The introduction of Java applets has taken the World Wide Web by storm. Information servers can customize the presentation of their content with server-supplied code which executes inside the Web browser. We examine the Java language and both the HotJava and Netscape browsers which support it, and find a significant number of flaws which compromise their security. These flaws arise for several reasons, including implementation errors, unintended interactions between browser features, differences between the Java language and bytecode semantics, and weaknesses in the design of the language and the bytecode format. On a deeper level, these flaws arise because of weaknesses in the design methodology used in creating Java and the browsers. In addition to the flaws, we discuss the underlying tension between the openness desired by Web application writers and the security needs of their users, and we suggest how both might be accommodated.

/pdf/java-security-from-hotjava-to-netscape-and-beyond-17b9nz6d6h.pdf

Java security: from HotJava to Netscape and beyond

Nowadays, there is a trend to design complex, yet secure systems. In this context, the Trusted Execution Environment (TEE) was designed to enrich the previously defined trusted platforms. TEE is commonly known as an isolated processing environment in which applications can be securely executed irrespective of the rest of the system. However, TEE still lacks a precise definition as well as representative building blocks that systematize its design. Existing definitions of TEE are largely inconsistent and unspecific, which leads to confusion in the use of the term and its differentiation from related concepts, such as secure execution environment (SEE). In this paper, we propose a precise definition of TEE and analyze its core properties. Furthermore, we discuss important concepts related to TEE, such as trust and formal verification. We give a short survey on the existing academic and industrial ARM TrustZone-based TEE, and compare them using our proposed definition. Finally, we discuss some known attacks on deployed TEE as well as its wide use to guarantee security in diverse applications.

https://hal.archives-ouvertes.fr/hal-01246364/document

Trusted Execution Environment: What It is, and What It is Not

machines, 178, 179 Abstract model, 30, 31–32, 105–30. See also Security models Access class, 52, 112 dominates relationship between, 53, 122, 183-84 partial ordering of, 53, 122 SYSTEM HIGH/SYSTEM LOW, 123, 148 Access control, 22–23, 45–46. See also Multilevel security discretionary, 45, 47–50 input/output, 96–102 limiting Trojan horses with, 63–64 mandatory, 45, 50–51 with memory management, 83–86 network, 213–15 Access control list (ACL), 49–50 Access list, 48 Access matrix model, 109, 110 Bell and La Padula model, 123 ACF2 (software), 9 ACL. See Access control list (ACL) Address. See Virtual address space Adleman, L., 202 AFFIRM, 167, 168 Akers, R. L., 167 Algebraic specifications, 168 Algorithmic refinement, 178–81 Ames, S. R., Jr., 28, 131 Anderson, J. P., 131 Application mode, 27 Applications programs, 25, 26 Argument validation, 153 Arpanet Reference Model, 196 Ashland, R. E., 9, 51 Assertions, entry and exit, 190–92 Assurance, security control, 31 Asynchronous attack, 153–54 Atomic functions, 115 Authentication. See also Password(s) vs. identification, 18–19, 45–46 provided by encryption, 208 Authentication server, 221 Authorization, 22 Authorization server, 221

Building a Secure Computer System

A practical technique for delegation is described. It provides both cryptographic assurance that a delegation was authorized and authentication of the delegated systems, thereby allowing reliable access control as well as precise auditing of the systems involved in every access. It goes further than other approaches for delegation in that it also provides termination of a delegation on demand (as when the user logs out) with the assurance that the delegated systems, if subsequently compromised, cannot continue to act on the user's behalf. Delegation and revocation are provided by a simple mechanism that does not rely on online trusted servers. >

https://sce.uhcl.edu/yang/teaching/csci5233fall02/DistributedAuthenticationGasser1990.pdf

An architecture for practical delegation in a distributed system

The Digital Distributed System Security Architecture is a comprehensive speci cation for security in a distributed system that employs state-of-the-art concepts to address the needs of both commercial and government environments. The architecture covers user and system authentication, mandatory and discretionary security, secure initialization and loading, and delegation in a general-purpose computing environment of heterogeneous systems where there are no central authorities, no global trust, and no central controls. The architecture prescribes a framework for all applications and operating systems currently available or to be developed. Because the distributed system is an open OSI environment, where functional interoperability only requires compliance with selected protocols needed by a given application, the architecture must be designed to securely support systems that do not implement or use any of the security services, while providing extensive additional security capabilities for those systems that choose to implement the architecture.

/pdf/the-digital-distributed-system-security-architecture-4r0ghgguuk.pdf

The Digital Distributed System Security Architecture

Providing highly reliable protection for computerized information has traditionally been a game of wits. No sooner are security controls introduced into systems than are penetrators finding ways to circumvent them. Security kernel technology provides a conceptual base on which to build secure computer systems, thereby replacing this game of wits with a methodical design process. The kernel approach is equally applicable to all types of systems, from general-purpose, multiuser operating systems to special-purpose systems such as communication processors-wherever the protection of shared information is a concern. Most computer installations rely solely on a physical security perimeter, protecting the computer and its users by guards, dogs, and fences. Communications between the computer and remote devices may be encrypted to geographically extend the security perimeter, but if only physical security is used, all users can potentially access all information in the computer system. Consequently, all users must be trusted to the same degree. When the system contains sensitive information that only certain users should access, we must introduce some additional protection mechanisms. One solution is to give each class of users a separate machine. This solution is becoming increasingly less costly because of declining hardware prices, but it does not address the controlled sharing of information among users. Sharing information within a single computer requires internal controls to isolate sensitive information. Continual efforts are being made to develop reliable internal security controls solely through tenacity and hard work. Unfortunately, these attempts have been uniformly unsuccessful for a number of reasons. The first is that the operating system and utility software are typically large and complex. The second is that no one has precisely defined the security provided by the internal controls. Finally, little has been done to ensure the cor-rectness of the security controls that have been implemented. The security kernel approach described here directly addresses the size and complexity problem by limiting the protection mechanism to a small portion of the system. The second and third problems are addressed by clearly defining a security policy and then following a rigorous methodology that includes developing a mathematical model, constructing a precise specification of behavior, and coding in a high-level language. The security kernel approach is based on the concept of the reference monitor, an abstract notion adapted from the models of Butler Lampson.I The reference monitor provides an underlying security theory for conceptualizing the idea of protection. In a reference monitor, all …

Schell

Papers

Security Kernel Design and Implementation: An Introduction