Module: Cloud Computing Security Professor Trent Jaeger Penn State - - PowerPoint PPT Presentation

▶
module cloud computing security
SMART_READER_LITE
LIVE PREVIEW

Module: Cloud Computing Security Professor Trent Jaeger Penn State - - PowerPoint PPT Presentation

Sep 06, 2022 26 likes •429 views

slide-1
SLIDE 1

฀฀฀฀ ฀

  • ฀฀฀฀

฀฀฀฀฀ ฀฀฀฀฀฀

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Module: Cloud Computing Security

Professor Trent Jaeger Penn State University

1

slide-2
SLIDE 2

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Cloud Computing Is Here

2

Why not use it?

slide-3
SLIDE 3

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

What’s Happening in There?

3

slide-4
SLIDE 4

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Overview

  • Cloud computing replaces physical infrastructure
  • Is it safe to trust these services?

4

slide-5
SLIDE 5

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

From Data Center to Cloud

5

slide-6
SLIDE 6

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Reasons to Doubt

  • History has shown they are vulnerable to attack
  • SLAs, audits, and armed guards offer few guarantees
  • Insiders can subvert even hardened systems

6

‘06 ‘07 ‘08 ‘09 ‘10 ‘11

903 678 695 986 770 641

Data Loss Incidents External 54%

Unknown 7%

Insider 16% Accidental 23%

Incident Attack Vector

Credit: The Open Security Foundation datalossdb.org

slide-7
SLIDE 7

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Cloudy Future

  • New problem or new solution?
  • New challenges brought on by the cloud (plus old ones)
  • Utility could provide a foundation for solving such challenges

7

slide-8
SLIDE 8

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Cloudy Future

  • Improve on data centers? On home computing?
  • Seems like a low bar

8

slide-9
SLIDE 9

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

What is Cloud Computing?

  • Cloud vendor provides managed computing

resources for rent by customers

  • What do you want to rent?
  • (Virtualized) Hosts (Infrastructure as a Service)
  • Rent cycles: Amazon EC2, Rackspace Cloud Servers, OpenStack
  • Environment (Platform as a Service)
  • Rent instances: Microsoft Azure, Google App Engine
  • Programs (Software as a Service)
  • Rent services: Salesforce, Google Docs
  • Other variations can be rented

9

slide-10
SLIDE 10

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

What is Cloud Computing?

10

slide-11
SLIDE 11

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

IaaS Platform: OpenStack

11

Client

Scheduler Network Controller Cloud Database Message Queue Volume Store Image Store

Cloud API

Cloud Customer

Cloud Node

Instances

Cloud Vendor

slide-12
SLIDE 12

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

PaaS Platform: Google App

  • Platform for deploying language-specific apps
  • Java, Python, PHP

, etc.

  • Vendor provides OS and middleware
  • E.g., Web server, interpreters
  • Customers deploy their customized apps
  • You focus on custom code
  • Clients use these apps
  • Analogously to IaaS

12

slide-13
SLIDE 13

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

How to Build an IaaS Cloud?

  • Vendors obtain hardware resources for
  • Various cloud services: API, Messages, Storage, Network, ...
  • Compute nodes for running customer workloads
  • Install your hardware
  • Need to choose software configurations specific for services

and compute nodes

  • Start your hosts
  • Join the cloud - services and available compute nodes
  • Now your cloud is running
  • Have fun! Customers are ready to use your services and nodes

13

slide-14
SLIDE 14

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

How to Use an IaaS Cloud?

  • Customers choose an OS distribution
  • These are published by the cloud vendor and others
  • Obtain cloud storage necessary to store these and your data
  • Configure your instance (VM)
  • Prior to starting - enable you to login and others to access the

instance’s services

  • Start your instance
  • Boots the chosen OS distribution with the configurations
  • Now your instance is running
  • Have fun! Login via SSH or ready for your clients

14

slide-15
SLIDE 15

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Multiple Stakeholders

15

Cloud Node Cloud Instance (VM) Client Data

Clients Service Providers Cloud Administrators

Is my platform secure? Are my services running correctly? Are my data protected?

slide-16
SLIDE 16

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

VM

Cloud Complexity

  • Cloud environment challenges
  • Opaque, Complex, Dynamic
  • Insiders, Instances, Co-hosting

16

Client

Service

Cloud Node Cloud Node Cloud Node Cloud Node

VM VM VM

Cloud Platform

slide-17
SLIDE 17

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

What Could Go Wrong?

  • What do customers depend on from the cloud?
  • Trust Model
  • Are those parties worthy of our trust?
  • Who are potential adversaries in the cloud?
  • Threat Model
  • Are customers protected from their threats?
  • What would be ideal from a security standpoint?
  • Ideal Security Model
  • How many trusted parties and how many threats?

17

slide-18
SLIDE 18

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Published Instances

18

!"#$%&'((& )*#+,&

  • .&/#012$+,&

3.&405*6076*,& 8.&$5,& 9.&($:"45;& <.&405*6076*,&

!"#$%&'()* +,-&".()*

!),/%0()*

=05*60/,>3'?=>3& =05*60/,>-'?=>-& '?=>3& '?=>-&

Consumers use published instances Who do you trust? What are threats?

slide-19
SLIDE 19

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

SSH Study [AmazonIA]

19

  • Publisher left an SSH user authentication key in

their AMI

  • Fortunately, Amazon agreed that this is a violation
  • Unfortunately, it was not an isolated problem
  • 30% of 1100 AMIs checked contained such a key
  • Also, pre-configured AMIs had SSH host keys
  • Thus, all instances use the same host key pair
  • Implications?
slide-20
SLIDE 20

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Security Configuration

  • Zillions of security-relevant configurations for instances
  • Do you have the right code and data installed?
  • Are you running the expected code?
  • Discretionary access control
  • Firewalls
  • Mandatory access control
  • SELinux, AppArmor, TrustedBSD, Trusted Solaris, MIC
  • Application policies (e.g., Database, Apache)
  • Pluggable Authentication Modules (PAM)
  • Application configuration files
  • Plus new configuration tasks for the cloud - e.g., storage

20

slide-21
SLIDE 21

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Cloud Service Vulnerabilities

  • Vulnerabilities have been found in cloud services
  • E.g., OpenStack identity service, web interface, and API service
  • Adversaries who compromise such services may launch

a variety of attacks

  • E.g., Key Injection Attack

21

API Service Compute Service Database API Service

nova keypair-add mykey nova boot --key-name mykey

mykey : ssh-rsa ABC mykey : ssh-rsa ABC ssh-rsa ABC ssh-rsa DEF

Step 1 Step 2

slide-22
SLIDE 22

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Insiders

  • Although the vendor may have a good reputation, not every

employee may

22

Trust me with your code & data Cloud Provider Client You have to trust us as well Cloud operators

slide-23
SLIDE 23

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Insider Threats

  • May trust the cloud vendor company
  • But, do you trust all its employees?
  • Insiders can control platform
  • Determine what software runs consumers’ code
  • Insiders can monitor execution
  • Log instance operation from remote
  • Insiders may have physical access
  • Can monitor hardware, access physical memory, and

tamper secure co-processors

23

slide-24
SLIDE 24

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Co-Hosting Threats

  • An instance co-hosted on the same physical

platform could launch attacks against your instance

  • Co-hosted instances share resources
  • Computer
  • CPU, Cache, Memory, Network, etc.
  • Shared resources may be used as side channels to

learn information about resource or impact its behavior

24

slide-25
SLIDE 25

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Resource Freeing Attacks

  • Setup
  • Victims
  • One or more

VMs with public interface

  • Beneficiary
  • VM whose performance we want to

improve (contend over target resource)

  • Helper
  • Mounts attack using public interface

25

Helper& VM# VM# Vic&m# Beneficiary#

slide-26
SLIDE 26

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Resource Freeing Attacks

  • Resource contention over the CPU
  • Schedule beneficiary more frequently
  • Attack: shift resource usage via public interface
  • Normally, victim is scheduled and pollutes the cache
  • Approach lower scheduling priority
  • Make victim appear CPU-bound

26

RFA$intensi*es$–$*me$in$ms$per&second& 196%$slowdown$ 86%$slowdown$ 60%$ Performance$ Improvement$

slide-27
SLIDE 27

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Preventing Vulnerabilities

  • How would you prevent these threats?
  • Misconfigured instances
  • Untrusted cloud services
  • Insiders
  • Side channels
  • (Attacks to cloud platform also)

27

slide-28
SLIDE 28

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Verifiable Computation

  • Your services are black boxes - to the cloud!
  • Send a program and encrypted data
  • Program computes over encrypted data
  • Scheme: KeyGen (for Program), Compute (Program),

Verify

28

Service

Data

Client

Depends on heavy crypto - homomorphic encryption

slide-29
SLIDE 29

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Pinocchio [Oakland 2013]

  • New cryptographic protocol for general-purpose public verifiable

computation with support for zero-knowledge arguments

  • Big advance: Performance
  • History: PCP (2007) = 72 trillion years, GGP (2010) = 37

centuries, Pepper/Ginger (2012) = 6 oom improvement, Pinocchio = 7 oom improvement (often ~10ms)

  • Encoding in “quadratic programs”; signature depends only on

security constant

  • Idea behind quadratic arithmetic programs: each multiplication

gate is a “small expression”. Construct polynomials that encode the equations, such that if the evaluation is correct, then D(z) / P(z). Then the protocol just checks divisibility randomly

  • Beats local C execution (for verification)

29

slide-30
SLIDE 30

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Service

Integrity Monitor Concept

  • Integrity monitor similar to a reference monitor
  • Mediate access to service based on integrity criteria
  • Challenges
  • Where do we measure integrity-relevant events?
  • How do we verify ongoing integrity?
  • How can we deploy this in a cloud environment?

30

Integrity Monitor

Client

Data

Service

Data

slide-31
SLIDE 31

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Excalibur

  • Policy-sealed data [USENIX Sec 2012b]
  • Do not release my data to the cloud until that cloud satisfies

my requirements

  • Customer-chosen policy
  • How to ensure that only nodes that satisfy customer-

chosen policy get data?

  • Attribute-based encryption
  • Encrypt data using ABE description of load-time configuration
  • A verifiable monitor is trusted to delegate correct credentials

to nodes (using hardware-based attestations - e.g., via TPM)

31

slide-32
SLIDE 32

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Excalibur Approach

32

4/19/13 Nuno Santos 13

! Check node

configurations

! Monitor attests

nodes in background

! Scalable policy

enforcement

! CP-ABE

  • perations at

client-side lib

Monitor

Customer

Policy-Sealed Data

+

seal unseal attest & send credential Datacenter

From Nuno Santos’ slides

slide-33
SLIDE 33

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Runtime Monitoring

  • Excalibur does not address runtime issues with instance
  • Customers may want to ensure that clients of their services
  • nly receive communications from satisfactory instances
  • Customer may want to take remediative actions

33

slide-34
SLIDE 34

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Client Cloud Node VM

Channel Mediator

Integrity Verification Proxy

(1) Register criteria (2) Verify Monitor / Node (3) Verify VM (4) Connect (5) Report Violation

Measure

Framework

Modules

Monitor VM

Integrity Verification Proxy

  • Clients specify criteria to be enforced by a channel

mediator [TRUST 2012]

  • Set of measurement modules verifies the criteria
  • Loadtime modules measure

VM components

  • VM Introspection to examine runtime criteria
  • E.g., Binaries/data loaded, enforcement disabled, policy changes,

kernel data (binary handler), etc.

34

slide-35
SLIDE 35

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Cloud Verifier Overview

35

Node Client Cloud Instance Node Cloud Instance Cloud Verifier

IVP

Client

Client monitors CV and cloud criteria IVP monitors cloud instance Client provides criteria Client criteria sent to IVP CV monitors cloud node

Block connection at the Cloud Node Disable Cloud Node Client stops using Cloud

Cloud Anchor [CCSW 2010, TrustCom 2012] +IVP in OpenStack [CSAW 2013]

slide-36
SLIDE 36

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Customer-Driven Monitoring

  • CV/IVP Limitation
  • IVP must be trusted by cloud vendor
  • Part of management

VM

  • What if you need to perform monitoring that the cloud

vendors will not support?

36

slide-37
SLIDE 37

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Self-Service Clouds

  • Customizable cloud platform stack [CCS 2012]

37

Why do these problems arise?

Hardware Hypervisor

Management$ VM$(dom0)$

Work" VM" Work" VM" Work" VM"

Slides courtesy of Vinod Ganapathy

slide-38
SLIDE 38

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Self-Service Clouds

  • Customizable cloud platform stack [CCS 2012]

38

Hardware Hypervisor

Management$ VM$

Client’s$VMs$

slide-39
SLIDE 39

Systems and Internet Infrastructure Security (SIIS) Laboratory Page

Self-Service Clouds

  • Customizable cloud platform stack [CCS 2012]
  • UDom0 boots customer-defined Service

VMs

39

Hardware SSC Hypervisor

SDom0$

Work$ VM$ Work$ VM$

UDom0$ Client’s$metaBdomain$

Service$ VM$

Equipped$with$a$Trusted$Plaiorm$Module$(TPM)$chip$

slide-40
SLIDE 40

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Take Away

  • Cloud computing is here to stay
  • In some form
  • May be a solution or a problem or both
  • Introduces new types of vulnerabilities into systems we

ran on data centers - which had vulnerabilities to begin with

  • Ultimately, have to improve service providers’ jobs
  • Make it easy to ensure that systems perform as expected
  • Two possible methods
  • Verifiable computation and instance monitoring

40