Distribution of Client Security Policies

Transcription

1 Distribution of Client Security Policies Made for Nokia Internet Communications Eero Kukko Supervisor: Professor Raimo Kantola Instructor: Dr. Heikki Riittinen 1 Networking Laboratory Helsinki University of Technology

2 Introduction Security Technologies Policy Distribution Frameworks Communication Models Distribution Protocols Information Model Conclusions Agenda 2

3 3 Introduction

4 New Environment Clients use Internet to connect to the services Companies are already connected to the Internet Problems with security Encryption/authentication is needed Security clients: VPN and Firewalls Clients machines Computers Mobile devices Remote User ISP Access Point Internet VPN Tunnel VPN / Internet Gateway Company s Internal Network A Internal User VPN / Internet Gateway Server 4 Company s Internal Network B

5 The Problem How to get the information to the client How to describe the client policies in a general format? How the communication between the PDP and clients is done? How does the client locate PDPs What are the needed protocols for the PDP and client communication and how do these protocols work? Information Model VPN / Firwall Client Communication Model TCP/IP Network Framework Policy Deployment Point Policy Deployment Point 5

6 Used Methods Examine the papers written on policies and policy distribution Also QoS policies Other security concerns Analyse the used services/protocols Examine the user needs Examine existing implementations How to move to the new networks 6

7 Security Technologies VPN and Firewalls 7

8 Commonly used in gateways Firewalls No exact definition for firewall Different firwall technologies Application Layer, Packet Filtering and Stateful Packet Filtering ICSA Firewall Certification Client firwalls are used to protect the client Remote User ISP Access Point Internet VPN Tunnel VPN / Internet Gateway Company s Internal Network Internal User Hacker Server 8

9 VPN VPN = Virtual Private Network Virtual, users don t see it Private, encryption and authentication No single VPN technology L2TP PPTP IPSec Internet Remote User Focused on IPSec VPNs Standard Most popular Corporate Firewall Router VPN Gateway Remote User 9 Server Internal Network

10 10 Policy Distribution Frameworks

11 Tool used to create policies Policies stored in repository Tool can notify PDP IETF Model PDP retrieves information from repository PEP, Policy Enforcement Points Used to enforce policies Can have problems if the amount of PEPs increases Policy Mangement Tool PDP Policy Repository PEP 11

12 Multiple PDPs Multiple PDPs are needed to enable the model to scale Clients need to discover the PDPs Manual configuration DHCP / other dynamic configuration protocol DNS, Domain Name System SLP, Service Location Protocol Combination of DNS and SLP Manual configuration Clients have multiple entries for PDPs 12

13 DNS DNS is used to resolve names to IP addresses and vice versa DNS could be used to distribute other information, but problems DNS UDP based Optimised for small information pieces, typically 512 bytes DNS SRV RR can be used to locate services kosh.hut.fi Client ns1.hut.fi Local DNS Server fi, nokia.fi, d.root-servers.net Root name server ns1-fin.global.sonera.fi fi name server ns.nokia.com nokia.fi name server

14 My Suggestions for DNS Use Could be used to locate just regular names Suggestion policy- distribute_policy.domain E.g. if policy services where named as policy-ipsec.mydomain.com SRV records to locate policy services New service needs to be defined Suggestion _policy-ipsec Standardisation needed 14

15 My Suggestion in DHCP Use DHCP, Dynamic Host Configuration Protocol New option field needs to be defined Could be added fair easily Requires standardisation Code Lenght Name XX n P1... Pn 1. Uses DNS names, could used with IP addresses Code Lenght Address Port XX n a1 a2 a3 a4 pr 1 pr n Proto p Priority Weight Service Field Lenght Service p1 p2 w1 w2 srl sr 1... sr n 2. used send SRV Record type of information 15

16 Service Location Protocol SLP is used to discover network services Can be used to locate service attributes Components are: User Agent, Service Agent and Direcotry Agent Problems with multicast SLP can be used to advertise PDP information Enhancements needed 16

17 Combination of DNS and SLP DNS can be used in combination with SLP DNS needs to contain a DNS SRV RR for SLP Client first ask the SLP Directory Agent from its local DNS server The DNS server reply contains the address (SRV) of the SLP Directory Agent No multicating is needed At the moment, locating SLP service via DNS is not yet standardised Internet Draft exists Supported by DNS SRV 17

18 Policy Transfer Agents I am suggesting PTAs to increase security and scalability PTAs inspect data before passing it to the PDPs PTAs can operate as caches Proxy operation is supported to enable the support of multiple protocols PTA PDP Protocol Used Between PDP and PTA Conversion between different protocols Interface I HTTP Interface II LDAP Interface III SyncML To Clients HTTP To Clients LDAP To Clients SyncML 18

19 19 Communication Models

20 Update Phases, Intial Initial phase, client needs to retrieve the policy and the software Manually, using common protocol, such as HTTP Semiautomatic, using assistants Needs to connect to central database If the client has the software, it can locate PDP using same methods as with update process 20

21 Update Phases, Update In the update phase, the client has the software and the a policy Clients can manually download new policies Automatic download Requires the client to locate the PDPs Clients needs to determine wheter they need a new policy They can ask new policy from PDP Look at the policy s time stamp Receive a notification from a gateway Download new policy, if there are errors with the used policy 21

22 22 Distribution Protocols

23 COPS framework Can be extended COPS and COPS-PR COPS-PR, COPS for Policy Provisioning Extend COPS Can support other policies, also security Configuration loaded to the PEPs after boot Base layer COPS Base protocol Client-type layer Additional client types COPS-PR COPS for RSVP Policy information model PIB: Policy information base RSVP policy data 23

24 LDAP LDAP, Lightweight Directory Access Protocol Directories store information LDAP can be compared to off-line directories Client use LDAP server to request information Needs synchronisation on top of LDAP Uses TCP Message based 1. Search Operation LDAP Client 2. Returned Entry 3. Result Code LDAP Server 24

25 SNMP and SNMPCONF SNMP used in network management Get, Get-Next, Set and Trap Based on UDP Rudimentary security (HMAC-MD5-96, HMAC-SHA-96, DES) SNMPCONF IETF Work Group Extends the use of SNMP to policy configuration New MIB(s) 25

26 Information Model A Few Words on Information Structure 26

27 Common Information Models Information model contains The needed information Common data representation Needed for compatibility Examples of representation languages XML Ponder 27

28 28 Conclusions

29 Conclusions Presented new distribution framework Possible protocols to discover PDP New extensions for existing protocols New Policy Transfer Agent component New communication model How to synchorinise information Initial and update synchronisation Establishing the initial trust Presented possible protocols to use for information synchronisation Analysis of these protocols A brief look at information models Different information presentation schemes Collection of information 29

30 Thank You Questions? 30