Management of Exceptions in Access Control Policies. J. G. Alfaro, F. Cuppens, N. Cuppens ENST Bretagne, Rennes RSM/SERES

Transcription

1 Management of Exceptions in Access Control Policies J. G. Alfaro, F. Cuppens, N. Cuppens ENST Bretagne, Rennes RSM/SERES

2 - 2 - Outline Problem domain Main strategies Use of full expressiveness Conclusions and Perspectives

3 Problem domain When specifying an access control policy how can we properly specify exceptions to those general rules that almost always apply? Example: in a hospital General rule: All physicians are allowed to consult patient s medical records Exception 1 (exception to the general case): Physicians on strike can t access medical records Exception 2 (exception to Exception 1): For emergency purposes, even physicians going on strike can access patient s medical records

4 Management of exceptions on firewalls Example: Zone Private can access web resources of zone Internet Internet Private Firewall Format of a filtering rule: Condition accept or Condition deny Where condition is a conjunctive set of attributes in the form: (s)ource (d)estination source-port(sport) destination-port (dport) (p)rotocole Possible rule for the example: R: s /24 d any p = tcp dport = 80 accept

5 Management of exceptions on firewalls Example (continuation): Corporate Admin Internet Firewall Private Exception 1: The interfaces of Firewall (Interf-fw) are not allowed to access web resources on the zone Internet Exclusion of address from zone Private Exception 2: The hosts in Admin are not allowed to access web resources Exclusion of zone Admin from zone Private Exception 3: The hosts in Corporate ( *.*) are not considered a part of zone Internet Exclusion of zone Corporate from zone Internet

6 Management of exceptions on firewalls Example (continuation): Corporate Admin Internet Firewall Private Problem: How to express the following rule? Zone (Private Admin Interf-fw) has the permission of accessing web resources in zone (Internet Corporate)?

7 Management of exceptions on firewalls Three main strategies: 1. First/Last Matching Algorithms Total ordering of rules 2. Segmentation of Rules Exclusion of condition attributes 3. Partial Ordering of Rules Use of Chains and Jumps

8 First Matching Strategy Principle: Ordering of permissions and prohibitions The firewall is parsing rules until one applies: If the rule is a permission, traffic is accepted Otherwise, traffic is refused When no rule applies, the decision depends on the default policy: In the case of an open policy, traffic is accepted If the policy is closed, traffic is refused Example: R: s (A B) accept R 1 : (s B) deny R 2 : (s A) accept

9 First Matching Strategy Motivation example: Corporate Admin Internet Firewall Private Zone (Private Admin Interf-firewall) has the permission of accessing web resources from zone (Internet Corporate) Possible set of rules: R 1 : s d any p = tcp dport = 80 deny R 2 : s [ , ] d any p = tcp dport = 80 deny R 3 : s /24 d /16 p = tcp dport = 80 deny R 4 : s /24 d any p = tcp dport = 80 accept

10 First Matching Strategy Advantages Solution implemented in most existing firewalls Drawbacks Necessity of defining a total order between rules Transformation of local rule s exceptions into global exceptions Risk of interference between rules Administration of setups becomes error prone o Adding/removing of general rules o Adding/removing of exceptions Combinations of rules not always possible to implement by simple ordering of rules

11 Drawbacks of first matching strategies Example Expression of the following two rules R 1,1 : (s B) deny R 1,2 : (s A) accept R 2,1 : (s A) deny R 2,2 : (s B) accept We must first compute A B and the following transformations: R 1,1 : (s (A B)) deny R 1,2 : (s A) accept R 2,1 : (s (A B)) deny R 2,2 : (s B) accept We can finally deploy the following three rules: R 1 : (s (A B)) deny R 2 : (s A) accept R 3 : (s B) accept

12 Drawbacks of first matching strategies Example insertion of the following rule: The hosts of Private can access to web resources in DMZ DMZ Corporate Internet Firewall Admin Private d

13 Drawbacks of first matching strategies Ordering of rules: Only possibility! R 1 : s /24 d /24 p = tcp dport = 80 accept R 2 : s d any p = tcp dport = 80 deny R 3 : s [ , ] d any p = tcp dport = 80 deny R 4 : s /24 d /16 p = tcp dport = 80 deny R 5 : s /24 d any p = tcp dport = 80 accept

14 Segmentation of condition attributes Principle: Expression of only permissions In case of an open policy Expression of only prohibitions In case of a closed policy Transformation of general rules taking into account the set of exceptions Example: R: s (A B) accept R: (s (A B) accept

15 Segmentation of condition attributes Expression of rule: Zone (Private Admin Interf-firewall) has the permission of accessing web resources from zone (Internet Corporate) Private = * Admin = [ , ] Interf-firewall = { , } Private Admin Interf-firewall: [ , ] [ , ] Internet = *.*.*.* Corporate = *.* Internet Corporate: [ , ] [ , ]

16 Segmentation of condition attributes Expression of rule: Zone (Private Admin Interf-firewall) has the permission of accessing web resources from zone (Internet Corporate) R 1 : s [ , ] d [ , ] \ p = tcp dport = 80 accept R 2 : s [ , ] d [ , ] \ p = tcp dport = 80 accept R 3 : s [ , ] d [ , ] \ p = tcp dport = 80 accept R 4 : s [ , ] d [ , ] \ p = tcp dport = 80 accept

17 Segmentation of condition attributes Advantages: The ordering of rules is not longer relevant Drawbacks: It may lead to complex configurations Necessity of third party tools to manage intervals The number of rules may significantly increase Remarks: Rule updates may require further segmentation processing Some firewalls do not manage intervals Necessity of network masks Example: [ , ] / / /32

18 Partial ordering of rules Principle: When a general rule applies, jump to verify its exceptions If no exception applies, the traffic is accepted Otherwise, test of the following general rule Example: R 1 : (s (A (B C)) accept R 1 : (s A) jump_to chain A R 2 : deny R chain_a 1: (s B) return R chain_a 2: (s C) return R chain_a 3: accept

19 Partial ordering of rules Example: Rule 1: Zone (Private Admin Interf-firewall) has the permission of accessing web resources from zone (Internet Corporate) Rule 2 :Zone Private has the permission of accessing web from DMZ R main 1 : s /24 d any p = tcp dport = 80 jump priv-to-int R main 2 : s /24 d /24 p = tcp dport = 80 accept R main 3 : deny R priv-to-int 1 : s return R priv-to-int 2 : s [ , ] : return R priv-to-int 3 : s /24 d /16 return R priv-to-int 4 : accept

20 Partial ordering of rules NetFilter rules: iptables -N Priv_To_Internet iptables -A FORWARD -s $PRIVATE -p tcp --dport 80 -j Priv_To_Internet iptables -A FORWARD -s $PRIVATE d $DMZ -p tcp --dport 80 -j ACCEPT iptables -A FORWARD j DROP Remarks: iptables -A Priv_To_Internet -s $ADMIN -j RETURN iptables -A Priv_To_Internet -s $FW-INT1 -j RETURN iptables -A Priv_To_Internet -d $CORPORATE -j RETURN iptables -A Priv_To_Internet -j ACCEPT NetFilter must be patched in order to manage ranges Definition of variables such as $PRIVATE, $ADMIN, etc.

21 Partial ordering of rules Advantages Complete separation between exceptions and general rules The ordering of general rules is no longer relevant The insertion and elimination of rules is much easier Drawbacks Number of rules may increase Performance issues

22 Use of full expressiveness Principle: Combination of both positive and negative statements (e.g., A B) for a single attribute at the same time Example: Use of a SQL-like language may allow us to express the rule R: (s (A B)) accept in the form select decision from firewall where (s A) (s B)

23 Use of full expressiveness Proposal: Implementation of a NetFilter module to extend its matching algorithm to specify exceptions in the form R: (s (A B)) accept as follows: iptables --s[+] $A --s[ ] $B -j ACCEPT Example Expression of rules: (1) All hosts in (Private Admin) are allowed to access web resources on (Internet Corporate); (2) All the hosts in (Private Admin) are allowed to access web resources on the zone DMZ. iptables --s[+] $PRIV --s[ ] $ADMIN --d[+] $INTERNET --d[ ] $CORP -p tcp --dport 80 -j ACCEPT iptables --s[+] $PRIV --s[ ] $ADMIN --d[+] $DMZ -p tcp --dport 80 -j ACCEPT iptables -j DROP

24 Use of full expressiveness Implementation of a first prototype: New matching strategy implemented as a NetFilter extension Extending NetFilter involved two parts: Extension of kernel s code, by writing a new module (ipt_fex.ko) Extension of user space s program iptables, by writing a new shared library (iptables_fex.so) Initial evaluation of our prototype: Based on the use of NetPerf, to observe bandwith s overhead vs number of iptables rules

25 Evaluation IPTables Performance (netperf --m 65535; MTU: 1500)

26 Evaluation Matching process of IPTables (pseudocode) protocol, source, destination, in-interface, out-interface, fragment i.e,--sport, Overhead!! --dport, --syn, -m limit,

27 Conclusions/Perspectives Conclusions: Survey of main strategies to manage and deploy filtering rules exceptions Advantages and drawbacks of each stratedy Proposal of a new strategy based on the use of full expressiveness Implementation and evaluation of a first prototype Work in progress: A more in-depth evaluation of our first prototype Implementation of a new netfilter prototype based on a improved matching process

28 Management of Exceptions on Access Control Policies J. G. Alfaro, F. Cuppens, N. Cuppens ENST Bretagne, Rennes RSM/SERES