How can we specify high-level security goals for clouds and be sure that the infrastructure actually fulfills the goals? Presented at the EU Cyber Security and Privacy Forum 2012.

1. VALID Rules
A Language for Cloud Security
Dr. Thomas Gross
joint work with
Sören Bleikertz, IBM Research
Sebastian Mödersheim, DTU Informatics
[Work partially done while at IBM Research - Zurich]

2. What's our challenge?
[Automated Information Flow Analysis of Virtualized Infrastructures; ESORICS'11]

3. A Tale of a Bank's Private Cloud
Bank offloads IT to (private) cloud
Isolation of security zones
Network:
VLAN isolation
Storage:
Backup
Different storage volumes High Zone
Compute: Security
Covert-channels Low
unconsidered Security
[Photo:http://www.flickr.com/photos/teegardin/5737823348/]

4. The Ideal World: Cloud Topology
D0 VM1 VM2 D0 VM1 VM2 D0 VM1 VM2 VMs
Xen VMWare System p Hypervisors
HW HW HW
vSwitch vSwitch vSwitch Virtual Net
pSwitch Physical Net
S1 S2 Storage
WAN Global Net

5. The Real World
1,300 VMs
25,000 Nodes
30,000 Edges
[Data from a customer case study with a global financial institution]

6. Combat Against Complexity
Our Opponent
Complex Topology
Multi-tenancy
Changing System
Our Battle Plan
Versatile Tool Chain
Free Specification
of Security Goals
“Days of a startup”
http://www.flickr.com/photos/tangysd/

7. How to specify security goals?
[A Virtualization Assurance Language for Isolation and Deployment; POLICY'11]

8. Basis: Graph Model (e.g., Info Flows)
Sink
Source

9. Trust Assumptions: Traversal Rules
Behavior of
Components
Storage connections
Network connections
Isolation
Tailored
by administrator
Exchange format

10. Example Goal: Zone Isolation
section types:
MA, MB : machine
ZA, ZB : zone
section goals:
goal isolationBreach (info; ZA, ZB, MA, MB) :=
contains (ZA, MA).contains (ZB, MB)
.connected (MA, MB)
& not(equal(ZA, ZB))
[VALID is based on ASLan, proposed by the EU FP7 project AVANTSSAR]

11. Example Goal: Zone Isolation
section types: Declaration of Variables
MA, MB : machine
ZA, ZB : zone
section goals:
goal isolationBreach (info; ZA, ZB, MA, MB) :=
contains (ZA, MA).contains (ZB, MB)
.connected (MA, MB)
& not(equal(ZA, ZB))

12. Example Goal: Zone Isolation
section types:
MA, MB : machine
ZA, ZB : zone
section goals: Declaration of Alarm State
goal isolationBreach (info; ZA, ZB, MA, MB) :=
contains (ZA, MA).contains (ZB, MB)
.connected (MA, MB)
& not(equal(ZA, ZB))

13. Example Goal: Zone Isolation
section types:
MA, MB : machine
ZA, ZB : zone
section goals:
goal isolationBreach (info; ZA, ZB, MA, MB) :=
contains (ZA, MA).contains (ZB, MB)
.connected (MA, MB)
& not(equal(ZA, ZB)) Pattern Matching Facts

14. Example Goal: Zone Isolation
section types:
MA, MB : machine
ZA, ZB : zone
section goals:
goal isolationBreach (info; ZA, ZB, MA, MB) :=
contains (ZA, MA).contains (ZB, MB)
.connected (MA, MB) Zone Membership Fact
& not(equal(ZA, ZB))

15. Example Goal: Zone Isolation
section types:
MA, MB : machine
ZA, ZB : zone
section goals:
goal isolationBreach (info; ZA, ZB, MA, MB) :=
contains (ZA, MA).contains (ZB, MB)
.connected (MA, MB)
& not(equal(ZA, ZB)) Connectivity Fact

16. Example Goal: Zone Isolation
section types:
MA, MB : machine
ZA, ZB : zone
section goals:
goal isolationBreach (info; ZA, ZB, MA, MB) :=
contains (ZA, MA).contains (ZB, MB)
.connected (MA, MB)
& not(equal(ZA, ZB))
Logical Constraints

17. Library of Alarm States
Zoning
Breach
Deployment
Breach

18. How to verify the security of
an infrastructure?
[Automated Verification of Virtualized Infrastructures; CCSW'11]

19. TEST
HIGH SECURITY

20. TEST
MB
vlan1
IsolationBreach?
contains (ZA, MA).
vlan1 contains (ZB, MB).
MA connected (MA, MB)
& not(equal(ZA, ZB))
HIGH SECURITY
ZA,ZB

21. ZB
TEST
MB
vlan2
MA
vlan1
IsolationBreach?
contains (ZA, MA).
contains (ZB, MB).
connected (MA, MB)
& not(equal(ZA, ZB))
HIGH SECURITY
ZA

22. TEST
MB
IsolationBreach?
MA contains (ZA, MA).
contains (ZB, MB).
connected (MA, MB)
& not(equal(ZA, ZB))
HIGH SECURITY
ZA,ZB

23. ZB
TEST
MB
vlan3
vlan3
IsolationBreach
contains (ZA, MA).
contains (ZB, MB).
MA connected (MA, MB)
& not(equal(ZA, ZB))
HIGH SECURITY
ZA

24. Verification Tool Chain
[Contribution to EU FP7 project TCLOUDS]

25. Problem Solvers
Dynamic Problem Solvers: AVANTSSAR platform
Input: ASLan/IF (basis of VALID)
OFMC
SAT-MC
Cl-AtSe
Static Problem Solvers:
Input: proprietary language for first-order logic
SPASS
ProVerif
SuccintSolver

26. Verification of Zone Isolation
The Challenge
Three security zones Test, Base, High
Multiple VMs in each zone (contains(zone, vm))
Network isolation realized using VLANs
Input: Policy and information flow graph
Output: Isolation breach

27. Performance
4h
Test Environment
Cluster 1: isolation breach
15386 nodes, 17817 edges
Cluster 2: safe
6218 nodes, 7543 edges
Experiments
1: Simplified graph, attack
2: Simplified graph, safe
3: Non-simplified graph, attack
4: Non-simplified graph, safe

28. VALID Rules for Goal Specification
Expressive Policy Language
Pattern matching on positive facts
Logical predicates as constraints
Efficient Verification with Versatile Tool Chain
Next Big Step: Dynamic Problems

29. Get in Touch!
thomas.gross@ncl.ac.uk
Thomas Gross http://www.thomasgross.net
Computing Science@
http://www.cs.ncl.ac.uk
http://cccs.ncl.ac.uk