A firewall algebra for OpenStack

Foley, Simon N.; Neville, Ultan

doi:10.1109/cns.2015.7346867

Cited by 13 publications

(7 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Congress [41] is an OpenStack project offering similar features as Weatherman. Foley et al [47] propose an algebra for anomaly-free firewall policies for Open-Stack. Many state-based formal models (e.g., [40,[48][49][50]) are proposed for program monitoring.…”

Section: Related Workmentioning

confidence: 99%

Learning probabilistic dependencies among events for proactive security auditing in clouds

Majumdar

Tabiban

Jarraya

et al. 2019

JCS

View full text Add to dashboard Cite

Security compliance auditing is a viable solution to ensure the accountability and transparency of a cloud provider to its tenants. However, the sheer size of a cloud, coupled with the high operational complexity implied by the multi-tenancy and self-service nature, can easily render existing runtime auditing techniques too expensive and non-scalable. To this end, a proactive approach, which prepares for the auditing ahead of critical events, is a promising solution to reduce the response time to a practical level. However, a key limitation of such approaches is their reliance on manual efforts to extract the dependency relationships among events, which greatly restricts their practicality. What makes things worse is the fact that, as the most important input to security auditing, the logs and configuration databases of a real world cloud platform can be unstructured and not ready to be used for efficient security auditing. In this paper, we first propose a log processing technique, which prepares raw cloud logs for different analysis purposes, and then design a learning-based proactive security auditing system, namely, LeaPS + . To this end, we conduct case studies on current log formats in different real-world OpenStack (a popular cloud platform) deployments, and identify major challenges in log processing. Later, we design a stand-alone log processor for clouds, which may potentially be used for various log analyses. Consequently, we leverage the log processor outputs to extract probabilistic dependencies from runtime events for the dependency models. Finally, through these dependency models, we proactively prepare for security critical events and prevent security violations resulting from those critical events. Furthermore, we integrate LeaPS + to OpenStack and perform extensive experiments in both simulated and real cloud environments that show a practical response time (e.g., 6ms to audit a cloud of 100,000 VMs) and a significant improvement (e.g., about 50% faster) over existing proactive approaches. In addition, we successfully and efficiently apply our log processor outputs to other learning techniques (e.g., executing sequence pattern mining algorithms within 18ms for 50,000 events).

show abstract

Section: Related Workmentioning

confidence: 99%

Learning probabilistic dependencies among events for proactive security auditing in clouds

Majumdar

Tabiban

Jarraya

et al. 2019

JCS

View full text Add to dashboard Cite

show abstract

“…However, the time elapsed before reverting the operation can be critical to perform some illicit actions, for instance, transferring sensitive files before loosing the assigned role. Foley et al [31] provide an algebra to assess the effect of security policies replacement and composition in OpenStack. Their solution can be considered as a proactive approach for checking operational properties violations, whereas our work targets the runtime verification of structural security property violations.…”

Section: Cloud Security Auditingmentioning

confidence: 99%

Proactive Security Auditing in Clouds

Majumdar

Madi²,

Wang³

et al. 2019

Cloud Security Auditing

View full text Add to dashboard Cite

Cloud computing is emerging as a promising IT solution for enabling ubiquitous, convenient, and on-demand accesses to a shared pool of configurable computing resources. However, the widespread adoption of cloud is still being hindered by the lack of transparency and accountability, which has traditionally been ensured through security auditing techniques. Security auditing in the cloud poses many unique challenges in data collection and processing (e.g., data format inconsistency and lack of correlation due to the heterogeneity of cloud infrastructures), and in verification (e.g., prohibitive performance overhead due to the sheer scale of cloud infrastructures and need of runtime verification for the dynamic nature of cloud). To this extent, existing security auditing solutions can mainly be categorized into three types: retroactive, intercept-and-check and proactive. The retroactive auditing approach is the traditional auditing technique, which audits after the fact and cannot prevent irreversible damages (e.g., leakage of sensitive information and denial of service attacks). The intercept-and-check approach offers runtime auditing and performs all the auditing steps after the occurrence of a critical event (i.e., which may potentially violate a security property). However, this approach results significant delay in responding each critical event. On the other hand, the existing proactive approach requires the changes (in the cloud configurations) planned for the future in advance to verify its compliance; however, this approach is not practical, because the future change plan is not always available due to cloud's dynamic and ad-hoc nature. In this thesis, we address all the above-mentioned limitations of the existing works by proposing a proactive security auditing system, which potentially can prevent irreversible damages, respond in significantly less time and offer a practical approach without requiring any future change plan. To this purpose, we conduct our work into three main phases. During the first phase, we propose a runtime security auditing system for the user-level of the cloud; where our proposed system audits wide range of security properties relevant to different authentication and authorization mechanisms, such as role-based access control (RBAC), attribute-based access control (ABAC) and single sign-on (SSO), and enhances the existing intercept-and-check solutions by adopting an incremental approach to improve the efficiency. In the second phase of our work, we propose a novel approach of proactive security auditing; which leverages the dependency relationship among cloud events and pre-computes the most expensive parts of the auditing process to keep the response time This thesis work is the outcome of collaboration and support of many people, to whom I am sincerely grateful and would like to appreciate their help.At the very beginning, I would like to thank my PhD supervisor Dr. Lingyu Wang. His continuous availability and guidance helped me the most to complete this thesis work. I am gratef...

show abstract

“…Our work differs, in that policy composition under the , and o 9 operators defined in this paper all result in anomaly-free policies. In earlier work [22], we developed the algebra FW 0 , and used it to reason over host-based and network access controls in OpenStack. In the FW 0 algebra, we focused on stateless firewall policies that are defined in terms of constraints on individual IPs, ports and protocols.…”

Section: Table 18mentioning

confidence: 99%