Cloud Inspector A Cooperative Tool to Increase Trust in Cloud Computing

Transcription

1 SEcure computing for CRitical IT Inspector A Cooperative Tool to Increase Trust in Computing Roland Bless, Matthias Flittner, Robert Bauer Karlsruhe Institute of Technology (KIT) {bless, flittner, robert.bauer}@kit.edu AIT Austrian Institute of Technology ETRA Investigación y Desarrollo Fraunhofer Institute for Experimental Software Engineering IESE Karlsruhe Institute of Technology NEC Europe Lancaster University Mirasys Hellenic Telecommunications Organization OTE Ayuntamiento de Valencia Amaris

2 Lack of Transparency Virtual Tenant IaaS SLAs Tenant Physical Provider IaaS: as a Service SLA: Service Level Agreement Inspector A Cooperative Tool to Increase Trust in Computing 2

3 Lack of Transparency Undermines Trust Virtual Tenant SLA Fulfilment? Actual Geolocation? Security Posture? Dedicated Hosts? Evidence Gathering? IaaS Tenant? Trust? Physical Provider Sec-Audit A+ Nice, but not sufficient Inspector A Cooperative Tool to Increase Trust in Computing 3

4 Transparency Enhancement? Virtual Tenant Answer Interface Tenant Operator Inquiry Physical Data Center?? Management System Operator DB Inspector A Cooperative Tool to Increase Trust in Computing 4

5 Trust Building Tool: Inspector Virtual Tenant Transparency Enhancement Module Physical Independent View Combined View: Virtual + Host Resources Real-time Information Evidence Gathering Data Center Controller Inquiry Answer Interface Management System Tenant Operator Operator Inspector A Cooperative Tool to Increase Trust in Computing 5

6 Inspector Audit trails Virtual Tenant Logging Data RCA PoWerStore Trusted Third Party Auditor Controller Audit Log Policy Physical Management System Operator Data Center RCA: Root Cause Analysis Inspector A Cooperative Tool to Increase Trust in Computing 6

7 Example Conventional Tenant View VMware VDirector Tenant sees virtual resources only! Inspector A Cooperative Tool to Increase Trust in Computing 7

8 Example Tenant View (Web GUI) Inspector Inspector A Cooperative Tool to Increase Trust in Computing 8

9 Example Tenant View (Web GUI) Inspector A Cooperative Tool to Increase Trust in Computing 9

10 Example Tenant View (Web GUI) Tenant can now detect migration events! Inspector A Cooperative Tool to Increase Trust in Computing 10

11 Example Tenant View (Web GUI) Inspector A Cooperative Tool to Increase Trust in Computing 11

12 Running Code and Deployment Running code for OpenStack + VMware Lightweight o TEM CPU Overhead 1 5% o Latency (on-demand inquiries): 10 20ms Secure o purely detective, not corrective o separate logical network and secured communication o coupling with Trusted Platform Modules under investigation Easy to deploy and operate o scalable: more tenants more controllers o re-use of existing cloud ID management and authentication (e.g., Keystone) o plug and play: automatic integration of newly added TEMs automatic detection/correction of TEM failures Inspector A Cooperative Tool to Increase Trust in Computing 12

13 Conclusion Distributed monitoring system providing o real-time Transparency-as-a-Service o on-demand and/or permanent auditing Trust building tool providing win-win solution o Tenant more transparency independent + combined view (HW + Virtual resources) evidence gathering o Provider increased trust new customers additional service additional revenue additional monitoring easier root cause analysis evidence gathering More interesting SECCRIT output: Inspector A Cooperative Tool to Increase Trust in Computing 13

14 SEcure computing for CRitical IT Contact: PD Dr.-Ing. Roland Bless Karlsruhe Institute of Technology (KIT) Institute of Telematics Zirkel 2, Building 20.20, Campus South Karlsruhe Germany T: M: AIT Austrian Institute of Technology ETRA Investigación y Desarrollo Fraunhofer Institute for Experimental Software Engineering IESE Karlsruhe Institute of Technology NEC Europe Lancaster University Mirasys Hellenic Telecommunications Organization OTE Ayuntamiento de Valencia Amaris Inspector A Cooperative Tool to Increase Trust in Computing 14