Security, Trust and Privacy (STP) Model for Federated Identity and Access Management (FIAM) Systems

The federated identity and access management systems facilitate the home domain organization users to access multiple resources (services) in the foreign domain organization by web single sign-on facility. In federated environment the user’s authentication is performed in the beginning of an authentication session and allowed to access multiple resources (services) until the current session is active. In current federated identity and access management systems the main security concerns are: (1) In home domain organization machine platforms bidirectional integrity measurement is not exist, (2) Integrated authentication (i.e., username/password and home domain machine platforms mutual attestation) is not present and (3) The resource (service) authorization in the foreign domain organization is not via the home domain machine platforms bidirectional attestation

Trust and integrity in distributed systems

In the last decades, we have witnessed an exploding growth of the Internet. The massive adoption of distributed systems on the Internet allows users to offload their computing intensive work to remote servers, e.g. cloud. In this context, distributed systems are pervasively used in a number of difference scenarios, such as web-based services that receive and process data, cloud nodes where company data and processes are executed, and softwarised networks that process packets. In these systems, all the computing entities need to trust each other and co-operate in order to work properly. While the communication channels can be well protected by protocols like TLS or IPsec, the problem lies in the expected behaviour of the remote computing platforms, because they are not under the direct control of end users and do not offer any guarantee that they will behave as agreed. For example, the remote party may use non-legitimate services for its own convenience (e.g. illegally storing received data and routed packets), or the remote system may misbehave due to an attack (e.g. changing deployed services). This is especially important because most of these computing entities need to expose interfaces towards the Internet, which makes them easier to be attacked. Hence, software-based security solutions alone are insufficient to deal with the current scenario of distributed systems. They must be coupled with stronger means such as hardware-assisted protection. In order to allow the nodes in distributed system to trust each other, their integrity must be presented and assessed to predict their behaviour. The remote attestation technique of trusted computing was proposed to specifically deal with the integrity issue of remote entities, e.g. whether the platform is compromised with bootkit attacks or cracked kernel and services. This technique relies on a hardware chip called Trusted Platform Module (TPM), which is available in most business class laptops, desktops and servers. The TPM plays as the hardware root of trust, which provides a special set of capabilities that allows a physical platform to present its integrity state. With a TPM equipped in the motherboard, the remote attestation is the procedure that a physical node provides hardware-based proof of the software components loaded in this platform, which can be evaluated by other entities to conclude its integrity state. Thanks to the hardware TPM, the remote attestation procedure is resistant to software attacks. However, even though the availability of this chip is high, its actual usage is low. The major reason is that trusted computing has very little flexibility, since its goal is to provide strong integrity guarantees. For instance, remote attestation result is positive if and only if the software components loaded in the platform are expected and loaded in a specific order, which limits its applicability in real-world scenarios. For such reasons, this technique is especially hard to be applied on software services running in application layer, that are loaded in random order and constantly updated. Because of this, current remote attestation techniques provide incomplete solution. They only focus on the boot phase of physical platforms but not on the services, not to mention the services running in virtual instances. This work first proposes a new remote attestation framework with the capability of presenting and evaluating the integrity state not only of the boot phase of physical platforms but also of software services at load time, e.g. whether the software is legitimate or not. The framework allows users to know and understand the integrity state of the whole life cycle of the services they are interacting with, thus the users can make informed decision whether to send their data or trust the received results. Second, based on the remote attestation framework this thesis proposes a method to bind the identity of secure channel endpoint to a specific physical platform and its integrity state. Secure channels are extensively adopted in distributed systems to protect data transmitted from one platform to another. However, they do not convey any information about the integrity state of the platform or the service that generates and receives this data, which leaves ample space for various attacks. With the binding of the secure channel endpoint and the hardware TPM, users are protected from relay attacks (with hardware-based identity) and malicious or cracked platform and software (with remote attestation). Third, with the help of the remote attestation framework, this thesis introduces a new method to include the integrity state of software services running in virtual containers in the evidence generated by the hardware TPM. This solution is especially important for softwarised network environments. Softwarised network was proposed to provide dynamic and flexible network deployment which is an ever complex task nowadays. Its main idea is to switch hardware appliances to softwarised network functions running inside virtual instances, that are full-fledged computational systems and accessible from the Internet, thus their integrity is at stake. Unfortunately, currently remote attestation work is not able to provide hardware-based integrity evidence for software services running inside virtual instances, because the direct link between the internal of virtual instances and hardware root of trust is missing. With the solution proposed in this thesis, the integrity state of the softwarised network functions running in virtual containers can be presented and evaluated with hardware-based evidence, implying the integrity of the whole softwarised network. The proposed remote attestation framework, trusted channel and trusted softwarised network are implemented in separate working prototypes. Their performance was evaluated and proved to be excellent, allowing them to be applied in real-world scenarios. Moreover, the implementation also exposes various APIs to simplify future integration with different management platforms, such as OpenStack and OpenMANO

Engineering Trustworthy Systems by Minimizing and Strengthening their TCBs using Trusted Computing

The Trusted Computing Base (TCB) describes the part of an IT system that is responsible for enforcing a certain security property of the system. In order to engineer a trustworthy system, the TCB must be as secure as possible. This can be achieved by reducing the number, size and complexity of components that are part of the TCB and by using hardened components as part of the TCB. Worst case scenario is for the TCB to span the complete IT system. Best case is for the TCB to be reduced to only a strengthened Root of Trust such as a Hardware Security Module (HSM). One such very secure HSMs with many capabilities is the Trusted Platform Module (TPM). This thesis demonstrates how the TCB of a system can be largely or even solely reduced to the TPM for a variety of security policies, especially in the embedded domain. The examined scenarios include the policies for securing of device resident data at rest also during firmware updates, the enforcement of firmware product lines at runtime, the securing of payment credentials in Plug and Charge controllers, the recording of audit trails over attestation data and a very generic role-based access management. In order to allow evaluating these different solutions, the notion of a dynamic lifecycle dimension for a TCB is introduced. Furthermore, an approach towards engineering such systems based on a formal framework is presented. These scenarios provide evidence for the potential to enforce even complex security policies in small and thus strong TCBs. The approach for implementing those policies can often be inspired by a formal methods based engineering process or by means of additive functional engineering, where a base system is expanded by increased functionality in each step. In either case, a trustworthy system with high assurance capabilities can be achieved

Non-Interactive MPC with Trusted Hardware Secure Against Residual Function Attacks

Secure multiparty computation (MPC) has been repeatedly optimized, and protocols with two communication rounds and strong security guarantees have been achieved. While progress has been made constructing non-interactive protocols with just one-round of online communication (i.e., non-interactive MPC or NI-MPC), since correct evaluation must be guaranteed with only one round, these protocols are by their nature vulnerable to the residual function attack in the standard model. This is because a party that receives a garbled circuit may repeatedly evaluate the circuit locally, while varying their own inputs and fixing the input of others to learn the values entered by other participants. We present the first MPC protocol with a one-round online phase that is secure against the residual function attack. We also present rigorous proofs of correctness and security in the covert adversary model, a reduction of the malicious model that is stronger than the semi-honest model and better suited for modeling the behaviour of parties in the real world, for our protocol. Furthermore, we rigorously analyze the communication and computational complexity of current state of the art protocols which require two rounds of communication or one-round during the online-phase with a reduced security requirement, and demonstrate that our protocol is comparable to or outperforms their complexity

Demystifying Internet of Things Security

Break down the misconceptions of the Internet of Things by examining the different security building blocks available in Intel Architecture (IA) based IoT platforms. This open access book reviews the threat pyramid, secure boot, chain of trust, and the SW stack leading up to defense-in-depth. The IoT presents unique challenges in implementing security and Intel has both CPU and Isolated Security Engine capabilities to simplify it. This book explores the challenges to secure these devices to make them immune to different threats originating from within and outside the network. The requirements and robustness rules to protect the assets vary greatly and there is no single blanket solution approach to implement security. Demystifying Internet of Things Security provides clarity to industry professionals and provides and overview of different security solutions What You'll Learn Secure devices, immunizing them against different threats originating from inside and outside the network Gather an overview of the different security building blocks available in Intel Architecture (IA) based IoT platforms Understand the threat pyramid, secure boot, chain of trust, and the software stack leading up to defense-in-depth Who This Book Is For Strategists, developers, architects, and managers in the embedded and Internet of Things (IoT) space trying to understand and implement the security in the IoT devices/platforms

Security and trust in a Network Functions Virtualisation Infrastructure

L'abstract è presente nell'allegato / the abstract is in the attachmen

Forensics from trusted computing and remote attestation

Abstract. The demand for forensics tools is ever-increasing as cyber-attacks become more frequent and devastating. The only way to maintain the system’s trusted state is to keep the mechanisms to uncover malware more competitive than cyber-attackers’ abilities to create them. We provide a digital forensics tool and procedures specifically tailored for integration with remote attestation. Example Root Cause Analysis investigations are performed, where digital forensics plays the main role of evidence provider.Rikostekninen tieto tietoturvallisesti käyttäen etätodennusta. Tiivistelmä. Tietoturvahyökkäysten yleistyessä tarve rikostodennustyökaluille lisääntyy. Ainut keino digitaalisten järjestelmien turvaamiseksi, on olla askeleen edellä tietoturvahyökkääjiä. Onnistuakseen tässä tavoitteessa tietoturvatutkijoiden on kehitettävä jatkuvasti tehokkaampia menetelmiä haittaohjelmien havaitsemiseksi. Tämä työ tarjoaa uuden digitaalisen rikostutkinnan työkalun, jota voidaan hyödyntää etätodennuksen kanssa. Työssä esitellään tutkintatapausesimerkkejä, joiden lopputuloksiin päästään hyödyntäen perussyyanalyysiä ja digitaalisen rikostutkinnan työkalua todistuaineiston tarjoajana

Network Access Control Based on Endpoint Integrity - Industry Standards and Commercial Implementations

Tietoturva on keskeinen osa nykyaikaista verkkosuunnittelua. Perinteisesti tietoturvaa on pyritty parantamaan käyttämällä mm. verkkojen segmentointia, palomuureja sekä erilaisia IDS/IPS-järjestelmiä. Ongelma nykypäivän organisaatioissa on yhä enemmän ja enemmän liikkuvat käyttäjät. Kannettavat tietokoneet ovat syrjäyttäneet perinteiset pöytätietokoneet, mikä tuo uusia riskejä tietoturvanäkökulmasta sillä laitteet liikkuvat suojatun yritysverkon ulkopuolelle. Käyttävät kytkevät laitteita julkiseen verkkoon lentokentällä, kahviloissa sekä hotellien aulassa. Julkisissa verkoissa koneet altistuvat helpommin hyökkäyksille. Mikäli laitteen tietoturva-asetukset eivät ole ajan tasalla tai esimerkiksi palomuuri on kytketty pois päältä, laite saattaa saada tartunnan. Siinä vaiheessa kun saastunut kone kytketään takaisin yrityksen sisäverkkoon, tartunta saattaa levitä koko verkon laajuisesti. Päätelaitteen eheyteen pohjautuva verkon pääsynvalvonta on joukko mekanismeja, joiden avulla päätelaitten tietoturva-asetukset voidaan pakottaa määritettyjen tietoturvakäytäntöjen mukaisiksi. Laitteen muodostaessa yhteyden verkkoon sille tehdään tietyt tarkistukset, joiden pohjalta päätetään sallitaanko laitteen pääsy verkkoon. Laitteet, jotka eivät vastaa tietoturvakäytäntöjä, voidaan eristää erilliseen karanteeniverkkoon, jossa laitteiden asetukset voidaan palauttaa käytäntöjen mukaisiksi esimerkiksi asentamalla uusimmat virustunnisteet.Network security is an essential part of designing today's corporate networks. Traditionally security threats have been addressed by using network segmentation, firewalls, intrusion detection systems and so forth. However, most of the networks are still vulnerable to attacks coming from inside the internal network. Users in enterprise environments are becoming increasingly mobile when desktop computers are changing to portable computers and handheld devices. From a security perspective this poses new threats. The devices are moved outside the secure corporate network and connected to insecure networks in airports, hotels, caf es, etc. Their security software that defends from malicious users might not be up to date which may expose the device to infection. When the device is connected back to the corporate environment, the whole network might become under threat. Network Access Control based on Endpoint Integrity is a set of mechanisms to enforce security policies for network devices. The idea is that network access is granted only after certain compliance checks have been passed. Non-compliant endpoints can be denied access or they can be isolated into a dedicated network segment where they can be remediated. Remediation is the process where a non-compliant node is made compliant by applying necessary changes into configurations, installing the latest virus signatures, etc