1. Anna Giannakou Christine Morin, Jean-Louis Pazat, Louis Rilling
AL-SAFE: A Secure Self-Adaptable Application-Level Firewall for IaaS Clouds
Anna Giannakou
Christine Morin, Jean-Louis Pazat, Louis Rilling

2. Infrastructure as a Service Clouds

3. Infrastructure as a Service Clouds

4. Infrastructure as a Service Clouds

5. Infrastructure as a Service Clouds

6. Infrastructure as a Service Clouds

7. Infrastructure as a Service Clouds

8. The Need for Adaptable Security Monitoring
IaaS cloud environments are very dynamic
Topology-related changes (VM creation, deletion, migration)
Traffic load fluctuation
Service addition/removal
Traditional security monitoring is ineffective
Reconfiguration of monitoring system should be automated
Several actors with different security requirements (declared in the SLA)

9. Firewalls
Rule-based configuration

10. Application-level Firewalls: Overview
Complete overview of the host they are running on

11. Application-level Firewalls: Vulnerabilities

12. Application-level Firewalls: The way of the Introspection
How to secure an application-level firewall?
Our Approach: Use virtual machine introspection

13. Approach: Two-level Firewall
External firewall:
Block malicious traffic early
No CPU% cost in running VMs
At the switch level:
Block inter VM traffic
Less network load
Less traffic load on
other probes
Both firewalls:
Self-configurable rule sets

14. Two-level Firewall: Initial Set-up

15. Two-level Firewall: Introspection

16. Two-level Firewall: White-list Comparison

17. Two-level Firewall: Rule Creation

18. Two-level Firewall: Rule Insertion-External

19. Two-level Firewall: Rule Insertion-Switch

20. Two-level Firewall: Complete Approach

21. Two-level Firewall: SAIDS Integration
Towards Self Adaptable Security Monitoring in IaaS Clouds. A. Giannakou et al. In Cluster, Cloud and Grid Computing (CCGrid), May 2015

22. Implementation & Current Status
Implementation details:
Prototype in OpenStack and Open vSwitch
Nftables as external firewall
LibVMI + Volatility for introspection
Current Status:
Performance evaluation:
Process/Network intensive applications
Normal cloud operations (e.g VM migration)
Micro-benchmarks
Correctness
Filter out all unauthorized packets

23. Conclusion Conclusion Future work
Application-level firewalls are vulnerable to host compromisation
We can address this vulnerability through virtualization and introspection
Future work
Address multi-tenancy
Enable component sharing

24. Thank you