Dynamic Access Control Infrastructure (DACI) for on-demand ...

<strong>Dynamic</strong> <strong>Access</strong> <strong>Control</strong> <strong>Infrastructure</strong>
<strong>for</strong> On-demand
Provisioned Cloud Services
Canh Ngo
SNE Group, University of Amsterdam
OGF-ISOD 33
September 19-21, 2011
Lyon, 2011

Agenda
• Introduction
– Scenario
– Motivation
• Proposals on Security <strong>Infrastructure</strong> <strong>for</strong> Ondemand
Provisioned Cloud Services
– Security Reference Model
– Trust Relationship Model
– <strong>Dynamic</strong> <strong>Access</strong> <strong>Control</strong> <strong>Infrastructure</strong>
• Implementations
• Summary
ISOD, OGF33, 19-21 Sept 2010, Lyon
2

Introduction
Scenario
Virtual security
domain
Company A
• Cloud IaaS
• Multi-provider
• Multi-tenant
• Service Lifecycle
Management
Company B
Company C
Cloud Provider 1 Cloud Provider 2
Virtual Resource from Cloud Prov 1
Virtual Resource from Cloud Prov 2
ISOD, OGF33, 19-21 Sept 2010, Lyon
3

Introduction
Motivation
Security context management issues:
• Integrate with service lifecycles
• Context delivery and synchronization of isolated operations among multiple tenants
• Binding end-users operations to separate customers/tenants
Trust Management
• Trust model proposal
• Trust establishment protocols: establish trust-path/trust-chain between end-users and
virtualized resources through supply-chain of providers
• Bootstrapping protocols <strong>for</strong> trusted virtualized devices
Identity and <strong>Access</strong> <strong>Control</strong> Management
• Authorization policy management: synchronization of policies & reconfigurable resources
• Identity management, access control
• Support <strong>for</strong> virtual security domains across multiple Cloud providers
Delegation: Security services/tools delegation <strong>for</strong> customers/tenants
ISOD, OGF33, 19-21 Sept 2010, Lyon
4

Security <strong>for</strong> On-demand Provisioned Cloud Services
Security Reference Model
Common Security
Service Interface
(CSSI) proposal
Common Security Service Layer
<strong>Dynamic</strong> <strong>Access</strong>
<strong>Control</strong> <strong>Infrastructure</strong>
(<strong>DACI</strong>) proposal
Trust model proposal,
trust establishment
protocols,
bootstrapping
processes
Authentication &
Identity Man.
Trust Management
(<strong>Dynamic</strong> trust establishment, Bootstrapping)
SLA Management
Authorization &
Policy Man.
Security Context Management
Security Service Lifecycle
Management (SSLM)
ISOD, OGF33, 19-21 Sept 2010, Lyon 5

Security <strong>for</strong> On-demand Provisioned Cloud Services
Trust Relationship Model
Trust model using cryptographic-based
with trust transitivity
VIO1
VIO2
Building trust-paths from end-users to
virtualized resources
• Trust-path establishment protocols
• Bootstrapping <strong>for</strong> trusted virtualized
resources
• <strong>Dynamic</strong> Security Association
PIP1
VIP1
VIP2
VIP3
PIP2 PIP3 PIP4
PIP: Physical <strong>Infrastructure</strong> Provider
VIP: Virtual <strong>Infrastructure</strong> Provider
VIO: Virtual <strong>Infrastructure</strong> Operator
Static trust link
<strong>Dynamic</strong> trust link
Virtual Resource
End-user
ISOD, OGF33, 19-21 Sept 2010, Lyon
6

Security <strong>for</strong> On-demand Provisioned Cloud Services
<strong>Dynamic</strong> <strong>Access</strong> <strong>Control</strong> <strong>Infrastructure</strong>
Common Security
Service Interface (CSSI)
SecurityGateway
Consolidate a common
interface to access security
services
DACS
instance[i]
<strong>DACI</strong> Management
Authentication Authority
SAML-XACML Layer
Authz-token
Svc
<strong>DACI</strong> Configuration
<strong>DACI</strong> Monitoring
Attr DB
Attribute
Authority
Identity Management
Service
PIP (Authz
Ctx Hdlr)
PDP
Obligation
Handler
PAP
Authorization Service
Authz-token
Authority
Authz Token
Service
DACS
Man.
Service
<strong>DACI</strong> Policy
Management
<strong>DACI</strong> Context
Management
<strong>DACI</strong> Trust
Management
DACS Trust Manager
Provisioned security
services (DACS)
<strong>DACI</strong>: <strong>Dynamic</strong> <strong>Access</strong> <strong>Control</strong> <strong>Infrastructure</strong>
DACS: <strong>Dynamic</strong> <strong>Access</strong> <strong>Control</strong> Services
Update authz-policies upon
reconfiguring Virtual
<strong>Infrastructure</strong>
<strong>Dynamic</strong> Trust
Establishment: DSA,
Bootstrapping
ISOD, OGF33, 19-21 Sept 2010, Lyon
7

Implementation
GAAA-ISOD Toolkit Library
• Features
– <strong>Dynamic</strong> authorization policies: auto generate XACML authz-policies by predefined templates
– PEP: Common Security Service Interface (CSSI): facilitate integrations of virtualized security
services to resources
– Security token service: XML-based AuthzToken & AuthzTicket, persistent caches, digital
signatures
Authentication
(SAML, X.509,
User/Password)
Authorization
(PDP, PEP, PAP)
Security Token
OpenSAML
SunXACML
BouncyCastle
(Java crypto library)
ISOD, OGF33, 19-21 Sept 2010, Lyon
8

Implementation
GEYSERS Project
• Based on GAAATK-ISOD toolkit
• WP3-dev: Logical <strong>Infrastructure</strong> Composition Layer (LICL)
– FUSE ESB env, OSGi bundles
– Packages: AAI (AuthN/Z <strong>for</strong> LICL, NCP+), <strong>DACI</strong> (AuthN/Z provisioning <strong>for</strong> Cloud IaaS)
• WP4-dev: NCP+
– AAI web services
SecurityGateway
AuthnSvc AuthzSvc TokenSvc
<strong>DACI</strong> Policy
Man.
<strong>DACI</strong> Man.
<strong>DACI</strong> Trust
<strong>DACI</strong>
Context
DACS
AAI <strong>for</strong> LICL (eu.geysers.licl.aai.*)
<strong>DACI</strong>
GAAA-ISOD Toolkit
ISOD, OGF33, 19-21 Sept 2010, Lyon
9

Implementation
DACS Integration using SecurityGateway library
Isolate
tenants/subscribers
by Reservation Id (VI-GRI)
CSSI
Client
VR service
CSSI
CSSI/GAAPI
Policy En<strong>for</strong>cement Point
SecurityGateway Library
AuthN AuthZ TokenSvc
Identity
Management
Service
Authorization
Service
DACS instance
Security Token
Service
ISOD, OGF33, 19-21 Sept 2010, Lyon 10

Summary
• Future work
– Trust modeling across virtual security domains
– SSLM bootstrapping protocols <strong>for</strong> virtual devices:
• Trusted Computing Plat<strong>for</strong>m Architecture (TCPA)
• Trusted Plat<strong>for</strong>m Module (TPM)
– Federated virtualized Identity and <strong>Access</strong> <strong>Control</strong>
Management
– GAAA-ISOD toolkit implementations with SSLM
supports <strong>for</strong> on-demand infrastructure services
provisioning
ISOD, OGF33, 19-21 Sept 2010, Lyon
11

Thank you
Any questions?
ISOD, OGF33, 19-21 Sept 2010, Lyon 12