1 / 35

Security in a Distributed Resource Environment

Security in a Distributed Resource Environment. Profs. Steven A. Demurjian Q. Jin, J. Nam, Z. Qian and C. Phillips Computer Science & Engineering Department 191 Auditorium Road, Box U-155 The University of Connecticut Storrs, Connecticut 06269-3155. Paper Overview.

jneeley
Download Presentation

Security in a Distributed Resource Environment

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Security in a Distributed Resource Environment Profs. Steven A. Demurjian Q. Jin, J. Nam, Z. Qian and C. Phillips Computer Science & Engineering Department 191 Auditorium Road, Box U-155 The University of Connecticut Storrs, Connecticut 06269-3155

  2. Paper Overview • 1. Introduction and Motivation • 2. JINI • 3. System Architecture and Improvements • Merge Prototypes • Security Client Database • Dual Security Clients • Platform Independence • Leasing Enforcement • Negative Privileges • Architecture Improvements • Experimental Prototype • Related Work • Conclusions and Future Work

  3. Introduction and MotivationResearch Goals • Incorporation of Role-Based Approach within Distributed Resource Environment • Make Distributed Applications Available Using Middleware Tools • Propose Software Architecture and Role-Based Security Model for • Authorization of Clients Based on Role • Authentication of Clients and Resources • Enforcement so Clients Only Use Authorized Services (of Resource)

  4. Introduction and MotivationApproach • Many Middleware Lookup Services • Successfully Dictates Service Utilization • Requires Programmatic Solution for Security • DoesNot Selectively and Dynamically Control Access Based on Client Role • Security of a Distributed Resource Should Selectively and Dynamically Control Client Access to Services Based on the Role • Our Approach • Define Dedicated Resource to Authorize, Authenticate, and Enforce Security Policy based on Role of Client

  5. Introduction and MotivationInitial Architecture Role-Based Security Lookup Privileges Java Registration Service Client Java Database Client Software Legacy Agent Legacy COTS Client Database Database Client Lookup COTS Authorization COTS Service Client List Clients Using Services Resources Provide Services Figure 1.1: General Architecture of Clients and Resources.

  6. Introduction and MotivationInitial Prototypes • JINI Prototype of Role Based Approach • University Database (UDB) • Initial GUI for Sign In (Authorization List) • Student/faculty GUI Client (Coursedb) • Access to Methods Limited Based on Role (Ex: Only Student Can Enroll in a Course) • Security Client Prototype • Generic Tool • Uses Three Resources and Their Services • Role-Based Privileges • Authorization-List • Security Registration

  7. Introduction and MotivationSecurity System Resources and Services • Role-Based Privileges Resource • Define User-role • Grant/Revoke Access of Role to Resource • Register Services • Authorization List Resource • Maintains Client Profile (Many Client Types) • Client Profile and Authorize Role Services • Security Registration Resource • Register Client Service • Identity Registration at Startup • Uses IP Address • Services of Resource • Functionally Separated and Organized • Resemble Method Definitions (OO)

  8. Introduction and MotivationInitialSecurity Client and Resource Interactions Security Client General Resource Security Registration Find_Client(C_Id, IP_Addr); Find_All_Active_Clients(); Grant_UR_Client(UR_Id, C_Id); Revoke_UR_Client(UR, C_Id); Find_AllUR_Client(C_Id); Find_All_Clients_UR(UR); Create_New_Client(C_Id); Delete_Client(C_Id); Find_Client(C_Id); Find_All_Clients(); Authorization List Lookup Service Create_New_Role(UR_Name, UR_Disc, UR_Id); Delete_Role(UR_Id); Find_UR_Name(UR_Name); Find_UR_Id(UR_Id); Grant_Resource(UR_Id, R_Id); Grant_Service(UR_Id, R_Id, S_Id); Grant_Method(UR_Id, R_Id, S_Id, M_Id); Revoke_Resource(UR, R_Id); Revoke_Service(UR, R_Id, S_Id); Revoke_Method(UR, R_Id, S_Id, M_Id); Find_AllUR_Resource(UR,R_Id); Find_AllUR_Service(UR,R_Id,S_Id); Find_AllUR_Method(UR,R_Id,S_Id,M_Id); Find_UR_Privileges(UR); Discover Service Return Proxy Register_Resource(R_Id); Register_Service(R_Id, S_Id); Register_Method(R_Id, S_Id, M_Id); UnRegister_Resource(R_Id); UnRegister_Service(R_Id, S_Id); UnRegister_Method(R_Id, S_Id, M_Id); Role-BasedPrivileges Figure 1.2. Security Client and Database Resource Interactions.

  9. Introduction and MotivationClient Interactions and Processing GUI Client 1. Register_Client(C_Id, IP_Addr,UR); Security Registration 2. Verify_UR_Client(UR,C_Id); 4. Registration OK? 3. Client OK? 6.IsClient_Registered(C_ID) Authorization List 10. Modification OK? Lookup Service 7. Registration OK? Discover Service Return Proxy 5. ModifyAttr(C_ID,UR,Value) 8. Check_Privileges(UR,R_Id,S_Id,M_Id); Database Resource Role-BasedPrivileges 9. Privileges OK? Figure 3.1: Client Interactions and Service Invocations.

  10. Introduction and MotivationObjectives • Merge Prototypes • Implement Different DBMS • Use Multiple Different Computing Platforms • Establish Dual Security Clients • Leasing Enforcement • Implement Negative Privilege Policy • Improve Architecture

  11. JINILookup Service, Client and Resource Interactions

  12. System Architecture and ImprovementsMerge Prototypes

  13. System Architecture and Improvements JINI Prototype of Role Based Approach Role-Based Privileges &Sec. Reg. Role-Based Privileges &Sec. Reg. Java GUI Client1 Java GUI Client2 JINI Lookup Service Author. List Res. (copy 1) Author. List Res. (copy 2) CourseDB Resource (copy 1) CourseDB Resource (copy 2) DBServer Service GetClasses(); PreReqCourse(); GetVacantClasses(); EnrollCourse(); AddCourse(); RemoveCourse(); UpdateCourse(). Figure 3.3. University Database System Architecture

  14. System Architecture and Improvements Security Policy and Enforcement

  15. System Architecture and Improvements Security System Database

  16. System Architecture and Improvements Leasing, Negative Privilege Enforcement

  17. System Architecture and Improvements New Security Model Clients Using Services Enforcement Policy Lookup Lookup Client Client Service Service Java Database Client Software Legacy Agent Legacy COTS Client Database Database Client COTS SECURITY SECURITY General Resource COTS Client SYSTEM SYSTEM Resources Provide Services Figure 3.7: New Architecture of Clients and Resources.

  18. System Architecture and Improvements New Database Scheme

  19. Experimental Prototype Security Client Prototype Figure 4.1. Authentication GUI.

  20. Experimental PrototypePolicy Client Prototype Figure 4.2. Policy Client, Role, Create Role

  21. Experimental PrototypePolicy Client Prototype Figure 4.3. Policy Client, Role, Grant IP

  22. Experimental PrototypePolicy Client Prototype Figure 4.4. Policy Client, Resource, Method

  23. Experimental PrototypePolicy Client Prototype Figure 4.5. Policy Client, Resource, Resource

  24. Experimental PrototypePolicy Client Prototype Figure 4.6. Policy Client, Resource, Add Method to Service

  25. Experimental PrototypeEnforcement Client Prototype Figure 4.7. Enforcement Client, User, Create User

  26. Experimental PrototypeEnforcement Client Prototype Figure 4.8. Enforcement Client, User, Grant Role

  27. Experimental PrototypeEnforcement Client Prototype Figure 4.9. Enforcement Client, User, Negative Privileges

  28. Experimental PrototypeEnforcement Client Prototype Figure 4.10. Enforcement Client, Token, Unregister Token

  29. Experimental PrototypeUniversity Database Prototype Figure 4.11. University Database, Query Database

  30. Experimental PrototypeUniversity Database Prototype Figure 4.12. University Database, Update Course

  31. Experimental PrototypeUniversity Database Prototype Figure 4.13. University Database, Register Courses

  32. Security Policy & Enforcement (OS Security) Security Filters and Screens Header Encryption User-level Authen. IP Encapsulation Key Mgmt. Protocols Browser Security Use of Encryption Access Control Securing Comm. Channel Establishing a Trusted Computer Base Network Services Kerberos and Charon Security: Mobile Agents Saga Security Architecture Access Tokens Control Vectors Security Monitor Concordia Storage Protection Transmission Protection Server Resource Protection Other Topics Trust Appraisal Metric Analysis Short-lived Certificates Seamless Object Authentication Related Work

  33. Conclusions • For a Distributed Resource Environment • Proposed & Explained a Role-Based Approach • Presented Software Architecture Containing • Role-Based Security Model for a Distributed Resource Environment • Improved Prototype • Merged Prototypes • Improved Security Client • Token • Time Stamps • Negative Privileges • Dual Security Clients • Achieved Platform Independence

  34. Future Work • More on Negative Privileges • Chaining of Resource Invocations • Client Uses S1 on R1 that Calls S2 on R2 • Multiple Security Clients • What Happens When Multiple Security Clients Attempt to Modify Privileges at Same Time? • Security Client Hierarchy • Testing • Analysis Tool • Track Chaining of resources • Mandatory Access Control

  35. Future Work • Introduce Cryptography Technology • Location of Client vs. Affect on Service • What if Client in on Local Intranet? • What if Client is on WAN? • Are Privileges Different? • Tracking Computation for Identification Purposes • Currently Require Name, Role, IP Addr, Port # • How is this Tracked when Dynamic IP Addresses are Utilized?

More Related