Secure Sharing of an ICT Infrastructure Through Vinci

Transcription

1 Secure Sharing of an ICT Infrastructure Through Vinci Fabrizio Baiardi 1 Daniele Sgandurra 2 1 Polo G. Marconi - La Spezia, University of Pisa, Italy 2 Department of Computer Science, University of Pisa, Italy AIMS /32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

2 Outline 1 Secure Sharing of ICT Infrastructures Assumptions 2 3 Results and Future Works 2/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

3 Secure Sharing of ICT Infrastructures Assumptions Users and Applications Private ICT infrastructure: Bank, Hospital, Scada. Secure file sharing among users with distinct requirements. Several classes of users: users may belong to several classes; distinct security policies and reliability requirements; control shared data among users. Applications have different trust level: browser; home banking. 3/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

4 Example Secure Sharing of ICT Infrastructures Assumptions Hospital infrastructure: Communities (classes of users): doctors; nurses; administration. Each community manages its private information but also share some information with other communities. Each community should be able to: define its security policy; define its reliability requirements; control information to be shared. 4/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

5 Secure Sharing of ICT Infrastructures Assumptions Assumptions The infrastructure is a private network that: spans several locations; is centrally managed by a set of administrators. Most of the nodes are PC accessed by one person at time. Some server nodes to store shared data and execute server apps. Each node runs a virtual machine monitor (VMM). 5/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

6 Virtualization Technology Virtual Interacting Network CommunIty (Vinci) is a software architecture aimed at sharing an ICT infrastructure securely. Vinci exploits virtualization technology: Software emulation of HW: virtual machines (VMs). Benefits: 1 confinement among the VMs; 2 server consolidation: better resource utilization; 3 centralized management: easier administration. Widespread usage. 6/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

7 Virtualization Technology 7/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

8 Vinci defines many highly specialized and simple VM templates: each VM template implements different functionalities; dynamically instantiated; connected into overlays (network of VMs). Software customization. Minimization of complexity. More robustness. 8/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

9 9/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

10 9/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

11 9/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

12 9/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

13 9/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

14 Advantages: Easy-to-deploy virtual appliances. Minimize the software each VM runs. Run-time environment is highly customized, according to user and community of interest: amount of allocated memory; OS version; running kernel modules; applications and their configuration. 10/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

15 Currently, Vinci defines 6 VM templates: 1 Application VM: it runs a set of applications on behalf of a single user; 2 Community VM: it manages the private resources of a community; 3 File System VM: it belongs to several overlays and protects information shared among distinct communities; 11/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

16 4 Communication and Control VM: it implements and monitors flows among VMs of the same or distinct communities; 5 Assurance VM: it checks that Application VMs only run authorized software; 6 Infrastructure VM: these VMs manage the overall infrastructure. 12/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

17 Application VMs Run applications of a single user. Labeled with a global level of the community the user joins. A user can join distinct communities through distinct APP VMs. 13/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

18 Community VMs Manage and control private community resources: configuration files, system binaries, shared libraries; user home directories. MAC/DAC policies. 14/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

19 File System VMs Export shared file systems. They belong to several communities. Implement MAC/MLS policies to control file sharing. Tainting module to trace contamination. 15/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

20 Tainting Module 16/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

21 Tainting Module 16/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

22 Tainting Module 16/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

23 Tainting Module 16/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

24 Communication and Control VMs Protect and monitor information flows. 1 Firewall VMs; 2 VPN VMs; 3 IDS VMs. Communities can be isolated. Anti-spoofing to authenticate file requests. 17/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

25 Assurance VMs Protect integrity of critical VMs. They exploit virtual machine introspection. The Assurance VM can freeze the execution of a VM. 18/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

26 Virtual Machine Introspection Virtual Machine Introspection: Standford University. visibility: access a VM s state from a lower level; robustness: consistency checks applied from a distinct VM. 19/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

27 Infrastructure VMs 20/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

28 Infrastructure VMs They can: Configure and manage the overlays. Cooperate to monitor the overall infrastructure. Update the topology of the virtual overlays. Create/kill or migrate VMs. Configure a VM during the boot-up phase. Retrieve information about the VMs (resource usage). 21/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

29 Architecture 22/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

30 Architecture 22/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

31 Architecture 22/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

32 Architecture 22/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

33 Community Users run their applications in Applications VMs: each Application VM is paired with a global level; a community = APP VMs with the same global level; A community is composed of users and applications with the same security and reliability requirements. The number of communities reflects the distinct classes of users. A community is a collaborative environment where sharing of information does nor result in a loss of security or reliability. 23/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

34 Community 24/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

35 Community 24/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

36 Community 24/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

37 Virtual Community Network (VCN) An overlay, or virtual community network (VCN), is introduced for each community. A VCN includes: 1 the set of Application VMs of a community; 2 further VMs to manage the resources and interactions among communities (Infrastructure VMs, Assurance VMs,...). A VCN is an overlay network (a network of VMs). 25/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

38 Virtual Community Network 26/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

39 Virtual Community Network 26/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

40 Virtual Community Network 26/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

41 Virtual Community Network 26/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

42 Current Prototype The prototype is based on Xen and Linux OS. Patches to File System and Community VMs Linux kernel. Community and File System VMs run SELinux: 1 to support DAC/MAC/MLS policies; 2 to enforce the security policy in a centralized way. Vinci exploits NFSv3 service to handle file requests. File System VMs exploit a Tainting kernel module. 27/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

43 Threat Model The infrastructure is a private network centrally managed. VMMs, Infrastructure VMs and Assurance VMs belong to the Trusted Computing Base. Application VMs are untrusted: spoofed packets. Communications among physical nodes cannot be spoofed. 28/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

44 Results and Future Works Limitations Current limitations of the prototype: No File System encryption. Managing and configuring a node to support virtualization, with several customized OSes, is a challenging task. VM migration on request (not dynamic). Security policies are static. 29/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

45 Results Results and Future Works Virtual Interacting Network CommunIty (Vinci): Definition of parallel overlays: simplify management and sharing of a private ICT infrastructure; increase the robustness: specialized VMs apply security checks. Concept of community: set of users with similar requirements. VM templates: tailor each VM configuration by avoiding useless functionalities; smaller software; more robust. 30/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

46 Future Works Results and Future Works File System encryption. Finer-grained security policy: user-id and NFS client-id: 1 protection domain is a subset of the VM s domain; 2 client side authentication (certificate). Dynamic VM migration: to reduce communication delay; fault/error. Support for flexible security policies. Remote attestation. 31/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci

47 Questions? Results and Future Works Thank you! 32/32 Fabrizio Baiardi, Daniele Sgandurra Secure Sharing of an ICT Infrastructure Through Vinci