SilverLine: Data and Network Isolation for Cloud Services Yogesh - - PowerPoint PPT Presentation

▶
silverline data and network isolation for cloud services
SMART_READER_LITE
LIVE PREVIEW

SilverLine: Data and Network Isolation for Cloud Services Yogesh - - PowerPoint PPT Presentation

Sep 16, 2022 343 likes •548 views

SilverLine: Data and Network Isolation for Cloud Services Yogesh Mundada Anirudh Ramachandran Nick Feamster 1 Cloud Computing Advantages Reduced operational costs Reduced management overhead Easier resources scaling Lowers

slide-1
SLIDE 1

SilverLine: Data and Network Isolation for Cloud Services

Yogesh Mundada Anirudh Ramachandran Nick Feamster

1

slide-2
SLIDE 2

Cloud Computing Advantages

  • Reduced operational costs
  • Reduced management
  • verhead
  • Easier resources scaling
  • Lowers the barrier to

entry for new services Cloud revenue for 2010 was $68 billion. Estimated revenue for 2014 is $150 billion.

2

slide-3
SLIDE 3

Recent Cloud Data Leak Incidents

  • Microsoft BPOS cloud

service data breach (Dec 2010)

  • Heroku cloud application

platform vulnerability (Jan 2011)

  • Dropbox hash-tag security

flaw (May 2011)

3

Occurrences such as these make adoption of the cloud harder

slide-4
SLIDE 4

Top Cloud Computing Threats

  • Shared resources

– Heroku

4

  • Data loss and leakage

– Microsoft BPOS – Dropbox

slide-5
SLIDE 5

SilverLine Solution: Isolation

Problem Attack Solution

Data Loss Service exploit, Operating environment exploit, Misconfigurations SilverLine’s Information Flow Tracking and Control Network Side-Channels Gain more information about the environment through namespace, RTT and hop-count study SilverLine’s

  • bfuscation of

network metrics to reduce the information entropy.

5

slide-6
SLIDE 6
  • Information Flow Tracking

– Add taints or labels to data – Track the taints – System Call Hooks

  • Components of the system

– Tracker: Initialize and track taints, on end hosts – Enforcer: Stop unauthorized data flow, in the network

SilverLine Data Isolation

6

slide-7
SLIDE 7

7

Example Setting

SilverLine Storage service With automatically created labels for each database record

slide-8
SLIDE 8

8

Example Setting

Alex’s records are Labeled with a taint ‘A’

slide-9
SLIDE 9

9

Example Setting

VM instance that runs application logic

slide-10
SLIDE 10

10

Example Setting

Custom LOGIN module & Declassifier

slide-11
SLIDE 11

11

Example Setting

Network Level Enforcer in Dom0

slide-12
SLIDE 12

Normal User’s Interaction

Alex’s Worker Process

  • A2. Authen-

ticate Alex to Declassifier

  • A1. Login &

“Get My Balance”

  • A3. Start

Worker Process

  • A4. Get

Alex’s Balance

  • A5. Ans =

$100, Label=‘A’ A6. Labeled Replies

  • A7. Alex’s

Replies pass

  • A8. Reply

= $100

12

slide-13
SLIDE 13

An Attacker’s Interaction

Bob’s Worker Process

  • B1. Login,

SQL exploit to get Bob & Alex’s Balance

  • B2. Authen-

ticate Bob

  • B3. Start

Worker process

  • B4. Get

Bob & Alex’s Balance

  • B5. Ans=

($10,$100) Label=‘B,A’ B6. Labeled replies

  • B7. Bob’s

Replies are blocked

13

slide-14
SLIDE 14

SilverLine Configuration

  • Labeling Service

– Specify Taint Creation Policy

when query := “INSERT” and table := “USERS”: Generate a new label; add it to the DB record

  • Custom Login module

– Provided by each tenant – Authorizes legitimate users

14

slide-15
SLIDE 15

SilverLine Solution: Isolation

Problem Attack Solution

Data Loss Service exploit, Operating environment exploit, Misconfigurations SilverLine’s Information Flow Tracking and Control Network Side-Channels Gain more information about the environment through namespace, RTT and hop-count study SilverLine’s

  • bfuscation of

network metrics to reduce the information entropy.

15

slide-16
SLIDE 16
  • IP address obfuscation

– Actual Internal IP to Pseudo IP – OpenFlow protocol

  • Entirely in the software
  • Minimal changes

SilverLine Network Isolation

16

VM1 Click Software Router with OpenFlowClick VM2 VM3 Local Controller Actual IP Pseudo IP a.b.c.d w.x.y.z

  • Centralized

Controller

slide-17
SLIDE 17
  • Normalize network metrics

– Realistic RTTs between instances – Minimal threshold on hop counts – Modified openflow module for per packet decision

SilverLine Network Isolation

17

vitf0 vitf1 vitf1 eth0 vitf0 eth0 OpenFlowClick Element From External Virtual Machines To External Virtual Machines From Internal Virtual Machines To Internal Virtual Machines Delay Queue to simulate realistic delays between virtual machines

slide-18
SLIDE 18

Summary

  • Data Isolation: Information Flow Tracking
  • Network Isolation: Reducing the entropy of

the network side-channels

Future Work

  • Measure the taint leakage
  • Fine grained tainting in a VMM

SilverLine

18

slide-19
SLIDE 19

Questions

19

Bob’s Worker Process

  • B1. Login,

SQL exploit to get Bob & Alex’s Balance

  • B2. Authen-

ticate Bob

  • B3. Start

Worker process

  • B4. Get

Bob & Alex’s Balance

  • B5. Ans=

($10,$100) Label=‘B,A’ B6. Labeled replies

  • B7. Bob’s

Replies are blocked