SEcure computing for CRitical IT Inspector A Cooperative Tool to Increase Trust in Computing Roland Bless, Matthias Flittner, Robert Bauer Karlsruhe Institute of Technology (KIT) {bless, flittner, robert.bauer}@kit.edu AIT Austrian Institute of Technology ETRA Investigación y Desarrollo Fraunhofer Institute for Experimental Software Engineering IESE Karlsruhe Institute of Technology NEC Europe Lancaster University Mirasys Hellenic Telecommunications Organization OTE Ayuntamiento de Valencia Amaris
Lack of Transparency Virtual Tenant IaaS SLAs Tenant Physical Provider IaaS: as a Service SLA: Service Level Agreement Inspector A Cooperative Tool to Increase Trust in Computing 2
Lack of Transparency Undermines Trust Virtual Tenant SLA Fulfilment? Actual Geolocation? Security Posture? Dedicated Hosts? Evidence Gathering? IaaS Tenant? Trust? Physical Provider Sec-Audit A+ Nice, but not sufficient Inspector A Cooperative Tool to Increase Trust in Computing 3
Transparency Enhancement? Virtual Tenant Answer Interface Tenant Operator Inquiry Physical Data Center?? Management System Operator DB Inspector A Cooperative Tool to Increase Trust in Computing 4
Trust Building Tool: Inspector Virtual Tenant Transparency Enhancement Module Physical Independent View Combined View: Virtual + Host Resources Real-time Information Evidence Gathering Data Center Controller Inquiry Answer Interface Management System Tenant Operator Operator Inspector A Cooperative Tool to Increase Trust in Computing 5
Inspector Audit trails Virtual Tenant Logging Data RCA PoWerStore Trusted Third Party Auditor Controller Audit Log Policy Physical Management System Operator Data Center RCA: Root Cause Analysis Inspector A Cooperative Tool to Increase Trust in Computing 6
Example Conventional Tenant View VMware VDirector Tenant sees virtual resources only! Inspector A Cooperative Tool to Increase Trust in Computing 7
Example Tenant View (Web GUI) Inspector Inspector A Cooperative Tool to Increase Trust in Computing 8
Example Tenant View (Web GUI) Inspector A Cooperative Tool to Increase Trust in Computing 9
Example Tenant View (Web GUI) Tenant can now detect migration events! Inspector A Cooperative Tool to Increase Trust in Computing 10
Example Tenant View (Web GUI) Inspector A Cooperative Tool to Increase Trust in Computing 11
Running Code and Deployment Running code for OpenStack + VMware Lightweight o TEM CPU Overhead 1 5% o Latency (on-demand inquiries): 10 20ms Secure o purely detective, not corrective o separate logical network and secured communication o coupling with Trusted Platform Modules under investigation Easy to deploy and operate o scalable: more tenants more controllers o re-use of existing cloud ID management and authentication (e.g., Keystone) o plug and play: automatic integration of newly added TEMs automatic detection/correction of TEM failures Inspector A Cooperative Tool to Increase Trust in Computing 12
Conclusion Distributed monitoring system providing o real-time Transparency-as-a-Service o on-demand and/or permanent auditing Trust building tool providing win-win solution o Tenant more transparency independent + combined view (HW + Virtual resources) evidence gathering o Provider increased trust new customers additional service additional revenue additional monitoring easier root cause analysis evidence gathering More interesting SECCRIT output: https://seccrit.eu/ Inspector A Cooperative Tool to Increase Trust in Computing 13
SEcure computing for CRitical IT Contact: PD Dr.-Ing. Roland Bless Karlsruhe Institute of Technology (KIT) Institute of Telematics Zirkel 2, Building 20.20, Campus South 76131 Karlsruhe Germany T: +49 721 60846413 M: +49 1520 1601400 roland.bless@kit.edu AIT Austrian Institute of Technology ETRA Investigación y Desarrollo Fraunhofer Institute for Experimental Software Engineering IESE Karlsruhe Institute of Technology NEC Europe Lancaster University Mirasys Hellenic Telecommunications Organization OTE Ayuntamiento de Valencia Amaris Inspector A Cooperative Tool to Increase Trust in Computing 14