1 / 30

Unifying the Conceptual levels of Network Security through use of Patterns .

Unifying the Conceptual levels of Network Security through use of Patterns. PhD Proposal Ajoy Kumar. Overview. Application. Firewall. IDS. VPN. TLS. IPSec. Problem Statement.

mark-nixon
Download Presentation

Unifying the Conceptual levels of Network Security through use of Patterns .

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Unifying the Conceptual levels of Network Security through use of Patterns. PhD Proposal Ajoy Kumar

  2. Overview Application Firewall IDS VPN TLS IPSec

  3. Problem Statement • In each of the layers such as the application layer, transport layer, and the IP layer, security is of utmost concern. At each of these layers we discuss the different security components such as Firewall, IDS and VPNs and analyze security criteria and identify the non existing patterns and develop them.

  4. Network Architecture Security Mechanisms

  5. Supports SAML XML VPN VPN Supports TLS TLS VPN IPSec Supports IP VPN

  6. VPN Pattern Diagram for VPN SAML Realize Realize Realize TLS VPN IP VPN XML VPN TLS IPSec Secure Channel Authentication

  7. We can create similar diagrams for Firewalls and IDS. • Previous Work - Survey

  8. Class Diagram for a Packet FW[Fe06]

  9. Class Diagram for Proxy FireWall[Fe03]

  10. Work Already Completed • IDS Pattern (Signature Based) • VPN Pattern (Abstract)

  11. Class Diagram for Signature basedIDS.[Fer05]Viking PLOP

  12. Class Diagram For VPN Network VPN * * Network End Point 1 1 * Authenticator Secure Channel 1 Identity Base * Identity

  13. Proposed Work • Missing Patterns for the Functions and Protocols • Study of Combinations • IDS + Firewalls • Firewalls + VPN

  14. Expected Contributions • Unification of Security Functions in the Network Layer. • Consider a Case study like a SCADA system and see how these patterns apply to a SCADA system. • Development of Specific Patterns

  15. Case Study • SCADA Architecture • SCADA can be used as an example of a distributed system where we apply these patterns.

  16. SCADA • Supervisory Control and Data Acquisition (SCADA) systems consists of geographically scattered units (field devices) controlled using centralized data acquisition and control (control center) [Sto06]. They are usually highly distributed systems. Field devices could be controlling local operations such as valve operations, collecting sensor data, and monitoring for disaster conditions. The next figure shows the general architecture of a SCADA system. Examples for SCADA systems are electric power systems, oil and gas pipelines, water utilities, and any system that requires remote monitoring and control.

  17. General SCADA architecture (from [Sto06]).

  18. The common attacks threatening a SCADA system are physical attacks to the field (remote) units and network attacks to the communication networks usually through the internet. The primary security concerns are availability and integrity. Confidentiality and non-repudiation are secondary concerns.

  19. Example • An important example of SCADA application is electric power generation. • Context • A SCADA system such as electric power generation system with a Distributed Architecture and connected to the Internet.

  20. Forces • Only Authorized personnel should be able to access the system at the Remote units and the Main control unit. . • Messages sent from the supervisory control unit to the Remote field units and back should be confidential and data integrity should be preserved. • Messages should be sent only by authorized personnel at the remote location and the main location. • Authorized personnel should be able to do their respective duties based on Company defined Policies.

  21. Forces (Contd…) • Any message from unknown or spurious remote locations should be discarded. • We should be able to detect any intrusions into the system and create alert logs. • Field Units and Communication Lines should be free from Physical Attacks. • Service should be available 24 hrs 7 days a week.

  22. Solution • Authentication is done at the Remote and the Central Controller unit to make sure that only Authorized personnel have entry access to the system. • We can create secure VPN channels at the Central Controller and the Remote units so that we can send confidential messages. This also makes sure that the integrity of data is maintained. • Intrusion Detection Systems are able to detect any intrusions to the systems based on misuse based detection or anomaly based detection. • Firewalls prevent messages from unknown and dangerous sites from reaching the system.

  23. Solution (Contd…) • By providing Reference monitor or RBAC, we can make sure that the authorized personnel can perform their respective roles. • By adding Physical Access control zones we can prevent physical attacks caused by external elements. • All these security measures added make sure that there is no Denial of Service (DOS). • The use of these security models in SCADA communication can significantly reduce the vulnerability of these critical systems.

  24. Central Controller Comm. Network Field Unit Controller * 1 * Internet User Interface 1 Zone 1 Class Diagram (w/o Security Components)

  25. Class Diagram for Secure SCADA

  26. Consequences • Advantages • Users are authenticated by the system. This helps to maintain a good logging system also. • The RBAC model helps authorization policies to be implemented within the system based on roles of the personnel. • Secure channels use strong encryption which helps confidentiality and data integrity. • Firewall and IDS helps to make the system more secure.

  27. Consequences(Contd…) • Liabilities • High overhead with VPN connection, firewall and IDS. • If the protocol used is not a secure protocol, the risk increases..

  28. Known Uses • Any Power Utility company such as FPL. • Related Patterns • VPN Patterns. • Firewall Patterns • IDS Patterns

  29. References • [Bar04] K. Barnes, B. Johnson and R Nickelson. “Review of Supervisory Control and Data Acquisition (SCADA) Systems. “ Idaho National Engineering and Environmental Laboratory, Bechtel BWXT, Idaho. • http://www.inl.gov/technicalpublications/Documents/3310858.pdf • [Cla04] Practical Modern SCADA Protocols: DNP3, 60870.5 and Related SystemsGR Clarke, D Reynders - 2004 - books.google.com • [Fer07] Eduardo B. Fernandez. Class Notes COT5930 – Fall 2007, Florida Atlantic University. • [Fer05] Eduardo B. Fernandez, Jose Ballesteros, Ana C. Desouza-Doucet, and Maria M. • Larrondo-Petrie. “Security Patterns for Physical Access Control Systems.” Class Notes COT5930 – Fall 2007, Florida Atlantic University. • [Jeo07] Jeon Il Moon, Jung Sub Kim, Jong Bae Kim, Kye Young Lim and Byoung Wook Choi, “A hardware implementation of distributed network protocol.” Computer Standards & Interfaces, Volume 27, Issue 3, Pages 221-232 • [Pat07] S C Patel and Y Yu, “Analysis of SCADA security Models.” International Management Review. Vol.3 No.2., 2007 Pages 68 – 76. • [Sto06] K. Stouffer, J. Falco, and K. Kent, “Guide to supervisory control and data acquisition (SCADA) and industrial control systems security”, Spec. Pub. 800-82, National Institute of Standards and Technology (NIST), • http://csrc.nist.gov/publications/drafts/800-82/Draft-SP800-82.pdf

  30. Suggestions • Additions • Concerns • Modifications • Improvement

More Related