Enterprise Wrappers OASIS PI Meeting Feb. 15, 2001 Mark Feldman Lee ftp://ftp.tislabs.com/pub/wrappers

A Parallel, Collaborative Effort Using Previous DARPA Research Prototypes as a Base Teknowledge: Windows NT/2000 NAI Labs: Multi-Platform, concentrating on Linux under this program ftp://ftp.tislabs.com/pub/wrappers

Previous, Host-Based Prototype Design Goals Augment, Transform, Deny all interactions between COTS applications and resources on a COTS system (syscall interface on UNIX, DLLs on NT). High level of abstraction to remove ugliness of kernel or DLL API programming. Elegant, powerful language and environment Portability Non-bypassability

Existing UNIX Prototype FreeBSD, Solaris 2.6, Linux 2.2.x, Windows NT About 50K lines of (commented) C, Yacc, Lex, and Java. Now under the GNU GPL! Download it at: ftp://ftp.tislabs.com/pub/wrappers Wrapper Specifications in WDL Program OS Kernel External API Internal API Wrapper Enforcement Layer Program Wrapper GUI “DBMS” W1 W2 … Wn Dynamic OS Kernel Module

Accomplishments to Date Validation of hypothesis: practical security-enforcing wrappers can be added to broad-market COTS components with high performance, compatibility, portability. Numerous wrappers implemented: –administrative privilege control, synthetic execution environment, diagnostics, access control... –Suite of intrusion-detection wrappers. –Collection of intrusion-response wrappers. –Napoleon policy-enforcement wrapper. Available on systems of greatest impact. ftp://ftp.tislabs.com/pub/wrappers

Enterprise Wrappers Goals  Integrate host-based wrappers into scalable cyber- defense system  Create common, multi-platform, policy-enforcing infrastructure  Populate this infrastructure with useful monitors, authorizers, and controllers  Dynamically ensure a consistent, enterprise-wide policy “Scaling the power of the wrapper to the enterprise”

Enterprise Wrappers Objectives NWM Network Schema & Data Hardened System “Soft” System Manager Interface Other IA components, such as intrusion detection, sniffers, secure DNS, IDIP, etc. Boundary Controller... service WMI proxy Control Protocol Data Push/Pull Wrapper Network Interface –Off-board cyber-defense controllers –Off-board communication of wrapper data Host Controller –Manages dynamic insertion and removal of Wrappers –Multi-platform (Linux and NT) –Network-scalable Mutual protection/isolation of Host Controller & Wrappers from the system(s) being protected Linux or NT Wrapper Subsystem Data Base Hardened System(expanded) Host Controller M M M M MediationCocoon App M M M M MediationCocoon App

Integrating Enterprise Wrappers into 3GS Architecture Sense Detect Arbitrate Respond Wrapper i Wrapper Integration Modularize into SD,A,R Alerts Out Response Action Out Event access to modules Wrapper Policy Wrapper Policy Protocol Protocol for Arbitrate substitution Arbitrate Host Controller Wrapping Policy Off-BoardOn-Board Host Controller Integration Wrapping Policy Protocol Respond Wrapper Installer

Enterprise Wrapper APIs Enterprise lifecycle scales from host-based lifecycle. Deployed Deploy Installed Install Active Activate Sensed Deactivate Defined UndeployUninstall Define Focus Conceptual

InstalledDefined Enterprise Wrapper APIs Legend: Generates new instance of target state machine Destroys current instance of source state machine DeployedInstalledActiveDefined DeployInstallActivate UndeployUninstallDeactivate (Wrapper Def.) (Host) (Exec. Inst.) Define Sensed Focus

UNIX Wrapper Adapter Wrapper Policy Definition –Compiled WDL program (the wrapper) –Activation Criteria –Database contents for data-driven behavior Interfaces with existing API to allow secure, remote administration Provide publish/subscribe (pull) and push model for all wrapper data (wrappers, alerts, data)

Base Task: Options: Months after Project Start Option 3 Option 4 Option 5 Option 6 Option 7 Option 8 Option 9 Option 10 Option 11 Option 12 Option 13 Option 14 Option 1 Option 2 Task 1 Task 2 Host Controller Enterprise Wrapper Infrastructure Privilege Control Wrapper Program Sandboxing Wrapper Controlled Execution Wrapper Spec. Based Intrusion Detection Wrapper Synthetic Execution Environment Wrapper Windows NT Stand-Alone Wrapper Crypto. Resource Protection Wrapper Untrusted Wrapper Protection Intrusion Detection Response Wrapper Authentication Wrapper Integrity Labels Wrapper Host Boundary Controller Composition Safety Analysis Network Shield Controller Prototype Untrusted Wrapper Protection Network Wrapper Manager Project Milestones /12/00

Recent Work Development of common API Modularity of our LKM to provide –Composability with other LKMs under Linux that intercept system calls –Use of our “database” to other LKMs

Questions? ftp://ftp.tislabs.com/pub/wrappers Final Thought