDWWKHV\VWHP FRQÀJXUDWLRQ PDWFKHV WKH UHTXLUHPHQWV
2QH ORQJWHUP JRDO RI WKH &/,3 SURMHFW LV WR FUHDWHDOLEUDU\WKDWZLOOGHFUHDVHWKHGHYHORSPHQW DQGDFFUHGLWDWLRQWLPHE\JHQHUDWLQJWKHQHFHVVDU\ DUWLIDFWVIURPDVLQJOHVRXUFH6XFKDV\VWHPZRXOG DOORZGHYHORSHUVWROLVWWKHVHWRIUHTXLUHPHQWVWKDW
Cryptographic Binding
of Metadata
A
s most people know, metadata is“data about data.” It may include security labels and discovery in-formation, as well as user and environ-mental attributes. Metadata is intended to be used by human consumers or by autonomous processes such as access control mechanisms in the Global Infor-mation Grid (GIG), network-centric con-tent discovery services, or automated information dissemination systems. As decisions are made based on metadata content, the assurance provided for the actual metadata must be considered. In many scenarios, the assurance pro-vided to metadata and to the relationship between metadata and data is essen-tial. Such scenarios range from simple discovery queries to enabling Assured Information Sharing (AIS) through Cross Domain Solutions (CDS).
The Next Wave Vol 18 No 2 2009 23
What is cryptographic
binding?
Cryptographic binding provides as-surance to the relationship between data and its associated metadata. A binding also ensures that neither the data nor its associated metadata have been mali-FLRXVO\ RU DFFLGHQWDOO\ PRGL¿HG ZLWKRXW detection. The binding does not ensure that the original data or metadata is ac-curate or correct prior to the binding. As the name implies, cryptographic binding uses cryptography as a technique to as-VHUW D YHUL¿DEOH UHODWLRQVKLS RYHU GDWD DQG its associated metadata. The relationship established with a cryptographic bind-ing is claimed valid if the bound data has integrity and the identity of the binder is authenticated.
How does cryptographic
binding work?
Data formats, metadata standards, and cryptography are continually evolv-ing within the Department of Defense (DoD) GIG and the Intelligence Commu-QLW\ ,& )RU H[DPSOH PHWDGDWD WR IXO¿OO WKH QHHGV RI WKH ,& LV VWLOO EHLQJ GH¿QHG in many areas. With cryptographic bind-ing dependbind-ing on these evolvbind-ing data standards and formats, it is important to HVWDEOLVK D ÀH[LEOH DQG PRGXODU ELQGLQJ as well as a validation model that meets
the community’s needs and can cope with this ever-changing operating environ-ment. The design of cryptographic bind-ing centers on several key assumptions:
'DWD DQG PHWDGDWD PD\ H[LVW LQ any discrete format (e.g., XML, HTML, .doc, .xls, .txt, .ppt, .pdf) 0HWDGDWD PD\ H[LVW HPEHGGHG
ZLWKLQ GDWD RU DV D VHSDUDWH ¿OH &U\SWRJUDSKLF ELQGLQJ IXQFWLRQV
must not modify the data or meta-data
0XOWLSOH PHWDGDWD ¿OHV PD\ H[LVW for data (e.g., discovery metadata, IA metadata, user and environ-mental attributes)
&U\SWRJUDSKLF ELQGLQJ IXQFWLRQV may exist as embedded applica-tions or distributed services The cryptographic binding model offers two complementary functions, each with a distinct set of inputs and outputs. First, a binding function, often referred to as the binder, has the sole responsibility of creating cryptographic bindings. The ELQGHU DFFHSWV WKH GDWD DQG PHWDGDWD ¿OHV and uses a cryptographic technique to cre-ate the binding. The binder produces the asserted relationship as a binding infor-PDWLRQ ¿OH ELI 7KH YDOLGDWLRQ IXQFWLRQ often referred to as simply the validator,
accepts the data, metadata, and previously JHQHUDWHG ELI ¿OHV DQG DSSOLHV WKH VDPH cryptographic technique to verify the in-tegrity and authenticity of the relation-ship. The validator produces a “valid” or “not valid” response indicating the valid-ity of the binding. Figure 1 illustrates this model for creating and validating crypto-graphic bindings.
7KH ELI VDWLV¿HV WKH QHHG WR FUH ate a binding without modifying the data RU PHWDGDWD ¿OHV 7KH ELI FRQWDLQV WKH minimum data required for a validator to verify the integrity and authenticity of the ELQGLQJ 7KH ¿HOGV LQ WKH ELI ¿OH LQFOXGH but are not limited to:
&U\SWRJUDSKLF YDOXH HJ GLJLWDO signature) &U\SWRJUDSKLF DOJRULWKP LGHQWL ¿HU 'DWD KDVK YDOXH DOJRULWKP DQG XQLTXH LGHQWL¿HU 0HWDGDWD KDVK YDOXH DOJRULWKP DQG XQLTXH LGHQWL¿HU %LQGHU LGHQWLW\ 6HFXULW\ PDUNLQJV %LQGLQJ PHWKRG LGHQWL¿HU
Cryptographic binding builds upon underlying cryptographic techniques, such as digital signatures, to provide ad-ditional services and information. First,
24 Cryptographic Binding of Metadata
although the identity of the binder can be authenticated, the identity of the entity RULJLQDOO\ FODLPLQJ WKDW WKH ERXQG ¿OHV are indeed related must be captured for WUDFHDELOLW\ DQG DXGLWLQJ 6HFRQG D FU\S tographic binding can be thought of as the focal point of data aggregation, possibly bringing an increase of the security level to the binding. For example, imagine a VFHQDULR LQ ZKLFK D GDWD ¿OH FRQWDLQV D OLVW RI QDPHV DQG D PHWDGDWD ¿OH FRQWDLQV D FRUUHVSRQGLQJ OLVW RI GHSDUWPHQWV 6HSD UDWHO\ WKHVH LWHPV DUH XQFODVVL¿HG +RZ ever, once the items are cryptographically ERXQG FUHDWLQJ D YHUL¿DEOH UHODWLRQVKLS
the security level of the information could be increased due to the data aggregation.
This modular architecture separates the functionality from the underlying cryptographic mechanism that provides the integrity and authenticity. Multiple interchangeable binding methods are de-¿QHG WKDW HQDEOH WKH XVH RI DV\PPHWULF cryptography (e.g., digital signatures), symmetric cryptography, and authenti-cated shared secrets (e.g., secure hashes). Providing these general binding methods enables cryptographic binding to seam-lessly incorporate new cryptographic al-gorithms and techniques.
Proving cryptographic
binding concepts
Two cryptographic binding proto-W\SHV GHYHORSHG E\ WKH 1HW&HQWULF 6HFX rity Technologies Division implement the cryptographic binding model and system architecture. These prototypes made use of existing technologies and services to demonstrate the cryptographic binding capability as a system integrated applica-tion and an enterprise service. The fol-lowing are details of each prototype: Cryptographic binding using XML digital signatures
$SSOLHV WR ORFDO DQG GLVWULEXWHG architectures
,PSOHPHQWV ;0/ DQG ;0/ GLJL WDO VLJQDWXUHV '6,*
8VHV ZHE VHUYLFHV DQG PHVVDJH transmission optimization mech-anism (MTOM)
6XSSRUWV 56$ ELW HQFU\S WLRQ DQG 6HFXUH +DVK $OJRULWKP 6+$
'HYHORSHG XVLQJ -DYD 3URGXFHV D ELI VL[ NLORE\WHV LQ
size
Cryptographic binding using Abstract Syntax Notation 1 (ASN.1) and Cryptographic Message Syntax (CMS)— preferred method
$SSOLHV WR ORFDO DQG GLVWULEXWHG architectures
,PSOHPHQWV $61 DQG &06 VWXGLHV VKRZ $61 LV IDVWHU WR decode than XML
,PSOHPHQWV HOOLSWLF FXUYH FU\S tography (ECC) offering more bits of security using smaller key size and faster algorithmic pro-cessing
6XSSRUWV 56$ DQG ELW encryption