Secure Virtual Drive-Final year projects for cse

Project Statement To reinforce the discretionary access control mechanism on Windows 2000 through the creation of secure Virtual Drives.

Motivation and Objectives Windows 2000 has two forms of access control over objects. The first form—discretionary access control—is the protection mechanism that most people think of when they think of protection under Windows 2000. It’s the method by which owners of objects (such as files or printers) grant or deny access to others. When users log in, they are given a set of security credentials, or a security context. When they attempt to access objects, their security context is compared to the access control list on the object they are trying to access to determine whether they have permission to perform the requested operation.

Privileged access control is necessary for those times when discretionary access control isn’t enough. It’s a method of ensuring that someone can get to protected objects if the owner isn’t available. For example, if an employee leaves a company, the administrator needs a way to gain access to files that might have been accessible only to that employee. In that case, under Windows 2000, the administrator can take ownership of the file so that you can manage its rights as necessary.

With a privileged access control over objects, a user with administrative privileges can tamper with the files of other users, make changes in them or even delete them. There are situations where this privileged access of a user over objects is not only undesirable but can also cause heavy damage to the organization (consider a user modifying a tender document). An organization prefers to rely on the system than trusting those with administrative privileges.

We are trying to reinforce the discretionary access in WINDOWS 2000, which enables a user to protect his/her data from being tampered by users with privileged access to the system. Our project is driven by the concept of polyinstantiation of common resources leading to strong separation of users.

The easiest solution that comes to the mind is to provide the user with encryption software. Whatever documents the user wants to protect he simply encrypts it. Even the administrator cannot decrypt this document.

But if one looks carefully at the issue one finds that the administrator can still corrupt or delete the user’s data. Also the existence of the data can be known. Then also if we look from the point of view of the user’s convenience he has to explicitly specify which files need to be encrypted.

Our aim is to provide the user with a convenient mechanism to protect his data. We are providing every user his/her own secure virtual disk drive inaccessible and invisible to every other user, even the system administrator. The secure virtual drive is like a safe or a vault, what is inside it is known and accessible only to the owner.

• Win-2000 Operating System
• Driver Development Kit(DDK)
• Softice Debugger
• OSR Loader
• DBGView