Infrastructure Resilience against Attacks and Faults
1 like567 views
The document discusses infrastructure resilience against attacks and faults. It summarizes work on making authentication and authorization systems in software-defined networks fault tolerant using Byzantine fault tolerance (BFT) tools and techniques like diversity. Prototypes were developed for OpenID single sign-on and RADIUS protocols. Evaluations showed the systems can tolerate faults and attacks with some performance overhead. Ongoing work includes linking the tools to reference architectures and developing cloud security services.
Infrastructure Resilience against Attacks and Faults
- 1. WP5 ?¨C ?INFRASTRUCTURE ?RESILIENCE ? AGAINST ?ATTACKS ?AND ?FAULTS ? Diego ?Kreutz ?(FFCUL) ? ? (joint ?work: ?FFCUL, ?TUM, ?UFAM ?and ?UFSC) ? ? SECFUNET ?Final ?Meeting ? Brussels, ?11th ?June ?2014 ? SECFUNET ¨C Security for Future Networks? FP7-ICT-2011-EU-Brazil ¨C STREP number 288349"
- 2. Objectives ?(1/2) ? ! 2! Network Access Service! Network Operating System Management Applications Network! ControlPlane! Network Data Plane! FITS uses: ¡ì?? RADIUS for VMs AA ¡ì?? OpenID for user AA ¡ì?? OpenFlow controller
- 3. Objectives ?(2/2) ? ! 3! Virtual Network 2! Virtual Network 3! Physical Infrastructure! Virtual Network 1! VerticalandHorizontal! Control,Managementand! MonitoringSystems! Assure& Monitor& Con?g& Assure& Monitor& Con?g&
- 4. State ?of ?A?airs ?(OpenID ?& ?RADIUS) ? (current ?scenario ?and ?our ?goal) ? ! 4! Fault ?tolerance ? Level ?of ?trust ? C1 ? C2 ? C3 ? C4 ? C6 ? C5 ?
- 5. Use ?cases: ?OpenID ?& ?RADIUS ? ! 5!
- 6. Functional ?Model ? ??? Service-?©\oriented ?architecture ?of ?components ? ! 6! Client / Secure Component! AAI Replicas! (mfR + 1)! Service / Application / Device! (fS + 1)! Gateway! (AAI front-end)! (fG + 1)! AAI Secure ! Components (mfR + 1)! Alternative Path! Default Path! AAI Resilient Infra!
- 7. Functional ?Model ? ??? Fault ?detection ?mechanisms ? ! 7! ClientCw! Back-end! ServiceBz! Target ServiceIx! Service GatewayGy! Timeout A! Timeout B! Corrupted response ! from replica Tx! Corrupted response ! from replica Gy! Byzantine behavior! from replica Bz! Timeout C (e.g., OpenID)!
- 8. Towards ?Intrusion ?Tolerance ? 1.? BFT ?tools/protocols ? ¨C? BFT-?©\SMaRt ?(FCUL) ? ¨C? IT-?©\VM ?(UFSC) ? 2.? Additional ?mechanisms: ? ¨C? Diversity ? ¨C? Proactive-?©\reactive ?recovery ? 3.? Con?dentiality: ?a ?limitation ?of ?BFT ?systems ? ¨C? Speci?c ?components ?are ?required ?to ?ensure ? this ?property ? ! 8!
- 9. Diversity ?in ?the ?OpenID ?prototype ? ! 9! VM1! Gateway 1! VM1! OpenID BFT R1! VM2! Gateway 2! Pair-wised TCP/IP Communications! VMn! Gateway N!¡" Hypervisor! ! Secure Element! V"V"V" Reliable Communication Channels! VM2! OpenID BFT R1! Hypervisor! ! Secure Element! VM3! OpenID BFT R1! Hypervisor! ! Secure Element! VM4! OpenID BFT R1! Hypervisor! ! Secure Element!
- 10. A ?Trusted ?Component ?for ?RADIUS ?& ?OpenID ? ! 10! TC# PuCA# KNAS# PrS# KUser# ID# USER Table! ! <ID1> <¡, Perm>MAC! <ID2> <¡, Perm>MAC! <ID3> <¡, Perm>MAC! <ID4> <¡, Perm>MAC! ¡! <IDn> <¡, Perm>MAC! DATA Table (NAS | Association)! ! <NAS1 | Handler1> <¡, EK1>! <NAS2 | Handler2> <¡, EK2>! <NAS3 | Handler3> <¡, EK3>! <NAS4 | Handler4> <¡, EK4>! ¡! <NASn | Handlern> <¡, EKn>! TLS# EAP# RADIUS# Required methods:! 1.? HMAC! 2.? VerifySignRSA! 3.? SymmCipher! 4.? GenConfidential! 5.? SignRSA! 6.? GenAssocia;on# 7.? GenNonce# BFT?SMaRT# Authentication Service Replica! KAssoc# OpenID# HTTP/HTTPS#
- 11. Trusted ?Components ? ! 11! A trusted/secure component can be ¡°any¡± device capable of ensuring ! the data and operation con?dentiality of the target system/environment.! Smart Cards! Tamper Resistant a FPGA! A Shielded! Computer! Virtual TPM! (e.g. vTPM)! Secure Hypervisor (e.g. sHyper)! Intel TXT & GSX AMD SVM, ¡!
- 13. OpenID: ?performance ? ! 13! Average Latency: 78.360ms! Average Latency: 87.343ms! Average Latency: 32.103ms!
- 14. OpenID: ?the ?impact ?of ?faults ?& ?attacks ? ! 14! Type of execution/fault/attack 20 clients 40 clients Fault-free execution 867.73 984.59 Constantly crashing OpenID reps 1009.86 1145.98 Attacking OpenID replicas (DoS) 956.46 1005.54 Constantly crashing OpenID gws 633.44 718.75
- 15. ! 15! Remarks ? (prototypes ?& ?evaluations ?& ?proposals) ? VirtualMachineMonitor! Agreement Service! Authentication Server! Share Memory! VM1! IdP Proxy! VM2! IdP Proxy! API! Trusted Computing ! Base (TCB)! R-?©\OpenID-?©\PR ? R-?©\OpenID-?©\VR ?R-?©\RADIUS ? Resilient ? Mon ?Infra ? Fault-?©\tolerant ? OF-?©\C ? RT ? Kerberos ?v5 ?
- 16. ! 16! Remarks ? (linking ?our ?tools ?to ?the ?FITS ?arch) ? End user Physical Network Virtual Network
- 17. ! 17! Remarks ?(on-?©\going/future ?work) ? Cloud-?©\of-?©\Clouds ?Security ?Services ?(e.g., ?IdPaaS) ?
- 18. ! 18! Remarks ?(on-?©\going/future ?work) ? Cloud-?©\of-?©\Clouds ?Security ?Services ?(e.g., ?IdPaaS) ?
- 19. ! 19! Di?usion ? 0! 2! 4! 6! 8! 10! CORE A*! CORE A! CORE B! OTHER! Numberofpubs/work! Venue Rank! 4 2 7 9
- 20. 0! 5! 10! 15! 20! 25! 30! 35! 40! Presential! Online! Tech/Other! Numberofmeetings! Type of meeting! 6 34 ~30 ! 20! Meetings, ?on-?©\demand ?tech ?mini-?©\confs, ?etc. ? (challenge: ?technology ?transfer ?& ?tech ?sync) ?