Analysis of Terminal Server Architectures for Thin Clients in a High Assurance Network Steven R. Balmer & Cynthia E. Irvine Department of Computer Science Naval Postgraduate School

Agenda Introduction Terminal server topology NPS multilevel secure LAN Seven terminal server topologies & analysis Summary

Introduction Paper Focus Examination of the architectural and security impact of using terminal servers to support thin clients within the context of a high assurance multilevel network Base Project Naval Postgraduate School(NPS) Multilevel Secure Local Area Network (MLS LAN) project

Terminal Server Topologies Multi-user terminal server Deliver the graphic user interface and keyboard service to clients Run operating system and application A protocol interface between the server and the client Client software Permit PC on LAN acting as terminal

Basic Terminal Server Architecture PC LAN Terminal Server

Enterprise Terminal Server Architecture PC LAN Terminal Server Cluster Application Server Cluster

NPS Multilevel Secure LAN Building a system to provide controlled sharing of labeled information Permitting users to access the information through popular pc-based COTS personal and office productivity application

NPS Multilevel Secure LAN Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted

NPS Multilevel Secure LAN Components Application server High assurance base (HAS) (Sever-end) Client workstations Trusted computing based extension (TCBE) (User-end)

Trusted Mail Sever Mail server application with high assurance TCB Supports sharing and labeling information Permits user view of the system of mailboxes at or below the user’s current session level

High Assurance Base Enforce security policy Prevent sensitive data exfiltration Prevent corruption of information of higher integrity Provide multiple users with different access classes to communication with server through single physical network Trusted path Session-level negotiation Single-level session communications at different session level

Client Workstation Thin client Diskless Object reuse Sufficient volatile RAM-disk capability TCBE Ensure RAM or other volatile storage are purged with each change of session level or new user login at the workstation

Trusted Computing Base Extension Secure attention key(SAK) Protected communication channel between TCB and TCBE Mechanism to ensure high assurance object reuse Controlled delivery of operating system and application software to client PC

Terminal Server As Peer Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted Terminal Server

Terminal Server As Peer Analysis Strength Scalable Efficient Weakness LAN communication Terminal Server Low assurance Lack of isolation

Terminal Server in Series With HAS Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted Terminal Server

Terminal Server in Series With HAS Analysis Strength Protected LAN communication Weakness Heavy workload on HAS Terminal server Low assurance Lack of isolation

TCBE Enhanced Terminal Server Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted Terminal Server TS-TCBE

TCBE Enhanced Terminal Server Analysis Strength More efficient runtime communication between client and terminal server Protected LAN communication Weakness Terminal server Low assurance Lack of isolation

Per-sensitivity-level Unenhanced Terminal Server Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted HIGH Terminal Server LOW Terminal Server

Per-sensitivity-level Unenhanced Terminal Server Analysis Strength Physical separate terminal servers with different classification level Weakness Lack of communication protection Terminal server  client/TCBE Terminal server Low assurance

Multiple Terminal Servers in Series with High Assurance Server Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted HIGH Terminal Server LOW Terminal Server

Multiple Terminal Servers in Series With High Assurance Server Analysis Strength LAN communication protection Weakness Heavy workload on HAS Lack of scalability

Multiple TCBE-enhanced Terminal Servers Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted HIGH Terminal Server LOW Terminal Server TS-TCBE

Multiple TCBE-enhanced Terminal Servers Analysis Strength More efficient runtime communication between client and terminal server LAN protected communication Vulnerability Terminal server Low assurance Lack of scalability

Terminal Servers Running on a Secure Virtual Machine Monitor Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted Secure VMM HIGH Terminal Server LOW Terminal Server

Terminal Servers Running on a Secure Virtual Machine Monitor Analysis HAS enforces security policies through separation of data VMM enforces policies through the creation of virtual machines at different sensitivity levels TCBE supports SAK, protected communication interface, object reused controls on client

Summary Identify Three secure configurations Multiple TCBE-Enhanced Terminal Servers Suffer performance problem Lack of scalability Multiple Terminal Servers in Series Lack of scalability Terminal Servers on a High Assurance VMM Ideal Conclusion Using terminal server in a high assurance context with many sensitivity levels is Impractical!

What we learnt ? VMM Support multi-access level Thin client Object reuse Centralized management The whole architecture