Cloud&backed,Internet,of,Things, Security,and,Dependability,

Transcription

1 Cloudbacked,Internet,of,Things, Security,and,Dependability, Miguel,Pupo,Correia, 2015EuropeanSecurityConference,ISEG,June2015, Schedule 1. InternetofThingsmeetstheCloud 2. SecuredPersonalDevice 3. ShuGle:cloudintrusionrecovery 2, 1

2 1.,INTERNET,OF,THINGS,MEETS,THE, CLOUD, 3, InternetofThings embeddedcomputajonaldeviceseverywhere PCAS 4, 2

3 InternetofThings InternetofThings(IoT)vision=billionsof things connectedtotheinternet(gartner:26bin2020) Things embeddedcomputajonaldevices,cybert physical(sensors,actuators) TypicallyconnectedusingwirelesscommunicaJons WiFi,GSM/3G/4G/5G,Bluetooth,NFC 5, CompuJngasauJlity usecomputajonal resourceswithout buyingthem CAPEXvsOPEX PayTasTyouTgo ElasJcity CloudCompuJng 6, 3

4 IoTmeetstheCloud ManyIoTapplicaJonsneedapla\orm Cloudisaconvenientenvironmentforthatpla\orm Payasyougosupportsgrowthandbigdata(26B...) 7, IoTPla\ormsintheCloud FuncJonality ManagementandinterconnecJonofthethings Datastorage,processing,andanalysis BusinessprocessimplementaJonandmonitoring InteracJonamongusers 8, 4

5 IoTPla\ormsintheCloud OpenSensors.io Collectssensordata(MQTT) Dataisofferedtoallusers(unlessclientpays) ProvidesdataflowstoapplicaJons Datastorage,devicemanagement,... Carriots Collectsthings data(rest/http) Managesdevicesanddata SupportsapplicaJonimplementaJonandexecuJon andothers 9, 2.,SECURED,PERSONAL,DEVICE, 10, 5

6 MoJvaJon:smartphoneintrusions Smartphoneisahandyplacetoputpersonaldata... buttheirsecuritystatusisquitebadandstorageislimited Mobile Threat Classifications, 2013 Source: Symantec Track User Risks that spy on the individual using the device, collecting SMS messages or phone call logs, tracking GPS coordinates, recording phone calls, or gathering pictures and video taken with the device. 35% % 20% 32% 28% 30% Steal Information This includes the collection of both device- and user-specific data, such as device information, configuration data, or banking details. Traditional Threats Threats that carry out traditional malware functions, such as back doors and downloaders % 10% 8% 9% 8% 8% 15% Reconfigure Device These types of risks attempt to elevate privileges or simply modify various settings within the operating system. 5 Send Content Adware Reconfigure Traditional Steal Annoyance Device Threats Information Track User Adware/Annoyance Mobile risks that display advertising or generally perform actions to disrupt the user. Send Content These risks will send text messages to premium SMS numbers, ultimately appearing on the bill of the device s owner. Other risks can be used to send spam messages. Source:SymantecITSR , ProjectPCASoverview PCASaimsatimplemenJngasecurehandheld device:thesecuredpersonaldevice(spd) asmartphoneaddton(or sleeve ) recognizestheuserusingseveralbiometricsensors allowsuserstoauthenjcatethemselves allowsuserstosecurelystoredata cancommunicatewithtrusted(cloud)services 12, 6

7 SPDsketches 13, Scenarios TwousecasesarebeingusedforvalidaJon: Electronichealth SPDisusedforstoringpersonalhealth dataaswellasaccesspointtotheehratthecloud Universitycampus SPDisusedforbeGeraccesscontrol andmoresecureauthenjcajonintocampusservices (canteen,library,website,...) 14, 7

8 Usage 15, SPDmeetstheCloud Bio,Sensors SPD Smart Phone Cloud CPU, Gate, Unit AuthenWcaWon, Unit,, Protected,,, Encrypted,Storage, USB, Secure,Channel SemiTrusted,, Apps Secure,comm., Service,, Trusted,, App, 16, 8

9 3.,SHUTTLE:,CLOUD,INTRUSION, RECOVERY, 17, MoJvaJon:cloudintrusions Intrusion/faultcauses: Solwareflaws ConfiguraJonandusagemistakes CorruptedlegiJmaterequests Intrusions/faultsmaycompromisedata/service: Integrity Availability ConfidenJality 18, 9

10 Goal RecoverapplicaJons dataintegrity whenintrusionshappen 19, Backups? User,AcWon, Malicious, AcWon, Backup, WorksbutremovesbothbadandgoodacJons ShuGle:removesbadacJonsbutkeepsgoodacJons t 20, 10

11 Pla\ormasaService(PaaS) Cloudservice=torunapplicaJons ConsumerdevelopsapplicaJontoruninthat environment,using Supportedlanguages,e.g.,Java,Python,Go,PHP Supportedcomponents,e.g.,SQL/noSQLdatabases,load balancers 21, ShuGleintrusionrecoveryservice Features: Supportedbythecloud:availablewithoutsetup RemovestheintrusioneffectsintheapplicaJons state SupportsapplicaJonsdeployedinvariousinstances AvoidsapplicaJondownJme CosteffecJve Recoversfast 22, 11

12 ShuGlearchitecture User requests Proxy Manager Shuttle Storage Legend: Load Balancer Interceptor Application Server DB Proxy Database Instance normalexecujon:log, Replay takesnapshots Instance Interceptor Application Server DB Proxy Database Instance Scalling User Requests Replay Requests Control Messages 23, ReplayProcess 1. IdenJfythemaliciousacJons(notpartofShuGle) 2. StartnewapplicaJonanddatabaseinstances 3. Loadasnapshotprevioustointrusioninstant Createanewbranch;keepstheapplicaJonrunninginpreviousbranch 4. Replayrequestsinnewbranch 5. Blockincomingrequests;replaylastrequests 6. Changetonewbranch;shutdownunnecessary instances 24, 12

13 ReplayModes FullReplay:ReplayeveryoperaJonalersnapshot SelecWveReplay:Replayonlyaffected(tainted)operaJons Serial:,ReplayalldependencygraphsequenJally Clustered:,Independentclusterscanbereplayedconcurrently, FullTReplay SelecJveTReplay 1Cluster(Serial) Clustered 25, EvaluaJonEnvironment AmazonEC2,c3.xlargeinstances,GbEthernet WildFly(formelyJBoss)applicaJonservers Voldemortdatabase AskQAapplicaJon;datafromStackExchange 26, 13

14 PerformanceoverheadevaluaJon innormalexecujon Workload A Workload B Shuttle 6325 ops/sec [5.78 ms] ops/sec [3.62 ms] No Shuttle 7148 ops/sec [5.07 ms] ops/sec [3.01 ms] overhead 13% [14%] 16% [20%] Table II OVERHEAD IN THROUGHPUT (OPS/SEC) AND RESPONSE LATENCY (MS). full replay. The attack effects are removed because Shuttle loads a database snapshot instead of undoing every operation. As the malicious actions were not logged, they are not replayed and Shuttle recovers the application consistency. 27, The number of requests to replay is defined by the snapshot instant: on full replay Shuttle replays all requests performed after the intrusion instant, while on selective replay Shuttle replays the requests necessary to read the values of the entries before the intrusion and the tainted requests. While selective replay seems torecoveryjme have a big advantage comparing with full replay, which performs, in these scenarios, at least requests, some applications have more dependencies thus the for1millionrequests number of tainted requests is bigger. For instance, if the order between questions with the same tag is considered as a dependency, the number of dependencies rises from to and the number of independent clusters decreases from 6992 to 56. C. Performance We evaluate Shuttle s performance considering the throughput of the application, the size of the logs and the recovery time. We also estimate the cost of deployment of Shuttle on a public cloud provider, Amazon Web Services (AWS). We run 6 AWS c3.xlarge instances (14 ECUs, 4 vcpus, 2.8 GHz, Intel 28, Xeon E5-2680v2, 7.5 GB of memory, 2 x 40 GB storage capacity) connected by gigabit ethernet (780Mbps measured with iperf, 0.176ms round-trip time measured with ping). We use one client, one instance with Shuttle proxy and a load balancer (HAProxy), three WildFly (formerly JBoss) application servers and one Voldemort database. We consider a large data sample from the data of Stack Exchange with requests (1432 questions, 3399 answers, 8335 comments, votes, 950 Update latency (us) show Shuttle has accesses N Throughput (thousa (a) Workload A Figure Recovery. We m replay the sample cluster) takes appr clusters takes only We measured th instances on cluste Shuttle is scalable reducing the time half the time of 1 Requests per second clu 0 00:00 05:00 10:00 15 Time (minu (a) Recove Figu We measured 14 th two clients with The serial replay application server (2953s total, 1100

15 CONCLUSION, 29, Conclusion CloudandIoT,agreatmatch Thingscommunicatewithscalablepla\orminthecloud Payasyougo,elasJcity Intrusionsmayhappeninmobiledevices SPD,anoveldeviceforauthenJcaJonanddataprotecJon Dataphysicallyisolated,protectedwithbiometrics Intrusionsmayhappeninthecloud ShuGle,arecoveryserviceforPaaSofferings LeveragestheresourceelasJcityandpayTperTusemodelto reducetherecoveryjmeandcosts 30, 15

16 THANK,YOU,