Documente Academic
Documente Profesional
Documente Cultură
3. Karger, 2LT Paul A. and Schell, Maj. Roger R., Multics Security
Evaluation, Vulnerability Analysis, Electronic System Division, ESD-TR-74-193,
June 1974.
9. Sippl, Charles J., Computer Dictionary, Howard W. Sams & Co., Inc.
Fourth Edition, 1985.
Page 21
and disposal.
Trap Door
Trojan Horse
Page 20
GLOSSARY
Check Sum
A check in which groups of digits are summed, usually without regard for
overflow, and that sum checked against a previously computed sum to
verify that no digits have been changed since the last summation. [9]
Configuration Item
Configuration Management
Encryption
Fiber-Optic Latches
System Life-Cycle
Page 19
updates, could result in a compromise of the system's security policy. Trusted
distribution is a part of the life-cycle assurance required for trusted
systems that ensures that the security policy of a trusted system remains
intact throughout the life cycle of the system. Trusted distribution
provides assurance that the TCB components will not be altered during their
distribution from a vendor to a customer site. Generically, this process of
end-to-end control can be broken down into three stages: post-production,
transit, and delivery. Along with configuration management and the other
assurance requirements of the TCSEC, assurance is provided that no violation
of a system's security policy can occur.
Page 18
5. SAMPLE IMPLEMENTATION
Upon arrival of the system at the purchaser's site, the success of the
protective packaging methods provided by the vendor should be validated. It
is, however, the vendor's responsibility to provide either the documentation
or the manpower to assist the purchaser in determining if the methods used
were successful. Additionally, it is the purchaser's responsibility to
provide configuration management for the system throughout the remaining
life cycle of the system.
Page 17
assurance that the transmission has not been altered.
4.6.2 Inventory
Page 16
provides a second layer of assurance for trusted distribution. In the event
that any of the TCB components were altered during distribution, site
validation procedures should detect the alteration before the system is
installed and any compromise of security policy can take place.
It should be noted that there are ways to improve this approach. The
checksum program should not be distributed with the TCB software. Trusted
distribution implementing checksums should consist of sending one package
containing the checksum generation program and checksum result and another
package containing the TCB software. Both packages should be protected by
appropriate means of trusted distribution such as courier or registered mail.
Anyone having access to both the checksum generator and the TCB software could
retrieve the output from the checksum program through a print command and
alter the system so that the change would go unnoticed by saving the
original checksum value, modifying the system, and running the checksum
program until it matches the original checksum, adding modules to
inconsequential areas of the system when necessary. It may take some time to
get the checksum of the modified software to equal the original checksum,
but with a 16-bit or smaller checksum it may be a practical method for
modifying TCB software.
Page 15
the use of envelopes for wrapping, the contents should be protected from
direct contact with the inner container by a cover sheet or by folding
inward.
If the codes are not the same, this is an indication that the code being
transmitted has been tampered with. The length of the appended code can vary,
but the strength of the process is directly related to the length of the code.
As with all encryption-based processes, the management and protection of the
key ancinor algorithm is a critical factor that shall be addressed in the
design documentation.
4.5 Encryption
Page 14
the material may be delivered. A partial list of guidelines for the use of
courier service is provided below.
Page 13
package cannot be entered without triggering the alarm.
Other forms of locking devices and seals, such as a high impact security
lock or company registered seals, can also be applied before shipment and
verified prior to opening. The different sealing devices used provide
different degrees of assurance and should be selected based on the needs of
the item being distributed.
4.2 Couriers
There are several commercial firms that can supply bonded services, or
manufacturers may use their own internal courier service, if available. Within
the military, the Defense Courier Service (DCS), formerly known as the Armed
Forces Courier Service (ARFCOS), is an alternative.
Page 12
4.1 Protective Packaging
When heat is applied to the plastic film in shrink wrapping, the film
contracts, or shrinks, forming a tight seal around the product. If the shrink-
wrapped seal is broken, this is an indication that the product being shipped
has been tampered with. Not only is shrink wrapping used for the trusted
distribution of TCB components, but many industries including the food and
drug industry use shrink wrapping to provide consumer protection that products
have not been tampered with. Additional special shrink-wrap techniques are
available that may increase the reliability of the shrink wrap.
Page 11
layered approach will counter the insider threat or the threat of collusion
where employees themselves alter the contents of a package before it is
distributed. Each situation that requires trusted distribution is unique and
requires that the system be addressed individually.
There are other requirements in the TCSEC which are related to trusted
distribution, namely those concerning configuration management. A vendor
should be sure that the system sitting on the loading dock is the system
that the vendor thinks it is. At TCSEC class Al, the configuration
management system shall include, "a combination of technical, physical, and
procedural safeguards" to be "used to protect from unauthorized modification
or destruction the master copy or copies of all materials used to generate the
TCB."[7] All of the implementation methods that follow are contingent upon
prior performance of configuration management, ensuring that the system has
not been maliciously altered before being distributed.
Page 10
and physical controls must be placed on the system(s) both during the delivery
to and stay in the warehouse to ensure that no unauthorized modifications
are made. For example, controls must exist which log any entry into the
warehouse, authorizations for the alteration of any system or range of
serial numbers within the warehouse must be properly documented, etc."[6]
4. IMPLEMENTATION METHODS
Page 9
"take place in an identifiable and controlled environment and that they do not
adversely affect the implementation of the security policy of the TCB."[4]
More information on configuration management can be found in A Guide to
Understanding Configuration Management in Trusted Systems (NCSC-TG-006).
Once the system has been built, security testing shall be performed to
ensure that the system works exactly as claimed in the system documentation.
The security testing shall demonstrate that the TCB implementation is
consistent with the FTLS.
The manner in which the TCB components are handled prior to distribution
will have an impact on the trusted distribution process. The following is a
recommendation for how a vendor may provide assurance before the components
are actually shipped. "There are basically two types of production that
companies employ: mass production, and production per request basis. In either
case, there will probably be idle time where the system(s) will be waiting for
delivery probably in some type of warehouse. Strict accounting procedures
Page 8
The main purpose of trusted distribution is to protect a trusted
system as it is being distributed, and consequently to provide protection
for the information that will be processed on the system. Trusted distribution
provides assurance that a trusted system arrives at a customer site with all
of its security properties intact and that the system or update that is
received at the customer site is the, "same system or update which was
produced from the master copy of the system evaluated against the
TCSEC."[6] Any tampering with the TCB software, firmware, hardware, whether
originals or updates, from the time they leave the vendor site to the time
they arrive at the customer site may permit the security policy of the
system to be circumvented.
- Assurance that the product evaluated is the one the manufacturer built
- Assurance that the product built is the one that was sent
- Assurance that the product sent is the one the customer site received.
Page 7
There are basically two threats that trusted distribution protects
against. The first is the threat of someone tampering with a system during its
movement from a vendor site to a customer site. Throughout this document the
term "vendor site" will be used to mean the point from which the TCB hardware,
software, and firmware to be distributed are sent. The term "customer site" is
the point at which the distributed material is accepted. Specifically, any
system component that participates in the enforcement of the security policy
of the system is what needs to be protected. For example, someone may break
into a delivery truck and insert malicious code into a trusted system before
it reaches the customer site. The system or update being delivered, when
installed at the site, will contain the harmful code that could cause
compromise of the system's security policy. Trusted distribution may include
protective packaging methods that protect against changes being made to a
system (see Section 4.1 Protective Packaging). Trusted distribution may also
include methods of detecting if a system and/or its updates have been
accidentally or maliciously altered during or after distribution through
validation tests (see Section 4.7 Site Validation).
Hostile attacks may occur on computer systems when they are in use,
but it is also possible for computer systems to be attacked even before they
are installed at a customer site. The TCSEC requires that assurance mechanisms
be in place throughout the life cycle of a system to prevent modifications
being made to the TCB which could adversely affect the security policy of a
system. One such assurance requirement for class Al systems is trusted
distribution. Trusted distribution maintains the integrity of the current
TCB software, firmware, and hardware as well as any updates to these by
ensuring that any changes made to the TCB during the distribution process do
not go unnoticed.
Page 6
"Systems that are used to process or handle classified or other
sensitive information must be designed to guarantee correct and accurate
interpretation of the security policy and must not distort the intent of
that policy. Assurance must be provided that correct implementation and
operation of the policy exists throughout the system's life cycle."[7]
Any alteration to the TCB at any time during the system life cycle could
result in a violation of the system security policy. Assurance that the system
security policy is correctly implemented and operational throughout the system
life cycle is provided by different TCSEC requirements. At TCSEC class Al,
trusted distribution, in conjunction with configuration management, provides
assurance that the TCB software, firmware, and hardware, both original and
updates, are received by a customer site exactly as specified by the
vendor's master copy. Trusted distribution also ensures that TCB copies sent
from other than legitimate parties are detected.
2.1 Threats
The features and assurances in lower class systems protect against the
threat that someone will tamper with a system while it is in operation, but it
is at TCSEC class Al that the threat of subversion is addressed. Computer
subversion is the name generally applied to deliberate, malicious modification
of executable code or hardware within a computer system. The subversion can be
accomplished at any time during the system's life from the earliest stages
of design to the last day of its use. A component can be subverted either to
permit later penetration or as an act of sabotage -- to nullify or to
degrade the system's capability. Forms of subversion include the trap door,
the Trojan horse, and computer viruses. The threat of subversion exists at all
classes; however, the benefit of providing assurance features to guard against
it in lower class systems may not justify the cost of this type of protection.
Page 5
1. Introduction
1.1 Purpose
1.2 Scope
Page 4
CONTENTS
FOREWORD.................................................................i
ACKNOWLEDGMENTS ii
1. INTRODUCTION 1
1.1 PURPOSE 1
1.2 SCOPE 2
1.3 CONTROL OBJECTIVE 2
4. IMPLEMENTATION METHODS 11
4.1 PROTECTIVE PACKAGING 12
4.1.1 Shrink Wrapping 13
4.1.2 Active Systems 14
4.1.3 Tamper-Resistant Seals 14
4.2 COURIERS 15
4.3 REGISTERED MAIL 16
4.4 MESSAGE AUTHENTICATION CODES 17
4.5 ENCRYPTION 18
4.6 SITE VALIDATION 18
4.6.1 Checksum Programs 19
4.6.2 Inventory 20
4.6.3 Engineering Inspection 21
5. SAMPLE IMPLEMENTATION 23
5.1 TRUSTED DISTRIBUTION OF HARDWARE, FIRMWARE, AND
SOFTWARE 23
5.2 TRUSTED DISTRIBUTION OF DOCUMENTATION 23
GLOSSARY 27
REFERENCES 31
Page 3
ACKNOWLEDGMENTS
Page 2
NCSC-TG-008
Library No. S-228,592
FOREWORD
Page 1