1. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Securing Distributed Systems with Information Flow Control CS6204 Privacy and Security Virginia Tech -Nikhil Komawar Oct 6, 2011

2. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science  Introduction  Information Flow Control  Design  Implementation  Instance applications  Evaluation 2 Outline

3. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science  We try to design system which remain secure despite of the untrustworthy code.  Decentralized trust:-  OS has have it entirely trusted kernel  Not the same case for a Distributed System  One solution: centralize trust mechanism (Not the most effective!)  Egalitarian Mechanism:-  Specifically designed for applications  Even unprivileged code can use DIFC  No inherent covert channels:-  Avoid any covert channels in Dstar’s interface to meet different security requirements. 3 Introduction

4. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science A typical web application. 4

5. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science  Labels:  Ensure the communication between two processes  Direction of communication  Processes S and R:  Flows from S to R  Flows even from R to S  On a distributed system, label L M for a message M 5 Information Flow Control

6. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science  If information flows to higher label then we will not get anything out of the system  S can send message M to R if . 6 Downgrading privileges

7. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science  A process P’s downgrading are also represented as categories: P owns a category   Set of categories in DStar message M 7 Categories

8. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science 8 Lattice structure

9. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science  Each process has third set of categories C P besides L P and O P . Are called clearance: which gives a right to the process P to raise its own label say  Now 9 Clearance

10. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science 10 Example

11. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science  Run on each host: an exporter daemon which provides three requirements:-  Track labels assigned to and categories owned by each process on the machine  A process cannot send messages with inappropriate label  Send and accept network message M when a remote exporter can be trusted 11 DSTAR EXPORTER

12. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science  We may have different host Oses Asbestos, HiStar, Flume.  We refer to their categories as OS categories and OS labels  Downgrading privilages:  Corresponding category 12 Local OS DIFC

13. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science 13 Local checks, Trust and Addressing Local Checks Addressing Decentralized Trust

14. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science 14 Exporter Interface

15. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science  Delegation service  Local process to another exporter  Mapping service  Mapping between DStar and local OS categories  Guarded invocation service  Launches executables with specified arguments and privileges  Resource allocation service  Allocates space for data, CPU time for threads 15 Management Service

16. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science  Object types in HiStar  Segments: 0 or more memory pages  Containers: similar to directories  Threads: execute code  Gates: used for IPC and privilege transfer 16 HiStar

17. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science 17 DStar and HiStar Mapping Object is in a container HiStar category cDStar category d Binding segment

18. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science 18 HiStar SSL web server

19. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science 19 Code complexity Lines of C Code

20. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science 20 Web application on many HiStar machines

21. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science 21 Size of DStar structures Compression of data using zlib

22. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Microbenchmarks measuring time to sign and verify certificates 22 Microbenchmarks

23. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science 23 Throughput and Latency

24. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science 24 Different configurations

25. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science  DStar:  Framework for securing distributed systems  Uses security label mechanisms of DIFC Oses  Exporter daemon on every machine  Exporter ensures safe communication  Trust relation left to the applications  Self certifying categories – fully trusted machines not needed  Showed a DStar implementation of a three tired Web Server  Web server scales well 25 Summary

26. Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science Click to edit Master title style Thank You!