The Starfish System: Intrusion Detection and Intrusion Tolerance for Middleware Systems Kim Potter Kihlstrom Westmont College Santa Barbara, CA, USA Priya Narasimhan Carnegie Mellon University Pittsburgh, PA, USA

The Starfish SystemKihlstrom and Narasimhan Motivation Previous work SecureRing [ACM TISSEC 2001] Eternal [TAPOS 1998] Immune [ICDCS 1999] Byzantine fault detectors [Computer Journal 2003] Insights and lessons learned Cost of survivability Replication of objects Input and output majority voting Guarantees of underlying multicast protocol Detection and removal of faulty processors/replicas

The Starfish SystemKihlstrom and Narasimhan Immune: Looking Back Interception Replication Majority voting Secure multicast protocols

The Starfish SystemKihlstrom and Narasimhan Immune: Looking Ahead Issues left open Scalability Increasing number of objects Increasing number of processors Local area to wide area Bandwidth Survivability of Immune itself Voting Other middleware systems besides CORBA Led to development of Starfish

The Starfish SystemKihlstrom and Narasimhan Starfish Goals Intrusion detection and intrusion tolerance for middleware applications Not specific to any middleware system Infrastructural support for majority voting End-to-end intrusion detection Applicable to local and wide area systems Currently under development

The Starfish SystemKihlstrom and Narasimhan Starfish Organization

The Starfish SystemKihlstrom and Narasimhan Starfish Philosophy Central core Highly secure Tightly coupled Arms Less tightly coupled Less stringent security guarantees Can be removed in event of security compromise New arms can be grown

The Starfish SystemKihlstrom and Narasimhan Starfish Structure

The Starfish SystemKihlstrom and Narasimhan System Model Assumptions Distributed object system Asynchronous Determinism Faults Communication Processor Object

The Starfish SystemKihlstrom and Narasimhan Support for Voting Objects are replicated Replica consistency in event of malicious processor and object replica faults Object group abstraction

The Starfish SystemKihlstrom and Narasimhan Support for Voting Voting in a dynamic environment Knowledge of how many votes constitute a majority Voter must know the number of replicas in the originating object group Hierarchical membership structure Object groups and voting groups

The Starfish SystemKihlstrom and Narasimhan Support for Voting

The Starfish SystemKihlstrom and Narasimhan End-to-End Intrusion Detection Removal of faulty replica from object group and all voting groups To remove a faulty replica, all replicas in object group must receive evidence of value fault Special Value_Fault_Vote message Value fault detector

The Starfish SystemKihlstrom and Narasimhan End-to-End Intrusion Detection

The Starfish SystemKihlstrom and Narasimhan End-to-End Intrusion Detection

The Starfish SystemKihlstrom and Narasimhan End-to-End Intrusion Detection

The Starfish SystemKihlstrom and Narasimhan End-to-End Intrusion Detection

The Starfish SystemKihlstrom and Narasimhan End-to-End Intrusion Detection

The Starfish SystemKihlstrom and Narasimhan End-to-End Intrusion Detection Removal of processor hosting faulty replica from system Byzantine fault detector To remove the processor, all processors must vote locally on the same set of votes Special base group Problem with cascading: fault must be handled first at the object level

The Starfish SystemKihlstrom and Narasimhan Survivability in Starfish ClassificationFaultMechanism Communication Message loss Reliable delivery mechanisms Message retransmission Message corruption Message digest Message retransmission Processor Processor crash Processor, object, and voting group membership Failure to receive Processor, object, and voting group membership Malicious processor Byzantine fault detector Object Replica crash Object and voting group membership Send omission Majority voting on invocations and responses Value faultValue fault detector

The Starfish SystemKihlstrom and Narasimhan Conclusions Development underway Prior experience in building systems SecureRing Eternal Immune Take insights and lessons in building next generation survivable object system: Starfish

The Starfish SystemKihlstrom and Narasimhan Starfish Intrusion detection and intrusion tolerance for middleware applications Not specific to any middleware system Infrastructural support for majority voting End-to-end intrusion detection Applicable to local and wide area systems

The Starfish SystemKihlstrom and Narasimhan Questions and Feedback Kim Potter Kihlstrom Priya Narasimhan