Protection

And
Security

www.dextutor.com
 To prevent violation of
an access restriction of
Why user
protecti
on To ensure every program
component in a system
uses resources in an
intended manner only

Baljit Singh Saini (www.dextutor.com)

Principle of least privilege

• It dictates that programs, users and even systems be given just

enough privileges to perform their tasks.

Baljit Singh Saini (www.dextutor.com)

 Computer system is a collection of

• Processes

Domain
• Objects – hardware or software

Each object has a

of • unique name – for identification
• Well defined operations – for access
protecti E.g.

on • CPU – can only execute

• Memory segments – read and write
• Data files – created, opened, read, written,
closed and deleted

Baljit Singh Saini (www.dextutor.com)

 Protection domain specifies the resources that the
process may access.

Access right – ability to execute an operation on

Domain an object

Domain defines a set of objects and types of

Structur operations that may be invoked on each object.

Domain is a collection of access rights, each of

e
which is an ordered pair <object-name, rights-
set>.
E.g. domain D has the access right <file F,
{right,write}>
• Means any process executing in domain D can both read and
write in file F

Baljit Singh Saini (www.dextutor.com)

Example

Baljit Singh Saini (www.dextutor.com)

Domain

1 2 3
Each user can Each process Each
be a domain can be a procedure can
domain be a domain

Baljit Singh Saini (www.dextutor.com)

Access Matrix

• View protection as a
matrix (access matrix)
• Rows represent domains
• Columns represent
objects
• Access(i, j) is the set of
operations that a
process executing in
Domaini can invoke on
Objectj

Baljit Singh Saini (www.dextutor.com)

Access
matrix with
domains as
objects
• Process from one
domain can switch
to another domain

Baljit Singh Saini (www.dextutor.com)

 Access matrix with copy rights

A copy right allows the access right

to be copied only within the column.

Denoted by *

A process executing in domain D2 can

copy the read operation into any entry
associated with file F2.

Baljit Singh Saini (www.dextutor.com)

Access matrix with owner
rights

Owner right – permission to

add new rights or remove
some rights

If access(I,j) includes the

owner right, then a a process
executing in domain Di can
add and remove any right in
any entry in column j.

Baljit Singh Saini (www.dextutor.com)

Access matrix with control right

Baljit Singh Saini (www.dextutor.com)

 Worms
System
and
Network Port scanning
threats
Denial of
service
Baljit Singh Saini (www.dextutor.com)
 Passwords

• Password vulnerabilities
User
authenticati One time passwords
on

Biometrics

Baljit Singh Saini (www.dextutor.com)

References

• Silberschatz, Abraham, et al. Operating system concepts.

Edition-8. Reading: Addison-Wesley

Baljit Singh Saini (www.dextutor.com)