TY - GEN
T1 - Protection of components based on a smart-card enhanced security module
AU - García-Alfaro, Joaquín
AU - Castillo, Sergio
AU - Castellà-Roca, Jordi
AU - Navarro, Guillermo
AU - Borrell, Joan
PY - 2006/12/1
Y1 - 2006/12/1
N2 - We present in this paper the use of a security mechanism to handle the protection of network security components, such as Firewalls and Intrusion Detection Systems. Our approach consists of a kernel-based access control method which intercepts and cancels forbidden system calls launched by a potential remote attacker. This way, even if the attacker gains administration permissions, she will not achieve her purpose. To solve the administration constraints of our approach, we use a smart-card based authentication mechanism for ensuring the administrator's identity. Through the use of a cryptographic protocol, the protection mechanism verifies administrator's actions before holding her the indispensable privileges to manipulate a component. Otherwise, the access control enforcement will come to its normal operation. We also show in this paper an overview of the implementation of this mechanism on a research prototype, developed for GNU/Linux systems, over the Linux Security Modules (LSM) framework.
AB - We present in this paper the use of a security mechanism to handle the protection of network security components, such as Firewalls and Intrusion Detection Systems. Our approach consists of a kernel-based access control method which intercepts and cancels forbidden system calls launched by a potential remote attacker. This way, even if the attacker gains administration permissions, she will not achieve her purpose. To solve the administration constraints of our approach, we use a smart-card based authentication mechanism for ensuring the administrator's identity. Through the use of a cryptographic protocol, the protection mechanism verifies administrator's actions before holding her the indispensable privileges to manipulate a component. Otherwise, the access control enforcement will come to its normal operation. We also show in this paper an overview of the implementation of this mechanism on a research prototype, developed for GNU/Linux systems, over the Linux Security Modules (LSM) framework.
UR - https://www.scopus.com/pages/publications/84885705762
U2 - 10.1007/11962977_11
DO - 10.1007/11962977_11
M3 - Conference contribution
AN - SCOPUS:84885705762
SN - 3540690832
SN - 9783540690832
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 128
EP - 139
BT - Critical Information Infrastructures Security - First International Workshop, CRITIS 2006, Revised Papers
T2 - 1st International Workshop on Critical Information Infrastructures Security, CRITIS 2006
Y2 - 31 August 2006 through 1 September 2006
ER -