ENHANCING CLOUD SECURITY WITH CONTEXT-AWARE USAGE CONTROL POLICIES CHRISTIAN JUNG, ANDREAS EITEL, REINHARD SCHWARZ

Transcription

1 FRAUNHOFER INSTITUTE FOR EXPERIMENTAL SOFTWARE ENGINEERING IESE ENHANCING CLOUD SECURITY WITH CONTEXT-AWARE USAGE CONTROL POLICIES CHRISTIAN JUNG, ANDREAS EITEL, REINHARD SCHWARZ Christian Jung

2 MOTIVATION 2

3 MOTIVATION Sensitive Data Business data Personal data Intellectual property Data leaks (m alicious or unintentional) damage business reputation cause financial losses What happens after data is releas ed? 3

4 MOTIVATION Moving Data to the Cloud = Moving Data to Third Parties Data Protection Challenges Data Residency (data must be kept within defined geographic borders) Data Privacy (enterprise is responsible for any breach to data) Compliance (enterprise must comply with applicable laws) Data Usage Control (data is accessed from different entities) Main concerns for critical infrastructure IT using the Cloud Security and Privacy , SECCRIT 4

5 MOTIVATION Acces s control is not enough! Us age control a generalization of access control Fine-grained policies specify how data is handled after access has been granted Us age Control Enables compliance with privacy, auditing, and accountability regulations Acces s Control Allows you to keep control over your data 5

6 USAGE CONTROL THE IND²UCE FRAMEWORK 6

7 IND²UCE FRAMEWORK 7

8 USAGE CONTROL Tracking of data flow : Do not redistribute account inform ation Additional information sources (e.g. context): data can only be displayed on company s premises Expressive Policy Language (OS L) Cardinality operators: data can be read only tw ice Temporal operators: data must be deleted after one month Expressive Language Data flow Context 8

9 ENFORCEMENT IN THE CLOUD INFRASTRUCTURE 9

10 EU PROJECT SECCRIT IN A NUTSHELL Challenges Analyse and evaluate cloud computing with respect to security risks in sensitive environments (i.e., critical infrastructures) Goal Development of methodologies, technologies, best practices for secure, trustworthy, high assurance and legal compliant cloud computing environments for critical infrastructure IT. Enable cloud technologies to be used for critical infrastructure IT 10

11 ENFORCEMENT IN THE CLOUD INFRASTRUCTURE LEVEL IND²UCE FOR VMWARE Man in the Middle (Preventive Enforcement) Proxy between vcenterserver and vsphereclient VMware vsphereclient SOAP VMware vcenter Server VMware vsphere Manage VMware vsphere preventive and detective enforcement Rebuild all interfaces for enforcement VMware changes are critical man in the middle approach (TLS/SSL) missing user transparency, etc. Maintaining user roles and privileges within IND²UCE 11

12 ENFORCEMENT IN THE CLOUD INFRASTRUCTURE LEVEL IND²UCE FOR VMWARE vsphere Client Plugin (Preventive Enforcement) Managed user interface with integrated PEP (Plugin) VMware vsphereclient VMware vsphere SOAP VMware vcenter Server Manage VMware vsphere preventive and detective enforcement Rebuilding Control Center UI Maintaining user roles and privileges within IND²UCE Bypassing of plugin Client-based solution 12

13 ENFORCEMENT IN THE CLOUD INFRASTRUCTURE LEVEL IND²UCE FOR VMWARE SOAP Interface vcenter Server (Detective Enforcement) VMware vsphereclient SOAP VMware vcenter Server VMware vsphere Manage VMware vsphere independent of VMware changes (except for interface changes) no disturbance of other systems only detective enforcement 13

14 ENFORCEMENT IN THE CLOUD INFRASTRUCTURE LEVEL POLICY ENFORCEMENT POINT (PEP) Monitored types of Events (230 events tested, overall about 700 events) Virtual Machines Cluster Hosts Migration, Lifecycle, Powercycle, Cluster (Failover, HA Monitoring, etc.) Lifecycle, Resources, HA Services Host operations, networking, lifecycle, etc. Datastores Networking Lifecycle, Switch (e.g., port state) Roles and Permissions 14

15 ENFORCEMENT IN THE CLOUD INFRASTRUCTURE LEVEL POLICY ENFORCEMENT POINT (PEP) Event processing vcenter Server VMwarePEP SOAP- Interface Request new Events Response starts EventCollector PDP event VmWare events EventConverter PDP event with converted field added Response BooleanConveter Single field from Vmware Event + PDP event IntegerConverter EntityConverter... IntegerConverter 15

16 ENFORCEMENT IN THE CLOUD INFRASTRUCTURE LEVEL POLICY INFORMATION POINT (PIP) Contex tual Inform ation Performance of virtual machines, cluster, etc. Resource load such as CPU, memory, etc. Runtime status Connection or power state, boottime, maximum CPU usage, etc. Datastore Capacity, free space, etc. Configuration parameters of virtual machines or cluster Mac address, annotation, number of CPUs, etc. Information about user or group privileges 16

17 ENFORCEMENT IN THE CLOUD INFRASTRUCTURE LEVEL POLICY EXECUTION POINT (PXP) Ex ecute Actions Virtual Machines Powercycle (PowerOn/Off, Reset, Suspend, Standby, Shutdown, Reboot) Lifecycle (Reconfig, Relocate, Migrate, Clone, CreateSnapshot, etc.) Cluster Reconfigure, Apply/CancelRecommendation Roles and Permissions Set/Reset/RemoveEntityPermissions 17

18 ENFORCEMENT IN THE CLOUD INFRASTRUCTURE LEVEL ENFORCING ANTI-AFFINITY POLICY Scenario: TenantA runs critical infrastructure services on different machines (VMs) on a virtual datacenter. However, the services are not allowed to share the same physical resources! Problem: If TenantA or the cloud infrastructure operator starts migrating virtual machines (VMs) to the same physical host, both critical services run on the same physical host. VMware offers affinity rules, but allows their violation Solution: An anti-affinity policy specifies that critical VMs have to be separated. Migrating critical VMs to the same physical host results in automatically migrating the other critical service away. 18

19 ENFORCEMENT IN THE CLOUD INFRASTRUCTURE LEVEL ENFORCING VIRTUAL MACHINE SNAPSHOTS POLICY Scenario: A virtual machine is reserved as a sandbox for evaluating new software. Testers can install software on the machine, but it has to be reverted to previous state after usage. Only administrators are allowed to make persistent changes. Problem: A tester might forget to revert the machine or an administrator might forget to create a new snapshot. Creating snapshots and reverting has to be triggered manually. The vcenter user management has no automatic mechanisms for this kind of scenario. Solution: Virtual machine snapshots policies specify that a snapshot is created after an administrator logs out from the virtual machine. If a tester logs out from the virtual machine, the virtual machine is reverted. 19

20 ENFORCEMENT IN THE CLOUD INFRASTRUCTURE LEVEL ENFORCING VIRTUAL MACHINES GEOLOCATION Scenario: A virtual machine hosts sensitive data and is only allowed to be operated in countries within Europe. Problem: A cloud operator might trigger the process to migrate the virtual machine to another data center outside Europe. Solution: A virtual machines geolocation policy specifies that virtual machines are only allowed to be operated in data centers within Europe. Migrating the virtual machine outside Europe will be logged and countermeasures enforced. 20

21 CONCLUSION & FUTURE WORK Moving Data to the Cloud = Moving Data to Third Parties Loosing Control over Data Usage Control Access Control IND²UCE enables us age control capabilities to VMw are Cannot prevent system actions, but can react after the event or report policy violation IND²UCE enables compliance with privacy, auditing, and accountability regulations (e.g., data has to be stored within Europe) Usage Control keeps control over your data usage 21

22 CONCLUSION & FUTURE WORK Enforcem ent com ponents for Cloud S torage Changing source code of HBase to modify data in transit Us er-friendly Policy S pecification Elicitation method for security demands and mapping to machineenforceable security policies Reduction of errors and misunderstandings in policy specification Policy Managem ent in Dis tributed Env ironm ents Policy deployment and revocation; management policies 22

23 FRAUNHOFER INSTITUTE FOR EXPERIMENTAL SOFTWARE ENGINEERING IESE Chris tian Jung Fraunhofer Institute for Experimental Software Engineering IESE Fraunhofer-Platz Kaiserslautern Germany Phone Fax christian.jung@iese.fraunhofer.de This document was created using the official VMware icon and diagram library. Copyright 2012 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at VMware does not endorse or make any representations about third Fraunhofer party information IESE included in this document, nor does the inclusion of any VMware icon or diagram in this document imply such an endorsement. ind2uce@iese.fraunhofer.de