Outsourcing security in service ecosystems with evolving security deployment as a service

Transcription

1 Outsourcing security in service ecosystems with evolving security deployment as a service Authors : Dr. Wendpanga Francis Ouedraogo ([email protected]) Prof. Frédérique Biennier ([email protected]) Dr. Philippe Merle ([email protected])

2 Sommaire Context and motivation State of the Art Contributions Context-aware security approach : [email protected] Evaluation Conclusion et further works 2

3 Context and motivation Context Flexibility and agility provided by Intelligent Service Clouds Open and deperimeterized IS (Information System) organization Outsourcing part or all IS + inter-enterprises collaboration Services are reused to support new collaborative business process Shared data and features (services) between enterprises Cloud plasticity allows to use different access devices (BYOD - Bring your own device) and networks to interact with enterprise services and data No more global control on the IS and new security risks Enforce the protection mechanisms to mitigate vulnerabilities and / or threats related to business process and the execution environment Adapt on the fly business services security to changing environment 3

4 Context and motivation Motivating example 4

5 Context and motivation Motivating example 5

6 Context and motivation Motivating example Execution times 10ms 3ms 0 ms Track shipping security policies Track shipping ACL (Access Control List) 6

7 Context and motivation Security has a COST (time consuming, required resources ) Costly over-protection when all security requirements are fulfilled For example: restricted access to an information or service BUT a free access should be granted for any member of the enterprise connected on the enterprise site Systemic protection => Authentication + authorization process at each access Risky under-protection when some requirements are omitted Avoid under or over protection Compose and orchestrate on the fly security services depending on the execution context (and the related organizational and technical threats and vulnerabilities) 7

8 State of the art Different strategies can be used to provide a consistent protection on distributed IS Risks management methods (EBIOS, MEHARI, OCTAVE) Identify security requirements and countermeasures Security by Design approaches UML diagrams (UMLSec, SECURE UML) BPMN diagrams (BPSec) MDS(Model Driven Security) approach (Open PMF, SECTET) integrate the security requirements in the process model Security stack defined in the OASIS Service reference model Security requirement based on the ISO/IEC (Authentication, Authorization,.) OASIS security standards (WS-Security, SAML, XACML) define security services to fulfil the security requirements 8

9 Contribution Provide an end to end consistent protection of a given service, taking into account Business workflow context in which the service takes part Execution platform configuration (the hosting platform, the access devices, the interconnection network) Context-aware Security architecture coupling : MDS approach : transform security requirements to policies [email protected] approach : use policies as abstract models adapts the protection according to the business process collaboration context and the execution context 9

10 Contribution : Context-aware Security [email protected] architecture Software as a Service B u s i n e s s S e r v i c e M i d d l e w a r e Middleware Hosting cloud platform 10

11 Contribution: deployment environment Source: 11

12 Contribution : Context-aware Security [email protected] implementation with FraSCAti. An Interceptor component plugged on the FraSCAti middleware intercepts each service invocation and routes this request to the [email protected] component. 12

13 Contribution : Context-aware Security [email protected] architecture Software as a Service T r a c k i n g S e r v i c e 1 S p e c i f i c M i d d l e w a r e I n t e r c e p t o r M D r u n. t i m e F r a S C A t i M i d d l e w a r e Middleware C l o u d c h a r a c t e r i s t i c s Hosting cloud platform 13

14 Contribution : Context-aware Security [email protected] architecture Software as a Service T r a c k i n g S e r v i c e 1 2 S p e c i f i c M i d d l e w a r e I n t e r c e p t o r M D r u n. t i m e F r a S C A t i M i d d l e w a r e Middleware C l o u d c h a r a c t e r i s t i c s Hosting cloud platform 14

15 Contribution : Context-aware Security [email protected] implementation with FraSCAti. 15

16 Contribution : Context-aware Security [email protected] implementation with FraSCAti. The [email protected] component is the core component to achieve the dynamic security deployment. It consists in three sub components: The Mediator component is responsible for analyzing service requests to retrieve the policy reference. It also composes and orchestrates the security policies associated to business services. The Policy Manager component receives from the Mediator the service reference requested and returns the related security policies The Context Manager component : identifies the different policies to be applied according to the user context and the execution environment. 16

17 Context Contribution and motivation : Context-aware Security Logistic Service WSDL Track shipping security policies 17

18 Contribution : Context-aware Security [email protected] architecture Software as a Service T r a c k i n g S e r v i c e S e c u r i t y S e r v i c e 1 2 S p e c i f i c M i d d l e w a r e I n t e r c e p t o r M D r u n. t i m e F r a S C A t i M i d d l e w a r e 3 4 Middleware C l o u d c h a r a c t e r i s t i c s Hosting cloud platform 18

19 Contribution : Context-aware Security [email protected] implementation with FraSCAti. The Security as a Service (SecaaS) composite is invoked by the Mediator component. It includes various security services (Authentication, authorization, ), which allow protecting business services according to a Security as a Service approach. 19

20 Contribution : Context-aware Security [email protected] architecture Software as a Service 8 T r a c k i n g S e r v i c e S p e c i f i c M i d d l e w a r e I n t e r c e p t o r S e c u r i t y S e r v i c e 5 6 M D r u n. t i m e Middleware F r a S C A t i M i d d l e w a r e 7 C l o u d c h a r a c t e r i s t i c s Hosting cloud platform 20

21 Contribution Evaluation 21

22 Conclusion and further works Securing collaborative business processes deployed on cloud systems requires to pay attention on BP collaborative organization Execution environment (platform vulnerabilities, devices and networks used to interact with the business services) Contribution : security architecture build as plugged service on FraSCAti middleware Externalize the business service security management Dynamic security service selection/composition/orchestration Avoid over protection and under protection Provide an efficient protection 22

23 Conclusion and further works Further works Aggregate security policies Optimize the security service recalling to avoid redundancy Integration of more detailed platform models Develop a governance loop to integrate monitoring information to identify the context more precisely. 23

24 Thank you for your attention 24