1. Analysis of Terminal Server Architectures for Thin Clients in a High Assurance Network Steven R. Balmer & Cynthia E. Irvine Department of Computer Science Naval Postgraduate School

2. Agenda Introduction Terminal server topology NPS multilevel secure LAN Seven terminal server topologies & analysis Summary

3. Introduction Paper Focus Examination of the architectural and security impact of using terminal servers to support thin clients within the context of a high assurance multilevel network Base Project Naval Postgraduate School(NPS) Multilevel Secure Local Area Network (MLS LAN) project

4. Terminal Server Topologies Multi-user terminal server Deliver the graphic user interface and keyboard service to clients Run operating system and application A protocol interface between the server and the client Client software Permit PC on LAN acting as terminal

5. Basic Terminal Server Architecture PC LAN Terminal Server

6. Enterprise Terminal Server Architecture PC LAN Terminal Server Cluster Application Server Cluster

7. NPS Multilevel Secure LAN Building a system to provide controlled sharing of labeled information Permitting users to access the information through popular pc-based COTS personal and office productivity application

8. NPS Multilevel Secure LAN Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted

9. NPS Multilevel Secure LAN Components Application server High assurance base (HAS) (Sever-end) Client workstations Trusted computing based extension (TCBE) (User-end)

10. Trusted Mail Sever Mail server application with high assurance TCB Supports sharing and labeling information Permits user view of the system of mailboxes at or below the user’s current session level

11. High Assurance Base Enforce security policy Prevent sensitive data exfiltration Prevent corruption of information of higher integrity Provide multiple users with different access classes to communication with server through single physical network Trusted path Session-level negotiation Single-level session communications at different session level

12. Client Workstation Thin client Diskless Object reuse Sufficient volatile RAM-disk capability TCBE Ensure RAM or other volatile storage are purged with each change of session level or new user login at the workstation

13. Trusted Computing Base Extension Secure attention key(SAK) Protected communication channel between TCB and TCBE Mechanism to ensure high assurance object reuse Controlled delivery of operating system and application software to client PC

14. Terminal Server As Peer Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted Terminal Server

15. Terminal Server As Peer Analysis Strength Scalable Efficient Weakness LAN communication Terminal Server Low assurance Lack of isolation

16. Terminal Server in Series With HAS Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted Terminal Server

17. Terminal Server in Series With HAS Analysis Strength Protected LAN communication Weakness Heavy workload on HAS Terminal server Low assurance Lack of isolation

18. TCBE Enhanced Terminal Server Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted Terminal Server TS-TCBE

19. TCBE Enhanced Terminal Server Analysis Strength More efficient runtime communication between client and terminal server Protected LAN communication Weakness Terminal server Low assurance Lack of isolation

20. Per-sensitivity-level Unenhanced Terminal Server Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted HIGH Terminal Server LOW Terminal Server

21. Per-sensitivity-level Unenhanced Terminal Server Analysis Strength Physical separate terminal servers with different classification level Weakness Lack of communication protection Terminal server  client/TCBE Terminal server Low assurance

22. Multiple Terminal Servers in Series with High Assurance Server Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted HIGH Terminal Server LOW Terminal Server

23. Multiple Terminal Servers in Series With High Assurance Server Analysis Strength LAN communication protection Weakness Heavy workload on HAS Lack of scalability

24. Multiple TCBE-enhanced Terminal Servers Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted HIGH Terminal Server LOW Terminal Server TS-TCBE

25. Multiple TCBE-enhanced Terminal Servers Analysis Strength More efficient runtime communication between client and terminal server LAN protected communication Vulnerability Terminal server Low assurance Lack of scalability

26. Terminal Servers Running on a Secure Virtual Machine Monitor Architecture PC TCBE PC TCBE PC TCBE LAN High Assurance Server Trusted Secure VMM HIGH Terminal Server LOW Terminal Server

27. Terminal Servers Running on a Secure Virtual Machine Monitor Analysis HAS enforces security policies through separation of data VMM enforces policies through the creation of virtual machines at different sensitivity levels TCBE supports SAK, protected communication interface, object reused controls on client

28. Summary Identify Three secure configurations Multiple TCBE-Enhanced Terminal Servers Suffer performance problem Lack of scalability Multiple Terminal Servers in Series Lack of scalability Terminal Servers on a High Assurance VMM Ideal Conclusion Using terminal server in a high assurance context with many sensitivity levels is Impractical!

29. What we learnt ? VMM Support multi-access level Thin client Object reuse Centralized management The whole architecture