text: We present a taxonomy and an algebra for attack patterns on component-based operating systems. In a multilevel security scenario, where isolation of partitions containing data at different security classifications is the primary security goal and security breaches are mainly defined as undesired disclosure or modification of classified data, strict control of information flows is the ultimate goal. In order to prevent undesired information flows, we provide a classification of information flow types in a component-based operating system and, by this, possible patterns to attack the system. The systematic consideration of informations flows reveals a specific type of operating system covert channel, the covert physical channel, which connects two former isolated partitions by emitting physical signals into the computer's environment and receiving them at another interface.
  @cite_35: Covert channels have traditionally been categorized as either storage channels or timing channels. The author questions this categorization, and discusses channels that cannot be clearly identified as either storage or timing channels, but have aspects of both. A new model of timing channels is presented, which allows for channels that have characteristics of both storage channels and timing channels, and a method is given for constructing all channels in a computer system that have timing channel characteristics. Since R.A. Kemmerer's (1982) shared resource matrix methodology has the potential to detect all channels that have storage characteristics, the two methods jointly have the capability to construct all channels in a computer system. The approach to timing channels provides a justification of specific mechanisms for reducing their bandwidth which were employed in the VAX Virtual Machine Monitor. >
  @cite_14: 
  @cite_36: Operating systems and their security are the foundation to underlay and assure the security of information systems. While effective analysis and processing mechanism for covert channels inside operating systems is one of the bottleneck issues to build up operating systems of high security levels. In this paper, some methods for identification of covert channels such as syntactic information flow method, semantic information flow method, shared resources matrix method and covert flow tree method are studied at first. Then a prototype is designed and implemented to identify covert channels inside Linux kernel based on source codes by the way of integrating above methods together. The prototype is tested on the source codes of Linux kernel 2.4.18, potential covert channels are identified and analyzed from the view of application scene so that some actual covert channels are distilled and it is verified about the validity of the prototype and the related method. Finally, research work in this paper is summarized and further research directions in future are pointed out.
  @cite_16: onfining a program during its execution so that it cannot transmit information to any other program except its caller. A set of examples attempts to stake out the boundaries of the problem. Necessary conditions for a solution are stated and informally justified.
  @cite_13: Recognizing and dealing with storage and timing channels when performing the security analysis of a computer system is an elusive task. Methods for discovering and dealing with these channels have mostly been informal, and formal methods have been restricted to a particular specification language. A methodology for discovering storage and timing channels that can be used through all phases of the software life cycle to increase confidence that all channels have been identified is presented. The methodology is presented and applied to an example system having three different descriptions: English, formal specification, and high-order language implementation.
summary: Lampson @cite_16 introduces covert channels in 1973, which are defined as communication channels not intended for information transfer at all''. Both covert storage channels and covert timing channels have been described by the National Computer Security Center @cite_14 in 1993. Wray @cite_35 presents a study on covert channel terminology where he questions the differentiation between covert storage channels and covert timing channels and concludes that storage nature and timing nature are attributes of the channel, and a given channel may possess either or both.'' A covert channel of this combined type could be identified as both a covert storage channel and a covert timing channel in our taxonomy. In a different approach, @cite_36 present a study on automatic identification of covert channels in Linux. Kemmerer @cite_13 introduced the shared resource matrix that describes a methodology to systematically identify covert storage channels in a computing system. In contrast to the work of Kemmerer, our methodology is not targeted at covert channel identification, but aims to provide a complete information flow analysis in the model of a component-based operating system where different types of attack patterns are identified and described.