A JSON Token-Based Authentication and Access Management Schema for Cloud SaaS Applications

Cloud computing is significantly reshaping the computing industry built around core concepts such as virtualization, processing power, connectivity and elasticity to store and share IT resources via a broad network. It has emerged as the key technology that unleashes the potency of Big Data, Internet of Things, Mobile and Web Applications, and other related technologies, but it also comes with its challenges - such as governance, security, and privacy. This paper is focused on the security and privacy challenges of cloud computing with specific reference to user authentication and access management for cloud SaaS applications. The suggested model uses a framework that harnesses the stateless and secure nature of JWT for client authentication and session management. Furthermore, authorized access to protected cloud SaaS resources have been efficiently managed. Accordingly, a Policy Match Gate (PMG) component and a Policy Activity Monitor (PAM) component have been introduced. In addition, other subcomponents such as a Policy Validation Unit (PVU) and a Policy Proxy DB (PPDB) have also been established for optimized service delivery. A theoretical analysis of the proposed model portrays a system that is secure, lightweight and highly scalable for improved cloud resource security and management.Comment: 6 Page

Cyber-security of Cyber-Physical Systems (CPS)

This master's thesis reports on security of a Cyber-Physical System (CPS) in the department of industrial engineering at UiT campus Narvik. The CPS targets connecting distinctive robots in the laboratory in the department of industrial engineering. The ultimate objective of the department is to propose such a system for the industry. The thesis focuses on the network architecture of the CPS and the availability principle of security. This report states three research questions that are aimed to be answered. The questions are: what a secure CPS architecture for the purpose of the existing system is, how far the current state of system is from the defined secure architecture, and how to reach the proposed architecture. Among the three question, the first questions has absorbed the most attention of this project. The reason is that a secure and robust architecture would provide a touchstone that makes answering the second and third questions easier. In order to answer the questions, Cisco SAFE for IoT threat defense for manufacturing approach is chosen. The architectural approach of Cisco SAFE for IoT, with similarities to the Cisco SAFE for secure campus networks, provides a secure network architecture based on business flows/use cases and defining related security capabilities. This approach supplies examples of scenarios, business flows, and security capabilities that encouraged selecting it. It should be noted that Cisco suggests its proprietary technologies for security capabilities. According to the need of the project owners and the fact that allocating funds are not favorable for them, all the suggested security capabilities are intended to be open-source, replacing the costly Cisco-proprietary suggestions. Utilizing the approach and the computer networking fundamentals resulted in the proposed secure network architecture. The proposed architecture is used as a touchstone to evaluate the existing state of the CPS in the department of industrial engineering. Following that, the required security measures are presented to approach the system to the proposed architecture. Attempting to apply the method of Cisco SAFE, the identities using the system and their specific activities are presented as the business flow. Based on the defined business flow, the required security capabilities are selected. Finally, utilizing the provided examples of Cisco SAFE documentations, a complete network architecture is generated. The architecture consists of five zones that include the main components, security capabilities, and networking devices (such as switches and access points). Investigating the current state of the CPS and evaluating it by the proposed architecture and the computer networking fundamentals, helped identifying six important shortcomings. Developing on the noted shortcomings, and identification of open-source alternatives for the Cisco-proprietary technologies, nine security measures are proposed. The goal is to perform all the security measures. Thus, the implementations and solutions for each security measure is noted at the end of the presented results. The security measures that require purchasing a device were not considered in this project. The reasons for this decision are the time-consuming process of selecting an option among different alternatives, and the prior need for grasping the features of the network with the proposed security capabilities; features such as amount and type of traffic inside the network, and possible incidents detected using an Intrusion Detection Prevention System. The attempts to construct a secure cyber-physical system is an everlasting procedure. New threats, best practices, guidelines, and standards are introduced on a daily basis. Moreover, business needs could vary from time to time. Therefore, the selected security life-cycle is required and encouraged to be used in order to supply a robust lasting cyber-physical system

{SoK}: {An} Analysis of Protocol Design: Avoiding Traps for Implementation and Deployment

Today's Internet utilizes a multitude of different protocols. While some of these protocols were first implemented and used and later documented, other were first specified and then implemented. Regardless of how protocols came to be, their definitions can contain traps that lead to insecure implementations or deployments. A classical example is insufficiently strict authentication requirements in a protocol specification. The resulting Misconfigurations, i.e., not enabling strong authentication, are common root causes for Internet security incidents. Indeed, Internet protocols have been commonly designed without security in mind which leads to a multitude of misconfiguration traps. While this is slowly changing, to strict security considerations can have a similarly bad effect. Due to complex implementations and insufficient documentation, security features may remain unused, leaving deployments vulnerable. In this paper we provide a systematization of the security traps found in common Internet protocols. By separating protocols in four classes we identify major factors that lead to common security traps. These insights together with observations about end-user centric usability and security by default are then used to derive recommendations for improving existing and designing new protocols---without such security sensitive traps for operators, implementors and users

{SoK}: {An} Analysis of Protocol Design: Avoiding Traps for Implementation and Deployment

Today's Internet utilizes a multitude of different protocols. While some of these protocols were first implemented and used and later documented, other were first specified and then implemented. Regardless of how protocols came to be, their definitions can contain traps that lead to insecure implementations or deployments. A classical example is insufficiently strict authentication requirements in a protocol specification. The resulting Misconfigurations, i.e., not enabling strong authentication, are common root causes for Internet security incidents. Indeed, Internet protocols have been commonly designed without security in mind which leads to a multitude of misconfiguration traps. While this is slowly changing, to strict security considerations can have a similarly bad effect. Due to complex implementations and insufficient documentation, security features may remain unused, leaving deployments vulnerable. In this paper we provide a systematization of the security traps found in common Internet protocols. By separating protocols in four classes we identify major factors that lead to common security traps. These insights together with observations about end-user centric usability and security by default are then used to derive recommendations for improving existing and designing new protocols---without such security sensitive traps for operators, implementors and users

Resilient authentication service

Tese de mestrado em Engenharia Informática, apresentada à Universidade de Lisboa, através da Faculdade de Ciências, 2013A grande maioria dos sistemas online depende dos serviços básicos de autenticação e autorização. Estes são responsáveis por prover os recursos necessários para evitar acessos indevidos ou não autorizados a aplicações, dados ou redes. Para aceder aos recursos por norma os utilizadores usam um nome de utilizador e uma prova, que geralmente é uma senha, ou seja, uma informação teoricamente conhecida unicamente pelo respectivo utilizador. Nos últimos anos o uso de redes sem fios sofreu um grande aumento. A maioria destes serviços necessita de algum tipo de autenticação e mecanismos de autorização para dar ou não o acesso ao serviço e verificar os direitos e permissões dos utilizadores. Para isso o utilizador tem de se autenticar perante o serviço. É comum os utilizadores terem um par de nome de utilizador/palavra chave para cada serviço que usam. Isso traz problemas de gestão tanto para os utilizadores, que têm de memorizar as suas credenciais, como para os administradores, que têm de gerir um grande número de utilizadores. O utilizador não só tem de memorizar as credenciais para os serviços que usa como também passa a ter várias identidades, uma vez que identidades não são partilhadas entre serviços. Para resolver o problema de múltiplas identidades apareceu o modelo de identidade federada. As contas de utilizadores são agregadas num único provedor de identidade, a escolha de cada utilizador. Assim os utilizadores têm os seus dados num só local em que eles confiam e só tem de memorizar uma credencial. Isso permite usar as suas credenciais para acesso a vários serviços. Como exemplo podemos dar a rede sem fios eduroam. Esta dissertação vai se focar nos serviços de autenticação para redes sem fios com grande número de utilizadores. Com as identidades federadas os utilizadores podem aceder aos serviços de rede usando as suas credenciais a partir de qualquer local. No caso de serviço eduroam, um utilizador tendo credencias de uma instituição de ensino pode deslocar-se a outra instituição da federação em qualquer parte do mundo e ter acesso a rede usando as credenciais da sua instituição. Para isso os pontos de acesso usam um servidor de autenticação AAA (autenticação, autorização e responsabilidade), que no caso de eduroam é RADIUS. AAA é uma arquitectura que permite uso de protocolos de autenticação dos utilizadores nas redes de grande porte e é baseada em três componentes base, suplicante, NAS (e.g., router Wi-Fi) e o servidor de autenticação. Quando suplicante quer aceder a rede, ele manda as suas credenciais ao NAS e este usa o servidor de autenticação para validá-las. Ao longo da existência de arquitectura AAA foi dado mais enfase à segurança dos protocolos de autenticação do que a resiliência das componentes, tais como o NAS e o servidor de autenticação. No caso de falha do NAS o suplicante pode escolher outro e voltar tentar autenticar. Se o servidor de autenticação falhar, sofrer um ataque ou mesmo uma intrusão o atacante consegue negar acesso a rede aos utilizadores legítimos, ou roubar as credenciais dos mesmos e fazer um ataque à rede. No caso de uma federação, em que os utilizadores usam uma credencial para aceder a vários serviços, esse problema torna-se ainda mais grave, visto que o atacante consegue atacar não só um servidor de autenticação como toda a federação e os serviços prestados na rede da mesma. O grande objectivo desta dissertação é desenvolver um servidor de autenticação para redes sem fios resiliente, tolerante a faltas e as intrusões. Para cumprir estes objectivos foi escolhido o protocolo RADIUS devido a seu alargado uso (e.g., eduroam, provedores de Internet) e a sua simplicidade. As garantias de tolerância a faltas e a intrusões foram conseguidas através do uso de replicação activa, com máquinas de estados em conjunto com uma componente segura. A replicação de um serviço, por norma, obriga a uma mudança de cliente, neste caso seria o NAS, de modo a suportar a replicação. Durante o desenho de arquitectura teve-se o cuidado de evitar a mudança nas componentes mais próximas do suplicante, de modo a possibilitar a integração de novo serviço resiliente nas redes actuais. O protocolo RADIUS suporta, na sua definição base, mecanismos de autenticação fracos baseados em nome de utilizador/password, porque foi projectado para redes com fios. Em redes sem fios, geralmente é mais fácil escutar a comunicação e, assim, roubar credenciais dos utilizadores. A solução para este problema foi a adição de suporte de métodos de autenticação EAP (Extensible Authentication Protocol). Com a utilização de EAP, podemos adicionar métodos de autenticação fortes a fim de conseguir as propriedades de segurança durante a autenticação. A principal razão para usar EAP é eliminar a necessidade de mudar os componentes intermédios da rede, tais como NAS. Precisamos mudar apenas o suplicante e o servidor de autenticação. Os pacotes EAP são transportados através dos componentes de rede do suplicante para o servidor de autenticação através de, por exemplo, o protocolo 802.1X entre suplicante e NAS e RADIUS entre NAS e servidor de autenticação. O método de autenticação EAP escolhido foi EAP-TLS visto que é um padrão aberto e um dos mais robustos protocolos de autenticação. Permite uma autenticação fim-afim e a geração de chaves simétricas entre o suplicante e o servidor de autenticação de forma secreta. Apesar de ser um sistema de autenticação forte existe uma dificuldade em distribuição de credenciais. Ao contrário das credenciais baseadas em nome de utilizador/palavra chave, este método necessita de geração de um certificado para cada servidor de autenticação e para cada utilizador do sistema. O sistema desenhado e desenvolvido é composto por quatro componentes: suplicante (pede acesso a rede), NAS (no nosso caso é um router de rede sem fios), gateway (elimina a necessidade de alterarmos os clientes RADIUS existentes e funciona como cliente do nosso servidor de autenticação replicado) e servidor de autenticação RADIUS replicado (um serviço replicado tolerante a faltas bizantina e a intrusões). Para implementação do servidor de autenticação replicado e do seu cliente (gateway) foi usada biblioteca de replicação BFT-SMaRt. Cada servidor de autenticação tem a sua componente segura, que providencia a tolerância a intrusão escondendo os dados sensíveis do servidor, tais como seu certificado e chaves partilhadas com o NAS. Se o servidor necessitar de usar esses dados a componente segura providencia um interface que permite o servidor executar todas as operações necessárias que envolvem esses dados. Para validar o desempenho do sistema foram feitos vários testes de latência e de débito comparando o protótipo concretizado a uma implementação bastante popular de FreeRADIUS. Notaram-se algumas diferenças em termos de desempenho de serviço de RADIUS replicado em relação ao FreeRADIUS. Os testes mostraram que o RADIUS replicado tem uma latência superior e o débito inferior ou de FreeRADIUS. Isso deve-se, em especial, pelo facto do primeiro ser um sistema replicado e necessitar uma maior troca de mensagens devido aos protocolos BFT e replicação de máquina de estados. Apesar do RADIUS replicado ser um sistema replicado, consegue mostrar uma latência razoável e aceitável em ambientes de redes locais.The increasing use of the wireless networks in the last years has created the demand for authentication and authorization for these networks. The basic model usually requires a user, to access the network, authenticate itself before the authentication server using its credentials. Authentication and authorization in networks with the large number of users is usually achieved using the WPA-Enterprise mode. WPA-Enterprise allows the use of the external authentication server to validate user credentials and determinate his rights. Most common and widely used protocol for WPA-Enterprise is RADIUS, which follows AAA architecture. Normally RADIUS servers are running in a single machine and in a single process. If RADIUS server stops users are unable to authenticate and access the network. To solve this problem, most RADIUS servers are replicated for redundancy and load management. AAA architecture and RADIUS protocol fail completely in case of server Byzantine behavior, i.e., if a failure makes the system present arbitrary behavior. In case of intrusion on authentication server, the attacker is able to access user credentials and other sensible data, such as server certificates. The major focus of this work is to develop a resilient, fault- and intrusion-tolerant authentication server for WPA-Enterprise wireless networks, without changing existent systems. To meet these objectives we implemented a replicated RADIUS-compliant protocol, which uses EAP-TLS as its authentication method. Fault and intrusion tolerance is ensured using state machine replication, together with a tamper-proof component used for storing cryptographic keys related with user credentials. The service was evaluated and compared with a popular non-fault-tolerant solution, which is used in the eduroam network, FreeRADIUS. Initial results demonstrate the applicability of the proposed solution

Support for RADIUS Protocol in SSSD

Moderní trendy ve správě uživatelů ve firemních prostředích směřují k centralizovaným řešením jako je LDAP či Active Directory. Ověřování uživatelů vůči těmto úložištím v Unix-like systémech je dostupné buď přes PAM moduly, nebo nově i přes bezpečnostní démon SSSD. Tato práce analyzuje využití RADIUS protokolu pro ověřování uživatelů a v rámci práce byl vyvinut modul do SSSD umožňující využití tohoto protokolu.Modern trends in user management in enterprise solutions makes use of centralized solutions such as LDAP or Active Directory. User validation against those resources in Unix-like systems is available via PAM modules or via new security daemon SSSD. This work analyses the use of RADIUS protocol for user validation and as a part of this work was developed SSSD module which uses this protocol.

Design of an Enterprise Resource Planning System Using Service-Oriented Architecture

A typical ERP (Enterprise Resource Planning) system integrates many business functionalities such as billing, accounting, order processing, manufacturing and customer relationship management. Generally they are implemented as separate modules that are changed and modified as needed. However, lack of proper design can cause the modules to become tightly coupled. Unnecessary dependencies decrease maintainability because change in one part of the system can affect other parts. Large enterprise applications are often build by multiple organizations using varying methods and technologies. Development teams are not always fully aware of the work of others. This makes reusing existing features difficult and causes developers to recreate the same logic multiple times. This thesis describes how a monolithic architecture can be migrated into a service-oriented architecture (SOA). An ERP system designed for Apple service providers is used as an example. The large example system is converted into small services to improve its maintainability. The aim is to create an architecture that does not depend on a specific technology and supports reusing functionality. Although SOA has many benefits, effective use of it requires technological changes and adjustments to the whole development process. In the example system, lots of changes were made to the development, testing and deployment processes. The new architecture lead to eliminating lots of manual work. This was achieved by implementing a deployment pipeline that takes advantage of Docker virtual containers

Status of This Memo

This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. Copyright Notice Copyright (C) The Internet Society (2006). A mobile node needs at least the following information: a home address, a home agent address, and a security association with home agent to register with the home agent. The process of obtaining this information is called bootstrapping. This document discusses issues involved with how the mobile node can be bootstrapped for Mobile IPv6 (MIPv6) and various potential deployment scenarios for mobile node bootstrapping

Providing Secure Web Services for Mobile Applications

Changing consumer behavior drives the demand for convenient and easy-to-use mobile applications across industries. This also impacts the financial sector. Banks are eager to offer their services as mobile applications to match the modern consumer needs. The mobile applications are not independently able to provide the required functionality; they interact with the existing core business functions by consuming secure Web Services over the Internet. The thesis analyses the problem of how a bank can enable a new secure distribution and communication channel via the mobile applications. This new channel must be able to interact with existing core systems. The problem is investigated from different axis related to Web Services protocols suitable for mobile use, security solutions for the communication protocols and the required support available in the selected mobile operating systems. The result of the analysis is an architectural description to fulfil the presented requirements. In addition to constructing the architecture, the thesis also describes some of the more advanced threats targeted against mobile apps and Web Services and provides mitigation schemes for the threats. The selected architecture contains a modular security solution that can be utilized outside of the financial context as well. ACM Computing Classification System (CCS 2012): - Information systems → Web Services - Security and privacy → Software and application security - Software and its engineering → Software architecture