1 / 22

Cyber Security Constraints for Virtual Resource Orchestration in Cloud

This paper presents a method for enforcing cyber security constraints in virtual resource orchestration in Cloud Infrastructure-as-a-Service (IaaS) environments. It introduces a methodology and implementation using OpenStack.

fredricky
Download Presentation

Cyber Security Constraints for Virtual Resource Orchestration in Cloud

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Institute for Cyber Security Constraints Specification for Virtual Resource Orchestration in Cloud IaaS Khalid Bijon, Ram Krishnan and Ravi Sandhu University of Texas at San Antonio 5th ACM Conference on Data and Applications Security and Privacy (CODASPY 2015) 1 World-Leading Research with Real-World Impact!

  2. Outline • Introduction • Motivation • Goal • Methodology • Enforcement (in Cloud IaaS) • Implementation (in OpenStack) • Conclusion 2 World-Leading Research with Real-World Impact!

  3. Introduction Compute Host Virtual Machine Type-3 VM Image Type-1 Virtual Storage Rack Physical Storage Virtual Network Virtual Router Network Host Type-2 Physical Resources Virtual Resources • Three Different Mapping Types • Shared Responsibility • Only Consider Type-3 Mappings • Complex Management Process 3 World-Leading Research with Real-World Impact!

  4. Motivation • Inefficient and Tedious Management Plane • Manual Identification • User Centric (unnecessary indirection) • No Direct Misconfiguration Detection/Prevention • Elevate Security Vulnerability Tenant Users ec2:AttachVolumes Policies Virtual Machine Specifies Virtual Storage Figure 1 Tenant Admin Users Solution?? Manual Detection Credit: www.iconarchive.com www.consulting.ky www.acm.icpc.org 4 World-Leading Research with Real-World Impact!

  5. Goal • Easily Manageable Type 3 Mapping • High-level Policy • Configure Diverse Requirements • Establish Direct Relations • Keep Users Out of Loop • Automatically Prevent Misconfiguration Requirements Virtual Machine Tenants Virtual Storage Credit: www.bartley.hants.sch.uk 5 World-Leading Research with Real-World Impact!

  6. Methodology Mapping #3 Mapping #1 Mapping #4 Mapping #2 Virtual Machine Virtual Storage Virtual Network Virtual Router VM Image Figure 2 Constraint Policy • Constraint Policy • For Each Type-3 Mappings • Satisfied By • Individual Virtual Resources Allow Mapping Constraint for Mapping #1 Yes No Virtual Machine Instance j Virtual Storage Instance i Deny Mapping Figure 3 Credit: www.iconarchive.com 6 World-Leading Research with Real-World Impact!

  7. An Attribute Based Approach Workload Sensitivity Level volumeSize • Attribute Specifies Virtual Resource Properties • Aname:valuePair Owner tenant ioType Purpose Virtual Machine Virtual Machine Figure 4 Virtual Storage volumeSize: large tenant:BOF • Designed as Functions ioType: fast tier: database database presentation application tier Figure 5 Domain Figure 6 Codomain (Scope) 7 World-Leading Research with Real-World Impact!

  8. Constraint Policy • A Constraint • Logical Formula • Compares Certain Attribute Values • Simple but Powerful • Hadoop Cluster • 3-tier business application tier: x ioType:y Virtual Storage Instance i Request volumeAttach Virtual Machine Instance j Constraint Format If tier=database’ Then ioType=‘fast’ False True 8 World-Leading Research with Real-World Impact!

  9. UseCase (3-Tier System) netType tier Mapping #2 route ioType Mapping #3 Mapping #1 Virtual Machine Virtual Storage Virtual Network Virtual Router If tier=‘application’ If route=‘outer’ If tier=‘presentation’ Then netType=‘psNet’ then netType =‘psNet’ Or netType =‘webFront’ Constraint 2: Only an application layer VM can connect to a virtual network which is created for passing application layer data. Then ioTYpe!=‘fast’ Constraint 1: If a VM is for presentation layer, attaching storage’s ioType cannot be fast. Constraint 3: If a router is for connecting to out-side internet, only presentation layer network or web-fornt network can connect to it. 9 World-Leading Research with Real-World Impact!

  10. Enforcement • Two Components • Specifier and Enforcer 10 World-Leading Research with Real-World Impact!

  11. Specifier • Implemented in OpenStack • Execution of “attribute-creation” operation • Similarly, • Attribute-value specification • Constraint Specification • Attribute-value assignment Tenant Users 1. Get User Token 2. Request Attribute Name, Token 6. Allow/Deny 3. Token Revoked? 4. Verify Admin Role? NOVA (Compute) KEYSTONE (Authentication) 5. Enter Attribute Name and Tenant Name VM Attribute Table Credit: www.portalguard.com 11 World-Leading Research with Real-World Impact!

  12. Specifier (cont.) • API Specification • Rest API Attribute Name Attribute Value Attribute Value Assignment 12 World-Leading Research with Real-World Impact!

  13. Validation Check Tenant Specific System ioType, fast tier, database If tier=‘database’ Constraint Format Then ioType=‘fast’ • Validity of Attribute Name and Value • Tenant-Specific Attribute • System or Inter-Tenant Attribute 13 World-Leading Research with Real-World Impact!

  14. Enforcer Implementation • Implemented in OpenStack • A Constraint Parser • Invoked by Resource Mapping Operations (e.g., volume-attach) Tenant Users 1. Get User Token 2. Request volume-attach with VM Id, Storage Id and Token 11. Allow/Deny 6. Verify Project of VM, Storage and User 3. Token Revoked? 10. Evaluate Constraint NOVA KEYSTONE 4 5 9 8 7 Storage Attribute Table VM Attribute Table Constraint Table VM Table Storage Table 14 World-Leading Research with Real-World Impact!

  15. Automated Constraint Construction • Helps the tenants to find policy • From Previous Configurations Assigned Attributes • Construct Relation between values of two attributes Virtual Machine tier: database Virtual Storage ioType, fast tier, database Configuration Log Assigned Attributes Figure 8 ioType: fast Figure 7 Credit: www.iconarchive.com 15 World-Leading Research with Real-World Impact!

  16. Approach • Frequent-ItemSet Mining • Apriori Algorithm • with customization for IaaS (CVRM-Apriori) Virtual Machine Assigned Attributes Virtual Storage 1. Frequent-ItemSet Mining Attribute Relations 2. Constraints Construction Constraints Configuration Log Assigned Attributes 16 World-Leading Research with Real-World Impact!

  17. Evaluation • Policy for VM-Network Connectivity Mapping • From VM-Network Table (table virtual_interfaces in Nova, OpenStack) • 10 Attributes each with 10 values • 10 Virtual Networks • At least three Networks per VM • Mine relations between every two pair of attribute values 17 World-Leading Research with Real-World Impact!

  18. Conclusion • A Constraint Specification Framework • Easily manageable and generic • Can be applied for Misconfiguration Prevention • Also, for detection (flag-generator) • Automatic Generation of Constraints Requirements Tenants Future Work • Flag Generator System • Semantic meaning of mined Attribute Relation • Improve mining (incorporate noise) Credit: www.iconarchive.com 18 World-Leading Research with Real-World Impact!

  19. Language

  20. Backup 20 World-Leading Research with Real-World Impact!

  21. Backup

  22. Backup

More Related