Q-ESP: a QoS-compliant Security Protocol to enrich IPSec Framework

IPSec is a protocol that allows to make secure connections between branch offices and allows secure VPN accesses. However, the efforts to improve IPSec are still under way; one aspect of this improvement is to take Quality of Service (QoS) requirements into account. QoS is the ability of the network to provide a service at an assured service level while optimizing the global usage of network resources. The QoS level that a flow receives depends on a six-bit identifier in the IP header; the so-called Differentiated Services code point (DSCP). Basically, Multi-Field classifiers classify a packet by inspecting IP/TCP headers, to decide how the packet should be processed. The current IPSec standard does hardly offer any guidance to do this, because the existing IPSec ESP security protocol hides much of this information in its encrypted payloads, preventing network control devices such as routers and switches from utilizing this information in performing classification appropriately. To solve this problem, we propose a QoS-friendly Encapsulated Security Payload (Q-ESP) as a new IPSec security protocol that provides both security and QoS supports. We also present our NetBSD kernel-based implementation as well as our evaluation results of Q-ESP

Sécurité des réseaux et infrastructures critiques

Les infrastructures et réseaux critiques commencent à s'ouvrir vers des architectures, protocoles et applications vulnérables. Ainsi, non seulement il est question de sécuriser ces applications (e.g., contre les attaques potentielles), mais il faut également justifier notre confiance dans les mécanismes de sécurité déployés. Pour cela, nous présentons PolyOrBAC, un cadriciel basé sur le modèle de contrôle d'accès OrBAC, les mécanismes de services Web ainsi que les contrats électroniques. Ensuite, nous préconisons l'utilisation de la Programmation Logique par Contraintes (PLC) pour détecter et résoudre les conflits éventuels dans la politique de sécurité. Au niveau de la mise en œuvre, nous proposons le protocole Q-ESP, notre amélioration d'IPSec qui assure à la fois des besoins de sécurité et de QoS. Enfin, nous présentons nos modèles et résultats de test et d'évaluation d'outils de sécurité notamment les Systèmes de Détection d'Intrusions (IDS)

Extending Firewall Session Table to Accelerate NAT, QoS Classification and Routing

security and QoS are the two most precious objectives for network systems to be attained. Unfortunately, they are in conflict, while QoS tries to minimize processing delay, strong security protection requires more processing time and cause packet delay. This article is a step towards resolving this conflict by extending the firewall session table to accelerate NAT, QoS classification, and routing processing time while providing the same level of security protection. Index Terms ? stateful packet filtering; firewall; session/state table; QoS; NAT; Routing

Defining categories to select representative attack test-cases

7 pagesRapport LAAS-CNRSTo ameliorate the quality of protection provided by intrusion detection systems (IDS) we strongly need more effective evaluation and testing procedures. Evaluating an IDS against all known and unknown attacks is probably impossible. Nevertheless, a sensible selection of representative attacks is necessary to obtain an unbiased evaluation of such systems. To help in this selection, this paper suggests applying the same approach as in software testing: to overcome the problem of an unmanageably large set of possible inputs, software testers usually divide the data input domain into categories (or equivalence classes), and select representative instances from each category as test cases. We believe that the same principle could be applied to IDS testing if we have a reasonable classification. In this paper we make a thorough analysis of existing attack classifications in order to determine whether they could be helpful in selecting attack test cases. Based on our analysis, we construct a new scheme to classify attacks relying on those attributes that appear to be the best classification criteria. The proposed classification is mainly intended to be used for testing and evaluating IDS although it can be used for other purposes such as incident handling and intrusion reporting. We also apply the Classification Tree Method (CTM) to select attack test cases. As far as we know, this is the first time that this method is applied for this purpose

PolyOrBAC: a security framework for critical infrastructures

International audienceDue to physical and logical vulnerabilities, a critical infrastructure (CI) can encounter failures of various degrees of severity, and since there are many interdependencies between CIs, simple failures can have dramatic consequences on the users. In this paper, we mainly focus on malicious threats that might affect the information and communication system that controls the Critical Infrastructure, i.e., the Critical Information Infrastructure (CII). To address the security challenges that are specific of CIIs, we propose a collaborative access control framework called PolyOrBAC. This approach offers each organization taking part in the CII the capacity of collaborating with the other ones, while maintaining a control on its resources and on its internal security policy. The interactions between organizations participating in the CII are implemented through web services (WS), and for each WS a contract is signed between the service-provider organization and the service-user organization. The contract describes the WS functions and parameters, the liability of each party and the security rules controlling the interactions. At runtime, the compliance of all interactions with these security rules is checked. Every deviation from the signed contracts triggers an alarm, the concerned parties are notified and audits can be used as evidence for sanctioning the party responsible for the deviation. Our approach is illustrated by a practical scenario, based on real emergency actions in an electric power grid infrastructure, and a simulation test bed has been implemented to animate this scenario and experiment with its security issues

ICT Systems Security and Privacy Protection: 29th IFIP TC 11 International Conference, SEC 2014 Marrakech, Morocco, June 2-4, 2014

International audienceBook Front Matter of AICT 42

MODÈLES ET POLITIQUES DE SECURITE POUR LES DOMAINES DE LA SANTE ET DES AFFAIRES SOCIALES

While information technology is essential in complex, cooperative and largely distributed applications like telemedicine or social declarations, it becomes more and more necessary to have a high confidence in the processing and the distribution of data and services. This thesis proposes an approach based on a security policy, for healthcare and social information and communication systems (HSICS). These systems cover the whole of the needs generally found in other fields: interworking of systems, complexity of organizations, sensitivity of information, and diversity of security requirements (confidentiality, integrity, availability and auditability).The aim of the approach is to achieve a good trade-off between respect of the least privilege principle and flexibility of the access control. The first step consists in describing the system, identifying sensitive information and characterizing the threats. Then, the security policy specifies security properties that must be satisfied, and the rules expressing how the protection state of the system may evolve. The identified security policy is original in the way that it takes the context into account, and is flexible enough to manage any improvement, change or update in the system.Besides, a new access control model is presented: the Organization-Based Access Control (Or-BAC). In Or-BAC, the specification of the security policy is completely parameterized by the organization so that it is possible to handle simultaneously several security policies associated with different organizations. The model is not restricted to permissions, but it also includes the possibility to define prohibitions, obligations and recommendations. In this respect, Or-BAC is able to specify policies developed for HSICS, as it can be applied to a large range of complex and distributed applications.Or-BAC is represented by UML diagrams, and by a new logical language based on deontic logic. It is also integrated in a system security UML model. A prototype has been developed to illustrate the application of the security policy in the case of a dental center.Ce mémoire propose une démarche pour définir des politiques de sécurité adaptées aux systèmes d'informations et de communication en santé et social (SICSS). Ces systèmes couvrent l'ensemble des besoins généralement trouvés dans les autres domaines : interopérabilité des systèmes, complexité des organisations, sensibilité des informations et diversité des exigences de sécurité (confidentialité, intégrité, disponibilité et auditabilité).Le but de la méthode présentée est de réaliser un bon compromis entre le respect du principe du moindre privilège et la flexibilité du contrôle d'accès. La première étape consiste à décrire le système, identifier les informations à protéger et caractériser les menaces. La politique de sécurité vient ensuite spécifier comment contrer ces menaces, en exprimant d'une part, un ensemble de propriétés de sécurité qui doivent être satisfaites, et d'autre part, un ensemble de règles permettant de modifier l'état de protection du système. Les politiques de sécurité que nous proposons ont l'originalité de tenir compte du contexte et de l'interopérabilité, et d'être suffisamment souples pour prendre en compte toute amélioration, changement ou mise à jour dans le système.Par ailleurs, un nouveau modèle de contrôle d'accès est ici présenté : le modèle Or-BAC (pour Organization-Based Access Control). Ce modèle permet de prendre en compte des informations de contexte dans l'expression des règles, afin de spécifier un contrôle d'accès fin et adapté. Il est aussi un moyen de spécifier, dans un cadre homogène, plusieurs politiques de sécurité pour des organisations différentes devant coopérer. Or-BAC n'est pas restreint aux permissions, mais permet également de définir des interdictions, des obligations et des recommandations. À cet égard, Or-BAC est capable de spécifier des politiques de sécurité pour les SICSS, comme il peut être appliqué à une gamme très large d'applications complexes, interopérables et distribuées. Or-BAC est d'abord représenté par des diagrammes UML, puis dans un nouveau langage logique fondé sur la logique déontique. Il est par ailleurs intégré dans une modélisation UML d'une démarche sécuritaire globale spécifiant les aspects statiques et dynamiques des phases d'authentification et d'autorisation.Enfin, un prototype a été développé pour illustrer l'application de la politique et du modèle de sécurité dans le cas d'un centre dentaire