A Component Security Infrastructure Y. David Liu Scott Smith - - PowerPoint PPT Presentation

▶
a component security infrastructure
SMART_READER_LITE
LIVE PREVIEW

A Component Security Infrastructure Y. David Liu Scott Smith - - PowerPoint PPT Presentation

Aug 17, 2022 449 likes •833 views

A Component Security Infrastructure Y. David Liu Scott Smith http://www.jcells.org 9/24/15 Cells @ FCS 2002 1 Motivation Build software systems Secure software using components systems SDSI/SPKI Cells Secure software systems at the

slide-1
SLIDE 1

9/24/15 Cells @ FCS 2002 1

A Component Security Infrastructure

  • Y. David Liu

Scott Smith http://www.jcells.org

slide-2
SLIDE 2

9/24/15 Cells @ FCS 2002 2

Motivation

Secure software systems

Secure software systems at the component level

SDSI/SPKI Cells Build software systems using components

slide-3
SLIDE 3

9/24/15 Cells @ FCS 2002 3

Goals for a Component Security Infrastructure

l Simplicity – Complex protocols will be misused l Generality – Applicable across a wide range of domains l Interoperability – Security policies shared between

components, others

l Extensibility – Evolves as component architecture evolves

slide-4
SLIDE 4

9/24/15 Cells @ FCS 2002 4

Background: Cells

Cell A

Connector = Service =

plugout plugin

Header Body Header Body Cell B

l A new distributed component programming

language [Rinat and Smith, ECOOP2002]

slide-5
SLIDE 5

9/24/15 Cells @ FCS 2002 5

Background: SDSI/SPKI

l Basis of our security infrastructure l Features –

Principal with public/private key pair

–

Decentralized name service

l

Extended names, name certificate

l

Group membership certificate

–

Access control

l

Principal with ACL

l

Delegation model: authorization/revocation certificate

slide-6
SLIDE 6

9/24/15 Cells @ FCS 2002 6

Principles of Component Security

l

Each component should be a principal

–

Traditional principals: users, locations, protection domains, …

–

New idea: Components as principals

l

Components are known to outsiders by their public key

l

Components each have their own secured namespace for addressing other components

l

Components may be private

slide-7
SLIDE 7

9/24/15 Cells @ FCS 2002 7

Cell Identifiers: CID

l CID = the public key in the key pair

generated by public key cryptosystem

– CID is a secured cell identity l Universally unique – No two cells share the same CID l Outgoing messages signed by CID-1

and verified by CID

slide-8
SLIDE 8

9/24/15 Cells @ FCS 2002 8

CVM Identity

With President Cells:

l Universe is homogeneously composed of

cells

l Locations are also principals

– Locations are represented by cells and each cell is

a principal

l Unique CVM identity via its President

CVM CellA CID: 1..1 CellB CID: 5..5 CVM President Cell CID: 7..7

slide-9
SLIDE 9

9/24/15 Cells @ FCS 2002 9

Cell Header Security Information

CID CID-1

NLT SPT CertSTORE

Security Policy Table Naming Lookup Table Certificate Store (Delegation) Identity/Key

slide-10
SLIDE 10

9/24/15 Cells @ FCS 2002 10

Cell Reference

l A locator of cells l A capability to a cell – No cell reference, no access l A programming language

construct: reference

l Corresponds to a SDSI/SPKI

principal certificate Cell CID CVM CID Network Location Unifies many notions in one concept:

slide-11
SLIDE 11

9/24/15 Cells @ FCS 2002 11

Name Services

l CIDs vs. Names

– CIDs serve as universal identifiers, but names are

still necessary

– Extended name mechanism enables a cell to refer

to another cell even if its CID is unknown

l Our name service is based on SDSI/SPKI l Improvements:

– Fewer certificates needed due to on-line nature – More expressive lookup algorithm

slide-12
SLIDE 12

9/24/15 Cells @ FCS 2002 12

SDSI/SPKI Extended Names

Bob

ID : 1..3 LOC : sdsi://cs.jhu.edu ID 1..3 ID 2..9 ID 7..1

Andy ID : 2..9

LOC : sdsi://starwars.com

Bob’s Andy? Local Name Certificate Local Name Certificate

slide-13
SLIDE 13

9/24/15 Cells @ FCS 2002 13

SDSI/SPKI Groups

Bob

ID : 1..3 LOC : sdsi://cs.jhu.edu ID 1..3 ID 2..9 ID 7..1

Andy ID : 2..9

LOC : sdsi://starwars.com

Local Name Certificate Local Name Certificate Group Membership Certificate Friend

{Bob, Bob’s Andy}

slide-14
SLIDE 14

9/24/15 Cells @ FCS 2002 14

Cell Naming Lookup Table

Bob

CID : 1..3 CVM :4..7 LOC : cell:// cs.jhu.edu CID 1..3 CID 2..9 CID 7..1

Andy CID : 2..9

CVM :5..5 LOC : cell:// starwars.com CID: 4..7 cell://cs.jhu.edu CID: 5..5 cell://starwars.com

Friend {Bob, Bob’s Andy}

CID: 9..5 cell://home.org

slide-15
SLIDE 15

9/24/15 Cells @ FCS 2002 15

Cell Naming Lookup Table

l Online nature makes local name certificates

unnecessary, unlike SDSI/SPKI

– More suited for mobility

l Maintained by naming lookup interface, a

concept closer to programming languages

l Naming entries can be effectively secured by

using hooks

l Compatible with SDSI/SPKI

slide-16
SLIDE 16

9/24/15 Cells @ FCS 2002 16

Name Lookup Process

Bob

CID : 1..3 CVM :4..7 LOC : cell://cs.jhu.edu CID 1..3 CID 2..9 CID 7..1

Andy CID : 2..9

CVM :5..5 LOC : cell:// starwars.com

Bob’s Andy?

slide-17
SLIDE 17

9/24/15 Cells @ FCS 2002 17

A More Expressive Algorithm

Anthony CID : 9..9

CVM :4..7 LOC : cell://cs.jhu.edu CID 1..3 CID 2..9

Andy CID : 2..9

CVM :5..5 LOC : cell:// starwars.com

Tony? Tony Andy’s Anthony

CID 9..9

slide-18
SLIDE 18

9/24/15 Cells @ FCS 2002 18

Cycles

Alice

CID : 1..3 CVM :5..7 LOC : cell:// cs.jhu.edu CID 1..3 CID 2..9

Andy CID : 2..9

CVM :5..5 LOC : cell:// starwars.com

Tony’s Bob? Tony Andy’s Anthony

CID 9..9

Anthony

Alice’s Tony

slide-19
SLIDE 19

9/24/15 Cells @ FCS 2002 19

A cycle exists Same local name expansion entry encountered twice Solution:

l Keep track of the path l Raise an exception if the same name

encountered twice

Cycle Detection Sketch

slide-20
SLIDE 20

9/24/15 Cells @ FCS 2002 20

Security Policy

subject resource access right hook deleg bit

  • wner

unit Bob thiscell connector1 connect NULL Group1 thiscell service1 invoke NULL 1 Alice Tim service1 invoke h

l Each cell holds a security policy table, SPT. l Each policy is a 5-tuple.

slide-21
SLIDE 21

9/24/15 Cells @ FCS 2002 21

Subjects, Resources, Access Rights

l Subjects

– Cells and a group of cells – Local names, extended names, cell references

l Resources

– Services, connectors, operations – Partial order relations among them

l Access rights

– Connect and invoke

l Application level protection: meaningful

services and meaningful connections.

slide-22
SLIDE 22

9/24/15 Cells @ FCS 2002 22

Hooks

l Designed for fine-grained access control

– Protect a naming lookup entry: lookup(“Tony”) – Protect a specific file: read(“abc.txt”)

l Associated with operations l Operation parameters verified via a predicate l Predicate checked when the associated

  • peration is triggered

– Example:

Hooklookup(arg1) = { arg1=“Tony” }

slide-23
SLIDE 23

9/24/15 Cells @ FCS 2002 23

SDSI/SPKI Delegation

ID 3..3 ID 1..1 ID 5..5

AuthC1 AuthC3 AuthC1 AuthC3 AuthC1 “Access Granted”

slide-24
SLIDE 24

9/24/15 Cells @ FCS 2002 24

Cell Delegation

l Implements SDSI/SPKI delegation l Each cell holds all certificates (both delegation

and revocation) in a certificate store.

l Security policy table supports delegation

– The owner of the resource might not be thiscell – The delegation bit indicating whether certificates

can be further delegated

l Certificates are implicitly passed for

delegation chain detection

– No need for manual user intervention

slide-25
SLIDE 25

9/24/15 Cells @ FCS 2002 25

Goals Revisited

l Simplicity

– No complex algorithms/data structures – Clearly defined principals and resources

l Generality

– Not just cells, but components in general – Not limited to certain applications

l Interoperability

– Built on SDSI/SPKI standard – Communicate with any infrastructure that supports

SDSI/SPKI

l Extensibility

– Consideration for future additions: mobility, etc

slide-26
SLIDE 26

9/24/15 Cells @ FCS 2002 26

Future Work

l Security for Mobile Components – Cells can migrate – Mobile devices, PDAs l Hierarchical Security Policy l Interoperability

slide-27
SLIDE 27

9/24/15 Cells @ FCS 2002 27

jcells.org

slide-28
SLIDE 28

9/24/15 Cells @ FCS 2002 28

Dynamic Component

l Components are named, addressable

entities, running at a particular location.

l Components have interfaces which can

be invoked.

l Components may be distributed across

the network

slide-29
SLIDE 29

9/24/15 Cells @ FCS 2002 29

Summary

l Security infrastructure in a component programming

language

l Cell identity and CVM identity (president cell) l Naming lookup table/interface

– More expressive lookup algorithm and cycle detection

l Fine-grained access control l Unification of security artifacts and programming language

  • nes

l Formalization of SDSI/SPKI l API from programming language perspective

slide-30
SLIDE 30

9/24/15 Cells @ FCS 2002 30

Traditional Security Model

allow request from alice.jhu.edu

slide-31
SLIDE 31

9/24/15 Cells @ FCS 2002 31

…Fails for Mobile Devices

allow request from alice.jhu.edu

slide-32
SLIDE 32

9/24/15 Cells @ FCS 2002 32

Cell Security Infrastructure

allow request from CVM with CID 3333333

slide-33
SLIDE 33

9/24/15 Cells @ FCS 2002 33

…Adapts Well with Mobile Devices

allow request from CVM with CID 3333333

slide-34
SLIDE 34

9/24/15 Cells @ FCS 2002 34

Extended Name

An extended name is a sequence of local names [n1, n2, …, nk], where each ni+1 is a local name defined in the name space of the cell ni.

slide-35
SLIDE 35

9/24/15 Cells @ FCS 2002 35

Example: Traditional Security Model

allow request from alice.jhu.edu

slide-36
SLIDE 36

9/24/15 Cells @ FCS 2002 36

…Fails in Cell Migration

allow request from alice.jhu.edu

slide-37
SLIDE 37

9/24/15 Cells @ FCS 2002 37

Example: Cell Security Infrastructure

allow request from cell with CID 1234567

slide-38
SLIDE 38

9/24/15 Cells @ FCS 2002 38

…Adapts Well in Cell Migration

allow request from cell with CID 1234567