MILCOM 2001 October page 1 Defense Enabling Using Advanced Middleware: An Example Franklin Webber, Partha Pal, Richard Schantz, Michael Atighetchi, Joseph Loyall BBN Technologies QuO

MILCOM 2001 October page 2 Defense-Enabled Software Applications Some software applications can be given increased resistance to malicious attack even though the environment in which they run is untrustworthy. Any such application is “defense-enabled”.

MILCOM 2001 October page 3 Research On Defense Enabling Sponsored by DARPA/ATO Part of Fault-Tolerant Networking Program

MILCOM 2001 October page 4 A Distributed Military Application

MILCOM 2001 October page 5 A Cyber-Attack

MILCOM 2001 October page 6 An Abstract View Attacker Data Processing (Fusion, Analysis, Storage, Forwarding, etc.) Data User Data Source

MILCOM 2001 October page 7 Traditional Security Attacker Application Private Resources Private Resources Limited Sharing Trusted OSs and Network

MILCOM 2001 October page 8 Most OSs and Networks In Common Use Are Untrustworthy Attacker Application Private Resources Private Resources Limited Sharing OSs and Network

MILCOM 2001 October page 9 Cryptographic Techniques Can Block (Most) Direct Access to Application Attacker Application Private Resources Private Resources Limited Sharing OSs and Network CryptoCrypto

MILCOM 2001 October page 10 Attacker Raw Resources CPU, bandwidth, files... OSs and NetworkIDSsFirewalls Firewalls Block Some Attacks; Intrusion Detectors Notice Others Application CryptoCrypto

MILCOM 2001 October page 11 Application Attacker Raw Resources CPU, bandwidth, files... QoS Management CryptoCrypto OSs and NetworkIDSsFirewalls Defense-Enabled Application Competes With Attacker for Control of Resources

MILCOM 2001 October page 12 QuO Adaptive Middleware Technology QuO is DARPA Quorum developed middleware that provides: interfaces to property managers, each of which monitors and controls an aspect of the Quality of Service (QoS) offered by an application; specifications of the application’s normal and alternate operating conditions and how QoS should depend on these conditions. QuO has integrated managers for several properties: dependability (DARPA’s Quorum AQuA project) communication bandwidth (DARPA’s Quorum DIRM project) real-time processing (using TAO from UC Irvine/WUStL) security (using OODTE access control from NAI) QuO

MILCOM 2001 October page 13 QuO adds specification, measurement, and adaptation into the distributed object model Application Developer Mechanism Developer CLIENT Network operation() in args out args + return value IDL STUBS IDL SKELETON OBJECT ADAPTER ORB IIOP ORB IIOP CLIENT OBJECT (SERVANT) OBJECT (SERVANT) OBJ REF CLIENT Delegate Contract SysCond Contract Network MECHANISM/PROPERTY MANAGER operation() in args out args + return value IDL STUBS Delegate SysCond IDL SKELETON OBJECT ADAPTER ORB IIOP ORB IIOP CLIENT OBJECT (SERVANT) OBJECT (SERVANT) OBJ REF Application Developer QuO Developer Mechanism Developer CORBA DOC MODEL QUO/CORBA DOC MODEL

MILCOM 2001 October page 14 The QuO Toolkit Supports Building Adaptive Apps or Adding Adaptation to Existing Apps QuO aspect languages –Contract description language and adaptive behavior description language –Code generators that weave QuO code into Java and C++ applications System Condition Objects –Provide interfaces to resources, managers, and mechanisms QuO Runtime Kernel –Contract evaluator –Factory object which instantiates contract and system condition objects Instrumentation library QuO gateway –Insertion of special purpose transport layers and adaptation below the ORB CORBA IDL Code Generators Code Generators Contract Description Language (CDL) Adaptation Specification Language (ASL) QuO Runtime Delegates Contracts

MILCOM 2001 October page 15 Implementing Defenses in Middleware for simplicity: QoS concerns separated from functionality of application. Better software engineering. for practicality: Requiring secure, reliable OS and network support is not currently cost-effective. Middleware defenses will augment, not replace, defense mechanisms available in lower system layers. for uniformity: Advanced middleware such as QuO provides a systematic way to integrate defense mechanisms. Middleware can hide peculiarities of different platforms. for reuseability Middleware can support a wide variety of applications.

MILCOM 2001 October page 16 Security Domains Limit the Damage From A Single Intrusion hacked domain host router domain host router domain host

MILCOM 2001 October page 17 Replication Management Can Replace Killed Processes hacked domain host router domain host router domain host application component replicas QuO replica management

MILCOM 2001 October page 18 Bandwidth Management Can Counter Flooding Between Routers hacked domain host router domain host router domain host QuO bandwidth management RSVP reservation

MILCOM 2001 October page 19 Other Defense Mechanisms Dynamically change communication ports Dynamically change communication protocols

MILCOM 2001 October page 20 A Defense Strategy Coordinates Defense Mechanisms “if several IDS alarms on host H, tighten firewall on H” “if multiple crashes on host H, move application process replicas elsewhere” For example: Applications we have defense-enabled use a variety of such rules, implemented in QuO.

MILCOM 2001 October page 21 Validation Effectiveness of individual defense mechanisms has been tested in-house. Effectiveness of combined defense strategies will be measured by Red Team experiments.

MILCOM 2001 October page 22 Conclusion The technique of defense enabling is likely to increase the survivability of military applications and, because defenses are implemented in middleware, can be applied with relatively little effort.