CMPSC443 - Introduction to Computer and Network Security Module: - - PowerPoint PPT Presentation

cmpsc443 introduction to computer and network security
SMART_READER_LITE
LIVE PREVIEW

CMPSC443 - Introduction to Computer and Network Security Module: - - PowerPoint PPT Presentation


slide-1
SLIDE 1

฀฀฀฀ ฀

  • ฀฀฀฀

฀฀฀฀฀ ฀฀฀฀฀฀

CMPSC443 - Introduction to Computer and Network Security Page

CMPSC443 - Introduction to Computer and Network Security Module: Provenance

Professor Patrick McDaniel Spring 2009

1

slide-2
SLIDE 2

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

NASA/KSC

  • During a launch window, the pad

infrastructure collects and evaluates 50k sensor samples/sec ...

  • ... sensors measure the heat, stress,

vibration, etc. of the superstructure.

  • ... “state” of the launch is computed by

a complex model whose inputs are continuous (sometimes faulty) sensors.

  • ... launch aborted (or potentially worse,

not aborted) based on the launch state.

2

Thus, the safety of the launch mission relies on the pedigree of singular, aggregated, and synthesized cyber-physical sensor data.

slide-3
SLIDE 3

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Provenance

  • A human scale problem:
  • Data often comes from many sources ...
  • ... is synthesized by often complex/hidden processes ...
  • ... thus, how do you really know what the data means?
  • Data provenance immutably identifies how data came

to be in the state it is.

  • Who/what contributed to it?
  • What was it based on?
  • When was it generated?
  • Why was it generated?
  • How was it generated?

3

slide-4
SLIDE 4

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Practical Provenance

  • Medical data management - HIPAA requires

tight controls on the dissemination, generation and storage of patient including cyber-physical sensors and control systems.

  • security questions raised on this of late
  • SCADA/sensor-nets - Understanding pedigree of

sensed information is key to properly reacting to changes in physical system state.

  • manufacturing, power grids, utilities, airport

security, transportation, ...

  • Voting systems - one of the central

countermeasures to the pervasive problems is better tracking of election artifacts, logging.

4

slide-5
SLIDE 5

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Why provenance?

  • Error handling
  • Detection, isolation, and recovery
  • Source attribution
  • Forensics, consistency, believability
  • Evidentiary
  • Evidence that data is legitimate/legal
  • Data revision
  • Updates, correction, extension, refinement
  • The value of data can only be judged in light of how, when

and where it comes from (veracity/timeliness/quality)

5

slide-6
SLIDE 6

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Tracking provenance

6

SHALI, Russia — The men who set fire to Valentina Basargina’s house arrived in the stillness of 3 a.m. There were three of them. Each wore a camouflage uniform and carried a rifle. One held a can of gasoline. They wore masks. They led Ms. Basargina and her son outside and splashed gasoline in their two rooms, she and her relatives said. One man produced a T- shirt, knotted onto a stick. It was damp with gas. “This is for the one who is gone,” he said in thickly accented Russian.

  • Ms. Basargina’s nephew had recently disappeared; the police had said

he joined the small but smoldering insurgency fighting for Chechnya’s independence from Russia. The man lit the torch and tossed it inside. The air whooshed. Flames shot through the house. The attack, late last month, was part of what Chechens described as an intensified government effort to stamp out the remnants of a war that has continued, at varying levels of ferocity, for nearly 15 years. In a campaign to punish families with sons suspected of supporting the insurgency, at least a dozen homes have been set ablaze since midsummer, residents and a local human rights organization said. The burnings have been accompanied by a program, embraced by Ramzan A. Kadyrov, Chechnya’s president, that has forced visibly frightened parents of insurgents to appear on television and beg their sons to return home. “If you do not come back I will never forgive you,” one father, Ruslan Bachalov, said to his son on a recent broadcast. “I will forgive the man who will kill you.” “I have no other way out,” he added. “The authorities and the president demand that I bring my son back.”

GPS-tracking Field Agent A Field Agent B Analyst C Analyst D Station Chief

slide-7
SLIDE 7

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Tracking provenance

7

SHALI, Russia — The men who set fire to Valentina Basargina’s house arrived in the stillness of 3 a.m. There were three of them. Each wore a camouflage uniform and carried a rifle. One held a can of gasoline. They wore masks. They led Ms. Basargina and her son outside and splashed gasoline in their two rooms, she and her relatives said. One man produced a T- shirt, knotted onto a stick. It was damp with gas. “This is for the one who is gone,” he said in thickly accented Russian.

  • Ms. Basargina’s nephew had recently disappeared; the police had said

he joined the small but smoldering insurgency fighting for Chechnya’s independence from Russia. The man lit the torch and tossed it inside. The air whooshed. Flames shot through the house. The attack, late last month, was part of what Chechens described as an intensified government effort to stamp out the remnants of a war that has continued, at varying levels of ferocity, for nearly 15 years. In a campaign to punish families with sons suspected of supporting the insurgency, at least a dozen homes have been set ablaze since midsummer, residents and a local human rights organization said. The burnings have been accompanied by a program, embraced by Ramzan A. Kadyrov, Chechnya’s president, that has forced visibly frightened parents of insurgents to appear on television and beg their sons to return home. “If you do not come back I will never forgive you,” one father, Ruslan Bachalov, said to his son on a recent broadcast. “I will forgive the man who will kill you.” “I have no other way out,” he added. “The authorities and the president demand that I bring my son back.”

d1 d4 d2 d3 d5 d6 Station Manager Analyst C Field Agent A GPS Analyst D Field Agent A

slide-8
SLIDE 8

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Provenance approaches ...

  • Annotations describe data provenance
  • Can be manual or automated
  • Collects “log” of data transitions
  • Pro: complete record
  • Con: potentially large state (scalability?)
  • Inversion infers provenance by reversing processes
  • Reverse processes to recover data preimage, e.g., query inv.
  • Save all processing back to creation/import of data
  • Pro: small representation
  • Con: incomplete/cannot invert all processes (e.g., aggregation)
  • Orthogonal: data vs. process oriented provenance

8

f −1(y) = x

slide-9
SLIDE 9

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Provenance and Security

  • One could argue the genesis of provenance lies in the

early MLS systems. These systems track and constrain information based on labels (public, secret, top-secret).

  • The standard for intelligence and military for a generation
  • Integrity models track and constrain the modification of

information by labels (low integrity, high integrity).

  • BIBA, Clark-Wilson, Clark-Wilson Light
  • These are formal security models (fundamental science)
  • A recent revival of label based security ...
  • Security-typed languages
  • MAC-based policy, operating systems
  • Labeled communication

9

slide-10
SLIDE 10

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Ongoing efforts ...

  • Service-Oriented Architectures (Scientific/GRID comp.)
  • Chimera & and Virtual Data Grid (data regeneration)
  • myGRID, CMCS, PASOA, ESSW, Tioga, Trio, ...
  • Network systems
  • IP/Accountable Internet Protocol (AIP)
  • Forensics: relating users to behavior, hosts to malicious activity
  • Sensor networks -- aggregation, caching, spacial organization
  • System: Programming languages and operating systems
  • Tainting, process and data coloring, blame tracking
  • PASS - provenance enabled storage (filesystem)
  • Data: Proof carrying data
  • proofs with data of creation condition (evaluation)

10

slide-11
SLIDE 11

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Challenges/Open Problems

  • The key design issues of provenance:
  • What to record (scope)?
  • How to represent it?
  • How to store it?
  • How query it?
  • How to secure it?
  • Authenticity, integrity, timeliness
  • Problems:
  • Mixing paint - aggregation, synthesis, and compression can

muddle the pedigree of data (vs. meta data explosion)

  • Privacy - there is a lot of semantic information in provenance,

even more can be inferred (statistical inferences effective)

11

slide-12
SLIDE 12

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Impact

  • Obviously, there is tension between
  • Collection/synthesis/retention of data (e.g., SOX) and
  • Privacy of data (e.g., HIPPA)
  • In practice, provenance will improve the communities

ability to identify, manage and mitigate risk

  • E.g., FDA, financial industries, clinical medicine,
  • Needed: regulatory guidance with respect not only to

data, but to the substance and handling of the provenance information to which it applies.

  • Unclear responsibilities/liabilities in handing provenance data

will likely slow advancement/adoption

12