narain.ppt

315 views
284 views

Published on

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
315
On SlideShare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
3
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide
  • Hello, I a senior researcher at Telcordia. I’ll talk about the problem of deploying a web services security infrastructure. If you are an online business, you have to satisfy not just security requirements but also availability ones. And these requirements are end-to-end. What policies should be set on a component depends on policies at other components. Let us consider a plausible web services infrastructure deployment. The idea is to decouple application logic from security logic. So you have the application logic encrypt the most sensitive parts of an XML SOAP message. Then, you can set up XML gateways to perform XML layer authentication and authorization. Finally, the entire XML message can be encrypted via IPSec tunnels originating and terminating at gateway routers. In order to set up reliability you may want to set up a cluster of XML gateways. You may also want to set up reliable messaging between these gateways. You may also want to set up a router cluster. To get defense in depth, you may want to set up the XML gateway in a Demilitarized Zone (sandwiched bewtween two routers). You may also want to make your VPN fault-tolerant. If you just have a ring of IPSec tunnels, then if one fails, you will want to reroute
  • narain.ppt

    1. 1. Scalable Configuration Management For Secure Web Services Infrastructure Sanjai Narain Senior Research Scientist Telcordia Technologies [email_address] (732) 699 2806 Prepared For DIMACS Workshop on Security of Web Services and E-Commerce, May 5-6, 2005
    2. 2. Outline <ul><li>Focus on architectural aspect of web-services security. Components can be robust, but architecture into which they are integrated can be fragile and vulnerable. </li></ul><ul><li>How do we answer questions such as “is there a single point of failure?”, “is there sufficient defense-in-depth?” </li></ul><ul><li>Show an approach based on model-finding </li></ul><ul><li>Show how to scale this approach to realistic size and complexity </li></ul>
    3. 3. Deploying Web Services Security Infrastructure Component Configuration Is Central Operation Gateway Router F W XML Gateway Cluster Application Servers F W Gateway Router F W XML Gateway Cluster Application Servers F W Gateway Router F W XML Gateway Cluster Application Servers F W WAN Bulk encryption via fault-tolerant network of IPSec Tunnels Authentication Authorization Credit card encryption Defense-in-depth via DMZ Gateway Router
    4. 4. Yet, there is no theory of configuration System requirements on security, functionality, fault-tolerance Components Configuration Synthesis Configuration Error Diagnosis Requirement Verification Configuration Error Fixing Requirement Strengthening Component Adds & Deletes Configuration Sequencing Operations on requirements
    5. 5. Quotes <ul><li>Although setup (of the trusted computing base) is much simpler than code, it is still complicated, it is usually done by less skilled people, and while code is written once, setup is different for every installation. So we should expect that it’s usually wrong, and many studies confirm this expectation. – Butler Lampson, Computer Security In the Real World. Proceedings of Annual Computer Security Applications Conference , 2000. </li></ul><ul><ul><li>http://research.microsoft.com/lampson/64-SecurityInRealWorld/Acrobat.pdf </li></ul></ul><ul><li>65% of attacks exploit configuration errors. – British Telecom/Gartner Group. http://www.btglobalservices.com/business/global/en/products/docs/28154_219475secur_bro_single.pdf </li></ul><ul><li>...operator error is the largest cause of failures...and largest contributor to time to repair ... in two of the three (surveyed) ISPs.......configuration errors are the largest category of operator errors. – David Oppenheimer, Archana Ganapathi, David A. Patterson. Why Internet Services Fail and What Can Be Done About These? Proceedings of 4th Usenix Symposium on Internet Technologies and Systems (USITS ‘03 ), 2003. </li></ul><ul><ul><li>http://roc.cs.berkeley.edu/papers/usits03.pdf </li></ul></ul><ul><li>Consider this: ….the complexity [of computer systems] is growing beyond human ability to manage it….the overlapping connections, dependencies, and interacting applications call for administrative decision-making and responses faster than any human can deliver. Pinpointing root causes of failures becomes more difficult. –Paul Horn, Senior VP, IBM Research. Autonomic Computing: IBM’s Perspective on the State of Information Technology. </li></ul><ul><ul><li>http://www.research.ibm.com/autonomic/manifesto/autonomic_computing.pdf </li></ul></ul>
    6. 6. New Concept: Requirement Solver System components, e.g., hosts, servers, routers, firewalls With policy-based networking, this work has to be done by system designer. System Components System Requirements in FOL Configurations Requirement Solver Alloy (MIT) FOL  Boolean logic compiler SAT Solvers (Very fast) FOL formula model Transformations
    7. 7. Formalizing Configuration Management Problems S = System Requirement <ul><ul><li>Configuration error diagnosis: </li></ul></ul><ul><ul><li>Where C is current system configuration, is S  C satisfiable? </li></ul></ul><ul><li>Configuration error fixing: </li></ul><ul><li>Find new configuration C: S is satisfiable and cost of migration to C is acceptable </li></ul><ul><li>Requirement Strengthening: </li></ul><ul><li>Solve S  NewReq </li></ul><ul><ul><li>Configuration synthesis: </li></ul></ul><ul><ul><li>Find system configuration C: S is satisfiable </li></ul></ul><ul><li>Verification: </li></ul><ul><li>Where R is a requirement, to show that S  R is valid show S   R is unsatisfiable </li></ul><ul><li>Component adds/deletes: </li></ul><ul><li>Solve S for new set of components </li></ul><ul><li>Configuration Sequencing: </li></ul><ul><li>SAT for planning </li></ul><ul><li>Also Quantified Boolean Formulas </li></ul>
    8. 8. Fully Configured Fault-Tolerant VPN Full mesh of IPSec tunnels does not scale Spoke Router Hub Router Spoke Router Hub Router WAN Router GRE Tunnel IPSec Tunnel XML GW Cluster XML GW Cluster
    9. 9. Network Components <ul><li>Component Attributes </li></ul><ul><li>interface </li></ul><ul><ul><li>chassis: router </li></ul></ul><ul><ul><li>network: subnet </li></ul></ul><ul><ul><li>routing: routingDomain </li></ul></ul><ul><li>ipsecTunnel </li></ul><ul><ul><li>local: externalInterface, </li></ul></ul><ul><ul><li>remote: externalInterface, </li></ul></ul><ul><ul><li>protocolToSecure: protocol </li></ul></ul><ul><li>greTunnel </li></ul><ul><ul><li>localPhysical: externalInterface </li></ul></ul><ul><ul><li>remotePhysical:externalInterface </li></ul></ul><ul><ul><li>routing:routingDomain </li></ul></ul><ul><li>firewallPolicy </li></ul><ul><ul><li>prot: protocol </li></ul></ul><ul><ul><li>action: permission </li></ul></ul><ul><ul><li>protectedInterface: physicalInterface </li></ul></ul><ul><li>ipPacket </li></ul><ul><ul><li>source:interface, </li></ul></ul><ul><ul><li>destination:interface, </li></ul></ul><ul><ul><li>prot:protocol </li></ul></ul>RIP Routing Domain OSPF Routing Domain Spoke Router WAN Router Hub Router Access Server (router subtype) Legacy Router <ul><li>Interface </li></ul><ul><li>Physical Interface </li></ul><ul><ul><li>Internal Interface </li></ul></ul><ul><ul><li>External Interface </li></ul></ul><ul><ul><ul><li>hubExternalInterface </li></ul></ul></ul><ul><ul><ul><li>spokeExternalInterface </li></ul></ul></ul><ul><li>Subnet </li></ul><ul><li>Internal Subnet </li></ul><ul><li>External Subnet </li></ul><ul><li>Protocols </li></ul><ul><li>ike </li></ul><ul><li>esp </li></ul><ul><li>gre </li></ul>IPSec Tunnel GRE Tunnel firewallPolicy <ul><li>Permissions </li></ul><ul><li>permit </li></ul><ul><li>deny </li></ul>ipPacket
    10. 10. Fault-Tolerant VPN Requirements Human administrators reason with these in different ways to synthesize initial network, then reconfigure it as operating conditions change. Can we automate this reasoning? <ul><li>SecureGRERequirements </li></ul><ul><li>For every GRE tunnel there is an IPSec tunnel between associated physical interfaces that secures all GRE traffic </li></ul><ul><li>GRERequirements </li></ul><ul><li>There is a GRE tunnel between each hub and spoke router </li></ul><ul><li>RIP is enabled on all GRE interfaces </li></ul><ul><li>SubnettingRequirements </li></ul><ul><li>A router does not have more than one interface on a subnet </li></ul><ul><li>All internal interfaces are on internal subnets </li></ul><ul><li>All external interfaces are on external subnets </li></ul><ul><li>Every hub and spoke router is connected to a WAN router </li></ul><ul><li>No two non-WAN routers share a subnet </li></ul><ul><li>RouterInterfaceRequirements </li></ul><ul><li>Each spoke router has internal and external interfaces </li></ul><ul><li>Each access server has internal and external interfaces </li></ul><ul><li>Each hub router has only external interfaces </li></ul><ul><li>Each WAN router has only external interfaces </li></ul><ul><li>RoutingRequirements </li></ul><ul><li>RIP is enabled on all internal interfaces </li></ul><ul><li>OSPF is enabled on all external interfaces </li></ul><ul><li>FirewallPolicyRequirements </li></ul><ul><li>Each hub and spoke external interface permits esp and ike packets </li></ul>
    11. 11. Current VPN Configuration Process hostname SN1BS-RTR ! crypto isakmp policy 1 authentication pre-share crypto isakmp key PN1BS-RTR_key_with_SN1BS-RTR address 148.148.148.2 crypto isakmp key AI-RTR_key_with_SN1BS-RTR address 158.158.158.2 crypto isakmp key SN2-RTR_key_with_SN1BS-RTR address 138.138.138.2 ! crypto ipsec transform-set IPSecProposal esp-des esp-sha-hmac ! crypto map vpn-map-Ethernet0/0 33 ipsec-isakmp set peer 148.148.148.2 set transform-set IPSecProposal match address 142 crypto map vpn-map-Ethernet0/0 34 ipsec-isakmp set peer 158.158.158.2 set transform-set IPSecProposal match address 143 crypto map vpn-map-Ethernet0/0 35 ipsec-isakmp set peer 138.138.138.2 set transform-set IPSecProposal match address 144 ! interface Tunnel0 ip address 31.31.31.1 255.255.255.0 tunnel source 128.128.128.2 tunnel destination 148.148.148.2 crypto map vpn-map-Ethernet0/0 ! interface Tunnel1 ip address 35.35.35.1 255.255.255.0 tunnel source 128.128.128.2 tunnel destination 158.158.158.2 crypto map vpn-map-Ethernet0/0 interface Tunnel2 ip address 34.34.34.2 255.255.255.0 tunnel source 148.148.148.2 tunnel destination 138.138.138.2 crypto map vpn-map-Ethernet0/0 ! interface Ethernet0/0 ip address 128.128.128.2 255.255.255.0 crypto map vpn-map-Ethernet0/0 ! interface Ethernet0/1 ip address 50.50.50.1 255.255.255.0 ! router rip version 2 network 50.0.0.0 network 31.0.0.0 network 34.0.0.0 network 35.0.0.0 ! ip classless ip route 0.0.0.0 0.0.0.0 128.128.128.1 no ip http server ! access-list 142 permit gre host 128.128.128.2 host 148.148.148.2 access-list 143 permit gre host 128.128.128.2 host 158.158.158.2 access-list 144 permit gre host 128.128.128.2 host 138.138.138.2 ! end hostname SN2-RTR ! crypto isakmp policy 1 authentication pre-share crypto isakmp key PN1BS-RTR_key_with_SN2-RTR address 148.148.148.2 crypto isakmp key AI-RTR_key_with_SN2-RTR address 158.158.158.2 crypto isakmp key SN1BS-RTR_key_with_SN2-RTR address 128.128.128.2 ! crypto ipsec transform-set IPSecProposal esp-des esp-sha-hmac ! crypto map vpn-map-Ethernet0/0 33 ipsec-isakmp set peer 148.148.148.2 set transform-set IPSecProposal match address 142 crypto map vpn-map-Ethernet0/0 34 ipsec-isakmp set peer 158.158.158.2 set transform-set IPSecProposal match address 143 crypto map vpn-map-Ethernet0/0 35 ipsec-isakmp set peer 128.128.128.2 set transform-set IPSecProposal match address 144 ! interface Tunnel0 ip address 32.32.32.1 255.255.255.0 tunnel source 138.138.138.2 tunnel destination 148.148.148.2 crypto map vpn-map-Ethernet0/0 ! interface Tunnel1 ip address 36.36.36.1 255.255.255.0 tunnel source 138.138.138.2 tunnel destination 158.158.158.2 crypto map vpn-map-Ethernet0/0 ! ! interface Tunnel2 ip address 34.34.34.1 255.255.255.0 tunnel source 138.138.138.2 tunnel destination 128.128.128.2 crypto map vpn-map-Ethernet0/0 ! interface Ethernet0/0 ip address 138.138.138.2 255.255.255.0 crypto map vpn-map-Ethernet0/0 ! interface Ethernet0/1 ip address 60.60.60.1 255.255.255.0 ! router rip version 2 network 60.0.0.0 network 32.0.0.0 network 34.0.0.0 network 36.0.0.0 ! ip classless ip route 0.0.0.0 0.0.0.0 138.138.138.1 no ip http server ! access-list 142 permit gre host 138.138.138.2 host 148.148.148.2 access-list 143 permit gre host 138.138.138.2 host 158.158.158.2 access-list 144 permit gre host 138.138.138.2 host 128.128.128.2 ! end ip classless ! interface Tunnel2 ip address 32.32.32.2 255.255.255.0 tunnel source 148.148.148.2 tunnel destination 138.138.138.2 crypto map vpn-map-Ethernet0/0 ! interface Ethernet0/0 ip address 148.148.148.2 255.255.255.0 crypto map vpn-map-Ethernet0/0 ! interface Ethernet0/1 ip address 192.110.175.1 255.255.255.0 ! router rip version 2 network 192.110.175.0 network 31.0.0.0 network 33.0.0.0 network 32.0.0.0 ! ip classless ip route 0.0.0.0 0.0.0.0 148.148.148.1 no ip http server ! access-list 142 permit gre host 148.148.148.2 host 128.128.128.2 access-list 143 permit gre host 148.148.148.2 host 158.158.158.2 access-list 144 permit gre host 148.148.148.2 host 138.138.138.2 ! end hostname PN1BS-RTR ! crypto isakmp policy 1 authentication pre-share crypto isakmp key SN1BS-RTR_key_with_PN1BS-RTR address 128.128.128.2 crypto isakmp key A1-RTR_key_with_PN1BS-RTR address 158.158.158.2 crypto isakmp key SN2-RTR_key_with_PN1BS-RTR address 138.138.138.2 ! crypto ipsec transform-set IPSecProposal esp-des esp-sha-hmac ! crypto map vpn-map-Ethernet0/0 33 ipsec-isakmp set peer 128.128.128.2 set transform-set IPSecProposal match address 142 crypto map vpn-map-Ethernet0/0 34 ipsec-isakmp set peer 158.158.158.2 set transform-set IPSecProposal match address 143 crypto map vpn-map-Ethernet0/0 35 ipsec-isakmp set peer 138.138.138.2 set transform-set IPSecProposal match address 144 ! interface Tunnel0 ip address 31.31.31.2 255.255.255.0 tunnel source 148.148.148.2 tunnel destination 128.128.128.2 crypto map vpn-map-Ethernet0/0 ! interface Tunnel1 ip address 33.33.33.1 255.255.255.0 tunnel source 148.148.148.2 tunnel destination 158.158.158.2 crypto map vpn-map-Ethernet0/0 interface Tunnel2 ip address 36.36.36.2 255.255.255.0 tunnel source 158.158.158.2 tunnel destination 138.138.138.2 crypto map vpn-map-Ethernet0/0 ! interface Ethernet0/0 ip address 158.158.158.2 255.255.255.0 crypto map vpn-map-Ethernet0/0 ! interface Ethernet0/1 ip address 80.80.80.1 255.255.255.0 ! router rip version 2 network 80.0.0.0 network 35.0.0.0 network 33.0.0.0 network 36.0.0.0 ! ip classless ip route 0.0.0.0 0.0.0.0 158.158.158.1 no ip http server ! access-list 142 permit gre host 158.158.158.2 host 128.128.128.2 access-list 143 permit gre host 158.158.158.2 host 148.148.148.2 access-list 144 permit gre host 158.158.158.2 host 138.138.138.2 ! end New Cisco IOS configuration needs to be implemented at all VPN peer routers! For 4 node VPN that is more than 240 command lines hostname AI-RTR ! crypto isakmp policy 1 authentication pre-share crypto isakmp key SN1BS-RTR_key_with_AI-RTR address 128.128.128.2 crypto isakmp key PN1BS-RTR_key_with_AI-RTR address 148.148.148.2 crypto isakmp key SN2-RTR_key_with_AI-RTR address 138.138.138.2 ! crypto ipsec transform-set IPSecProposal esp-des esp-sha-hmac ! crypto map vpn-map-Ethernet0/0 33 ipsec-isakmp set peer 128.128.128.2 set transform-set IPSecProposal match address 142 crypto map vpn-map-Ethernet0/0 34 ipsec-isakmp set peer 148.148.148.2 set transform-set IPSecProposal match address 143 crypto map vpn-map-Ethernet0/0 35 ipsec-isakmp set peer 138.138.138.2 set transform-set IPSecProposal match address 144 ! interface Tunnel0 ip address 35.35.35.2 255.255.255.0 tunnel source 158.158.158.2 tunnel destination 128.128.128.2 crypto map vpn-map-Ethernet0/0 ! interface Tunnel1 ip address 33.33.33.2 255.255.255.0 tunnel source 158.158.158.2 tunnel destination 148.148.148.2 crypto map vpn-map-Ethernet0/0
    12. 12. Requirements In Alloy <ul><li>pred RouterInterfaceRequirements () </li></ul><ul><li>{ </li></ul><ul><li>(all x:spokeRouter | some y:internalInterface | y.chassis = x) && </li></ul><ul><li>(all x:spokeRouter | some y:spokeExternalInterface | y.chassis = x) && </li></ul><ul><li>(all x:accessServer | some y:internalInterface | y.chassis = x) && </li></ul><ul><li>(all x:accessServer | some y:externalInterface | y.chassis = x) && </li></ul><ul><li>(all x:hubRouter | some y:hubExternalInterface | y.chassis = x)&& </li></ul><ul><li>(all x:wanRouter | some y:externalInterface | y.chassis = x) </li></ul><ul><li>} </li></ul><ul><li>pred SecureGRERequirements () </li></ul><ul><li>{all g:greTunnel | </li></ul><ul><li>some p:ipsecTunnel | p.protocolToSecure=gre && </li></ul><ul><li>((p.local = g.localPhysical && p.remote = g.remotePhysical) or </li></ul><ul><li> (p.local = g.localPhysical && p.remote = g.remotePhysical))} </li></ul>
    13. 13. Sample Output From Requirement Solver <ul><li>routing : samples/router/routingDomain = </li></ul><ul><li>{externalInterface_0 -> ospfDomain_0, </li></ul><ul><li>externalInterface_1 -> ospfDomain_0, </li></ul><ul><li>externalInterface_2 -> ospfDomain_0, </li></ul><ul><li>externalInterface_3 -> ospfDomain_0, </li></ul><ul><li>externalInterface_4 -> ospfDomain_0, </li></ul><ul><li>hubExternalInterface_0 -> ospfDomain_0, </li></ul><ul><li>hubExternalInterface_1 -> ospfDomain_0, </li></ul><ul><li>internalInterface_0 -> ripDomain_0, </li></ul><ul><li>internalInterface_1 -> ripDomain_0, </li></ul><ul><li>internalInterface_2 -> ripDomain_0, </li></ul><ul><li>spokeExternalInterface_0 -> ospfDomain_0, </li></ul><ul><li>spokeExternalInterface_1 -> ospfDomain_0} </li></ul><ul><li>chassis : samples/router/router = </li></ul><ul><li>{externalInterface_0 -> accessServer_0, </li></ul><ul><li>externalInterface_1 -> wanRouter_0, </li></ul><ul><li>externalInterface_2 -> wanRouter_0, </li></ul><ul><li>externalInterface_3 -> wanRouter_0, </li></ul><ul><li>externalInterface_4 -> wanRouter_0, </li></ul><ul><li>hubExternalInterface_0 -> hubRouter_0, </li></ul><ul><li>hubExternalInterface_1 -> hubRouter_1, </li></ul><ul><li>internalInterface_0 -> spokeRouter_0, </li></ul><ul><li>internalInterface_1 -> accessServer_0, </li></ul><ul><li>internalInterface_2 -> spokeRouter_1, </li></ul><ul><li>spokeExternalInterface_0 -> spokeRouter_1, </li></ul><ul><li>spokeExternalInterface_1 -> spokeRouter_0} </li></ul><ul><li>network : samples/router/subnet = </li></ul><ul><li>{externalInterface_0 -> externalSubnet_0, </li></ul><ul><li>externalInterface_1 -> externalSubnet_0, </li></ul><ul><li>externalInterface_2 -> externalSubnet_1, </li></ul><ul><li>externalInterface_3 -> externalSubnet_2, </li></ul><ul><li>externalInterface_4 -> externalSubnet_3, </li></ul><ul><li>hubExternalInterface_0 -> externalSubnet_2, </li></ul><ul><li>hubExternalInterface_1 -> externalSubnet_3, </li></ul><ul><li>internalInterface_0 -> internalSubnet_0, </li></ul><ul><li>internalInterface_1 -> internalSubnet_0, </li></ul><ul><li>internalInterface_2 -> internalSubnet_1, </li></ul><ul><li>spokeExternalInterface_0 -> externalSubnet_0, </li></ul><ul><li>spokeExternalInterface_1 -> externalSubnet_1} </li></ul>
    14. 14. Configuration Synthesis: Physical Connectivity and Routing <ul><li>To synthesize network, satisfy R1-R11 for </li></ul><ul><ul><li>1 hub router, </li></ul></ul><ul><ul><li>1 WAN router, </li></ul></ul><ul><ul><li>1 spoke router, </li></ul></ul><ul><ul><li>1 internal subnet, </li></ul></ul><ul><ul><li>2 external subnets </li></ul></ul><ul><ul><li>1 internal interface, </li></ul></ul><ul><ul><li>4 external interfaces, </li></ul></ul><ul><ul><li>RIP domain, </li></ul></ul><ul><ul><li>1 OSPF domain </li></ul></ul>Spoke Router WAN Router Hub Router OSPF Domain RIP Domain <ul><li>SubnettingRequirements </li></ul><ul><li>A router does not have more than one interface on a subnet </li></ul><ul><li>All internal interfaces are on internal subnets </li></ul><ul><li>All external interfaces are on external subnets </li></ul><ul><li>Every hub and spoke router is connected to a WAN router </li></ul><ul><li>No two non-WAN routers share a subnet </li></ul><ul><li>RouterInterfaceRequirements </li></ul><ul><li>Each spoke router has internal and external interfaces </li></ul><ul><li>Each access server has internal and external interfaces </li></ul><ul><li>Each hub router has only external interfaces </li></ul><ul><li>Each WAN router has only external interfaces </li></ul><ul><li>RoutingRequirements </li></ul><ul><li>RIP is enabled on all internal interfaces </li></ul><ul><li>OSPF is enabled on all external interfaces </li></ul>Requirement Solver generates solution. Note that Hub and Spoke routers are not directly connected, due to Requirement 9
    15. 15. <ul><li>To synthesize network, satisfy R1-R13 for </li></ul><ul><li>previous list of components & </li></ul><ul><li>1 GRE tunnel </li></ul><ul><li>NOTE: GRE tunnel set up and RIP domain extended to include GRE interfaces automatically! </li></ul>Strengthening Requirement: Adding Overlay Network Spoke Router Hub Router OSPF Domain RIP Domain GRE Tunnel WAN Router <ul><li>GRERequirements </li></ul><ul><li>There is a GRE tunnel between each hub and spoke router </li></ul><ul><li>RIP is enabled on all GRE interfaces </li></ul><ul><li>SubnettingRequirements </li></ul><ul><li>A router does not have more than one interface on a subnet </li></ul><ul><li>All internal interfaces are on internal subnets </li></ul><ul><li>All external interfaces are on external subnets </li></ul><ul><li>Every hub and spoke router is connected to a WAN router </li></ul><ul><li>No two non-WAN routers share a subnet </li></ul><ul><li>RouterInterfaceRequirements </li></ul><ul><li>Each spoke router has internal and external interfaces </li></ul><ul><li>Each access server has internal and external interfaces </li></ul><ul><li>Each hub router has only external interfaces </li></ul><ul><li>Each WAN router has only external interfaces </li></ul><ul><li>RoutingRequirements </li></ul><ul><li>RIP is enabled on all internal interfaces </li></ul><ul><li>OSPF is enabled on all external interfaces </li></ul>
    16. 16. Strengthening Requirement: Adding Security For Overlay Network Spoke Router Hub Router OSPF Domain IPSec Tunnel <ul><li>To synthesize network, satisfy R1-R14 for </li></ul><ul><li>previous list of components & </li></ul><ul><li>1 IPSec tunnel </li></ul><ul><li>NOTE: IPSec tunnel securing GRE tunnel set up automatically </li></ul>WAN Router <ul><li>GRERequirements </li></ul><ul><li>There is a GRE tunnel between each hub and spoke router </li></ul><ul><li>RIP is enabled on all GRE interfaces </li></ul><ul><li>SubnettingRequirements </li></ul><ul><li>A router does not have more than one interface on a subnet </li></ul><ul><li>All internal interfaces are on internal subnets </li></ul><ul><li>All external interfaces are on external subnets </li></ul><ul><li>Every hub and spoke router is connected to a WAN router </li></ul><ul><li>No two non-WAN routers share a subnet </li></ul><ul><li>RouterInterfaceRequirements </li></ul><ul><li>Each spoke router has internal and external interfaces </li></ul><ul><li>Each access server has internal and external interfaces </li></ul><ul><li>Each hub router has only external interfaces </li></ul><ul><li>Each WAN router has only external interfaces </li></ul><ul><li>RoutingRequirements </li></ul><ul><li>RIP is enabled on all internal interfaces </li></ul><ul><li>OSPF is enabled on all external interfaces </li></ul><ul><li>SecureGRERequirements </li></ul><ul><li>For every GRE tunnel there is an IPSec tunnel between associated physical interfaces that secures all GRE traffic </li></ul>
    17. 17. Component Addition: Adding New Spoke Router Spoke Router Spoke Router <ul><li>To add another spoke router satisfy requirements R1-R15 for previous components and one additional spoke router and related components </li></ul><ul><li>Note: New subnets, GRE and IPSec tunnels set up, and routing domains extended automatically </li></ul>Hub Router WAN Router
    18. 18. Component Addition: Adding New Hub Router Spoke Router Hub Router Access Server OSPF Domain Spoke Router Hub Router <ul><li>To add another hub router satisfy requirements R1-R15 for previous components and one additional hub router (and related com[ponents) </li></ul><ul><li>New subnets, GRE and IPSec tunnels set up, and routing domains extended automatically </li></ul>WAN Router
    19. 19. Verification: Adding Firewall Requirements & Discovering Design Flaw Spoke Router Hub Router OSPF Domain Spoke Router Hub Router <ul><li>Symptom: Cannot ping from one internal interface to another </li></ul><ul><li>Define Bad = ip packet is blocked </li></ul><ul><li>Check if R1-R16 & Bad is satisfiable </li></ul><ul><li>Answer: WAN router firewalls block ike/ipsec traffic </li></ul><ul><li>Action: Create new policy that allows WAN router firewalls to pass esp/ike packets </li></ul>WAN Router
    20. 20. Scalability Approaches <ul><li>Can we write specifications in such a way that they are “efficient”? </li></ul><ul><li>Two heuristics: </li></ul><ul><ul><li>Small number of quantifiers in formulas </li></ul></ul><ul><ul><li>Scope splitting </li></ul></ul><ul><li>Even with these, Alloy crashes for 10 sites (200 object instances) </li></ul><ul><li>New approach is required </li></ul>
    21. 21. Divide, Conquer, Verify <ul><li>Heuristic: Instead of creating VPN for all sites all at once, create it incrementally by adding sites one at a time </li></ul><ul><li>Goal: Solve R for component set C </li></ul><ul><li>If C is large, Alloy will take a long time or crash </li></ul><ul><li>Split C into C1,..,Ck and solve R for C1,..,Ck generating solutions M1,..,Mk. Then take union of M1,..,Mk = M </li></ul><ul><li>Verify that M is a solution for R. </li></ul><ul><li>Using Alloy for verification will restore inefficiency </li></ul><ul><li>However, one can use Prolog </li></ul>
    22. 22. Any FOL formula can be expressed in full Prolog. <ul><li>pred greTunnelEveryHubSpoke () </li></ul><ul><li>{all x:hubExternalInterface, y:spokeExternalInterface | some g:greTunnel | </li></ul><ul><li>(g.localPhysical=x && g.remotePhysical=y) or (g.localPhysical=y && g.remotePhysical=x)} </li></ul><ul><li>----------------------------------------------------------------------------------------------------------------------------------- </li></ul><ul><li>greTunnelEveryHubSpoke if not counterExampleGreTunnelEveryHubSpoke. </li></ul><ul><li>counterExampleGreTunnelEveryHubSpoke if type(X,hub),type(Y,spoke), not existsGRE(X,Y). </li></ul><ul><li>existsGRE(X,Y) if localPhysical(GT, P1),remotePhysical(GT,P2), chassis(P1, X), chassis(P2, Y) </li></ul><ul><li>existsGRE(X,Y) if localPhysical(GT, P1),remotePhysical(GT,P2), chassis(P2, X), chassis(P1, Y) </li></ul><ul><li>------------------------------------------------------------------------------------------------------------------------------------ </li></ul><ul><li>Represent model as a collection of Prolog ground facts. Now, evaluate Prolog requirement. This is a database integrity checking problem </li></ul>
    23. 23. Summary & Future Directions <ul><li>Problem: Focus on architectural aspects of security </li></ul><ul><li>Configuration plays central role in web services infrastructure synthesis & management </li></ul><ul><li>We need a theory of configuration to solve following fundamental problems: </li></ul><ul><ul><li>Specification languages </li></ul></ul><ul><ul><li>Configuration synthesis </li></ul></ul><ul><ul><li>Incremental configuration (requirement strengthening, component addition) </li></ul></ul><ul><ul><li>Configuration error diagnosis </li></ul></ul><ul><ul><li>Configuration error troubleshooting </li></ul></ul><ul><ul><li>Verification </li></ul></ul><ul><ul><li>Configuration sequencing </li></ul></ul><ul><ul><li>Distributed configuration </li></ul></ul><ul><li>Proposed formalization of 1-6 via Alloy and SAT solvers </li></ul><ul><li>Proposed scalability approach by complementary use of Prolog </li></ul><ul><li>Future directions: </li></ul><ul><ul><li>Scalable algorithms to solve above problems. </li></ul></ul><ul><ul><li>Combine FOL reasoning systems, Linear Programming systems, relational databases, graph algorithms into single programming model </li></ul></ul>
    24. 24. <ul><li>Thank You </li></ul>
    25. 25. <ul><li>There is no theory of configuration. There is a deep logic that governs infrastructure. </li></ul><ul><li>Security and routing interfere </li></ul><ul><li>Move from coding to configuration </li></ul><ul><li>Why is diagnosis hard: work in isolation but not together </li></ul><ul><li>Policies across components, and across layers……! GUIs don’t even have expressive power of Boolean logic </li></ul><ul><li>Self-healing architecture VG </li></ul><ul><li>Emphasize Language (syntax/semantics). Semantics: services at each layer </li></ul><ul><li>Integrate fault-tolerant protocols </li></ul><ul><li>Scalability </li></ul><ul><li>LP </li></ul>

    ×