【正文】 HPUX Security Whitepaper By Mike Jerbic phone: 4084476299 Version May 20xx ??? HPUX Security White Paper 2 Overview This document describes the securityrelated features and benefits of the HPUX core operating system. Releases described in this document include HPUX , , , and . The special, highsecurity OS releases such as , , , and the Virtual Vault operating systems are not described here. This document is anized as follows: Section 1 contains the overall purpose and anization of this paper. Section 2 contains OS security concepts that define the terms used and scope of Operating System Security. Section 3 contains a description of available security features in the two modes (Standard and Trusted), how security is managed through ServiceControl Manager, SAM, NIS, and NIS+. At the end of the section is a table of HPUX features and their associated customer benefits Section 4 is a summary of security features available by release (, …) Section 5 provides additional reference information for further study. Appendix A provides the specifications and availability of the CDSA Cryptography. Appendix B discusses the risks of viruses on HPUX systems. Security Programs Not Covered in This Document Hewlett Packard has numerous activities in security outside of core operating systems. Some of these include: Praesidium, the HP program and brand name for security infrastructure middleware. Information on these products can be found in: HPUX addon products that are available on the HPUX Application Release CD. Some specific security products that are beyond the scope of this paper include: ? IPSEC / VPN ? Kerberos ? LDAP ? CIFS/9000 ? Intrusion Detection ? Java HPUX Security White Paper 3 Table of Contents OVERVIEW ..............................................................................................................2 Security Programs Not Covered in This Document ................................................................................................... 2 OS SECURITY CONCEPTS ......................................................................................6 Identification and Authentication .................................................................................................................................. 6 Authorization ...................................................................................................................................................................... 6 Access Control.................................................................................................................................................................... 6 Audit / Accountability ....................................................................................................................................................... 6 Object Reuse ....................................................................................................................................................................... 7 Intrusion Resistance.......................................................................................................................................................... 7 Assurance ............................................................................................................................................................................. 7 US Government Security Specifications and Levels .................................................................................................. 7 European Security Specifications and Levels .............................................................................................................. 8 Extensions to Security Specifications ........................................................................................................................... 8 HPUX OPERATING SYSTEM SECURITY FUNCTIONALITY..............................9 Two Modes of Security in HPUX .................................................................................................................................. 9 Standard HPUX Security ................................................................................................................................................ 9 Identification and Authentication.................................................................................................................................... 9 Authorization .................................................................................................................................................................. 10 Access Control ............................................................................................................................................................... 10 Audit / Accountability .................................................................................................................................................... 10 Object Reuse .................................................................................................................................................................. 11 Intrusion Resistance....................................................................................................................................................... 11 Assurance ........................................................................................................................................................................ 11 Security Criteria Compliance ....................................................................................................................................... 11