security in distributed systems
DESCRIPTION
Security in Distributed Systems. Introduction and Design Issues Threats to security systems Security Mechanisms Design Issues: Focus of Data Control, Layering of security mechanisms and Simplicity Cryptography Basics of Cryptography - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/1.jpg)
Security in Distributed Systems
1. Introduction and Design Issuesa) Threats to security systemsb) Security Mechanismsc) Design Issues: Focus of Data Control, Layering of security
mechanisms and Simplicity
2. Cryptographya) Basics of Cryptographyb) Types of encryption: Symmetric, Asymmetric and Hash Functions
3. Secure Channelsa) Using Symmetric Keysb) Using Public/Private Keysc) Signing/Digital Signatures
4. Secure Mobile Codea) Sandboxing
1
![Page 2: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/2.jpg)
“Uncertainty is the only certainty there is, and knowing how to live with insecurity is the only security.”
• John Allen Paulos
2
Security in Distributed Systems
![Page 3: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/3.jpg)
Typical Software Stack
Application API
Middleware API
Network API
Security
network
3
![Page 4: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/4.jpg)
Security Threats
• Fabrication: generating data or activity that would not normally exist. For example, adding a password into a password file or database or falsifying a service.
4 possible threats to security in computer systems:
• Interception: unauthorized party has gained access to a service or data e.g. eavesdropping, illegal copying of data (or files)• also used to enforce ‘security’
• Interruption: when a service or data becomes unavailable, unusable, destroyed etc. e.g. when a file is lost or corrupted, denial of service by malicious attacks
• Modification: unauthorized changing the data or service.• intercepting and changing transmitted data • changing the behaviour of a service • altering database entries
4
![Page 5: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/5.jpg)
Security Mechanisms
• Need a Security Policy• defined at the business level
• Look at security mechanisms by which a policy can be enforced:
• Encryption: transforms data (encrypts) into unintelligible data i.e. implements confidentiality, integrity
• Authentication: verify the claimed identity of the user e.g. passwords, public/private-keys
• Authorization: is user authorized to access the resource e.g. unix
• Auditing: track which clients accessed what5
![Page 6: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/6.jpg)
Design Issues
• Focus of Control• Layering of Security mechanisms• Simplicity
6
![Page 7: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/7.jpg)
Methods
Data
Data
Data is protected against wrong or invalid operations
Methods
Data
methodData is protected
against unauthorized invocations
Methods
Data
User
Data is protected by checking the role of invoker
Focus of Data Control
7
![Page 8: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/8.jpg)
Application
Middleware
OS Services
Transport
Network
Datalink
Physical
OS Kernel
Hardware
Application
Middleware
OS Services
Transport
Network
Datalink
Physical
OS Kernel
Hardware
Network
Low-level protocols
High-level protocols
Machine A Machine B
• which level are the security mechanisms placed ? - communication or services (Middleware)
• depends on the trust of the client • application requirements
Issues:
Layering of Security Mechanisms
8
![Page 9: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/9.jpg)
The fewer security mechanisms the better !
• need to be easily understood• and trusted to work• simplicity will contribute to the trust that end
users will put into the application
The Good news …
The Bad news ..• Often applications are too complex and
security just makes it worse!• Security is often classified as ‘cross-cutting’ in
systems architecture, or vertical in a horizontal layered architecture.
• How do you keep this cross-cutting simple?
Simplicity
9
![Page 10: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/10.jpg)
Cryptography
• Basics of Cryptography• Types of Encryption• Symmetric Encryption• Asymmetric Encryption• Hash Functions
10
![Page 11: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/11.jpg)
Sender Receiver
Plaintext, P Plaintext, P
KeyK
Ciphertext, C
EncryptionMethod Ek(P)Key
K
Ciphertext, C
Network
DecryptionMethod
Dk(C)
Passive Intruder,
only listens
Active Intruder,
Can insert message
Active Intruder,
Can change message
Defence from:
Plaintext
Basics of Cryptography
11
![Page 12: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/12.jpg)
Text is converted to ciphertext by use of an algorithm and key• Algorithm is publicly known• Key is held private
Three Main Categories
• Secret Key (symmetric cryptosystem)– single key is used to encrypt and decrypt information
• Public/Private Key (asymmetric cryptosystem)– two keys are used: one for encryption and one for decryption
• One-way Function (hash functions)– information is encrypted to produce a “digest” of the original
information that can be used later to prove its authenticity
Types Of Encryption
12
![Page 13: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/13.jpg)
Sender and receiver have same secret key that will encrypt and decrypt plain text
– Strength of encryption technique depends on key length
– Some symmetrical algorithms• Data Encryption Standard (DES) - 56 bit key• Triple DES, DESX, GDES, RDES - 168 bit key • RC2, RC4, RC5 - variable length up to 2048 bits • IDEA - basis of PGP - 128 bit key• Blowfish - variable length up to 448 bits
Symmetric Encryption
13
![Page 14: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/14.jpg)
• widely-used
• private (secret) key - judged so difficult to break it was restricted for export by US Gov.
• 72,000,000,000,000,000 (72 quadrillion) or more possible encryption keys • key chosen at random - both sender and receiver must know and use the
same private key
• can run in several modes and involves 16 rounds or operations
• many companies use "triple DES“ - applies three keys in succession
• in 1997, Rivest-Shamir-Adleman, owners of another encryption approach, offered a $10,000 reward for breaking a DES message
• cooperative effort on the Internet of over 14,000 computer users trying out various keys finally deciphered the message, discovering the key after running through only 18 quadrillion of the 72 quadrillion possible keys!
• since that is has been superseded by Advanced Encryption Standard (AES)
Data Encryption Standard (DES)
14
![Page 15: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/15.jpg)
• Better Known as Public/Private Key– user X has a pair of keys one public and one private– To encrypt a message to X use X’s public key– X will decrypt encrypted message using X’s private key that “matches” X’s
public key– The keys are generated together in order that the encrypted data can be
reverse engineered.
• Most common algorithm is the RSA (Rivest Shamir Adelman) algorithm with key lengths from 512 to 1024 bits
o Pretty Good Privacy (PGP), o the Secure Sockets Layer (SSL), o S/MIME, Secure Electronic Transactions (SET), o Secure Shell (SSH). o X. 509 V.3 certificates as used in JXTA, Globus/OGSA o included in WWW browsers e.g. Netscape and Microsoft Internet Explorer
• Uses modular arithmetic & elementary number theory • based on the fact that it is extremely difficult to find the prime factors of
large numbers.
Asymmetric Encryption
15
![Page 16: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/16.jpg)
• One-Way Functions– non-reversible “quick” encryption– produces a fixed length value called a hash or
message digest– used to authenticate/integrity check contents of
a message– Common message digest functions
• MD4 and MD5– produces 128 bit hashes
• SHA– produces 160 bit hashes
Hash Functions
16
![Page 17: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/17.jpg)
Secure Channels
• Protecting communication between two users e.g. peer-to-peer or client server
• Two Types:– Symmetric
• Shared Secret Keys• Session Keys
– Asymmetric i.e. Public/Private Key
17
![Page 18: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/18.jpg)
Symmetric: Shared Secret Keys
• generated once and secretly passed to the individuals
• This can be done in a number of ways: • other methods e.g. by using public-keys • telephone each other • post it to each other.
• Example system that uses this is Kerberos.
18
![Page 19: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/19.jpg)
Symmetric: Session Keys
• Dynamically created at run time • Can be done in two ways: • by using public-keys
• generate a random key computed from a nonce encrypted using public keys
• dynamically create using Diffie-Hellman key exchange
19
![Page 20: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/20.jpg)
SymmetricDiffie-Hellman Key Exchange
• Also called exponential key agreement• Developed in 1976 - published ground-breaking paper "New Directions in
Cryptography." • Allows two users to exchange a secret key over an insecure medium without
any prior secrets.
1. Both pick 2 large numbers, n and g (public) – subject to certain mathematical properties
2. Tim chooses secret large random number = x3. Gareth chooses secret large random number = y4. Tim computes (gx) mod n (public: virtually impossible to compute x from gx mod n)5. Gareth computes gy mod n6. They exchange public keys (gx) mod n and (gy) mod n7. Gareth computes ((gx) mod n)y mod n = gxy mod n8. Then, Tim computes ((gy) mod n)x mod n = gxy mod n
Both now have the shared secret key gxy mod n
Algorithm:
20
![Page 21: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/21.jpg)
Example 1: Asymmetric Cryptosystem
• Tim sold Gareth a data projector for £750 through a chat room (email was their only communication channel).
• Gareth sends Tim a message confirming that he will buy the projector for £750.
• Two issues:– Tim needs to be assured that Gareth cannot deny
ever having sent the message (if he starts to get second thoughts)
– Gareth needs to be assured that Tim will not change the sum of £750 specified in his message to something higher
21
![Page 22: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/22.jpg)
Using Asymmetric: Public/Private Key Pairs:
1. Gareth encrypts the message using his private key
2. Gareth also encrypts the message (for privacy) using Tim’s public key
3. Tim can first decrypt the key using his private key then he can use Gareth’s public key to decrypt the original message from Gareth
So:
• If Tim accepts that Gareth’s public key is in fact his then this must mean that the message came from Gareth.
• Gareth knows that Tim received the message containing the original message because only Tim can open the message as he is the only person who has access to his private key 22
Asymmetric Cryptosystem Example
![Page 23: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/23.jpg)
Example 2: Digital Signatures
• Asymmetric cryptosystems allow users to digitally sign messages– allows a user to establish the message authenticity.
• A hash function is used in the process of creating and verify a digital signature– Converts the document into a hash– Concise and efficient for calculation
23
![Page 24: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/24.jpg)
Message
DigitalSignature
To Verifier
HashFunction
SigningFunction
PrivateKey
Signing
24
![Page 25: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/25.jpg)
Message
DigitalSignature
FromSigner
HashFunction
VerifyFunction
PublicKey
ValidYes/No?
Verifying
25
![Page 26: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/26.jpg)
Digital Signature Verification
• Verification indicates that:– the digital signature was created by the signer (i.e. s/he is the only
person with access to the private key) – that the message was not altered since it was signed (because
collisions are considered mathematically improbably).
• There exist a number of different mathematical formulas and procedures, but all share this overall operational pattern
• Note: Signing does not encrypt a message – it is merely a method of verifying identity– But encrypting a message with a private key also verifies a
message – but much less efficient if this is its only purpose
26
![Page 27: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/27.jpg)
Digital Certificates
• A certificate binds a public key with an identity– most common are X509 certificates
• typically include:– public key– details of the identity (organisation, email, location etc)– signature of the certificate generated by the private key of the certificate
issuer and a hash of the certificate’s contents.– verified with the public key of the issuer.
• can be either self-signed or signed by a Certificate Authority (CA)– CAs are well-known authorities e.g. VeriSign, godaddy
• Certificates can be chained, i.e., each certificate has been signed by the next in the chain.– Trusted CAs form the root certificate of the chain.
• In environments without central authority, certs can be used for a Web of Trust– I don’t know this person, but I know the person that signed their cert.
27
![Page 28: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/28.jpg)
SSL and TLS
• Secure Socket Layer (SSL):
• standard for encrypted client/server communication • protocol that runs on top of TCP/IP• utilizes several security techniques e.g. public keys,
symmetric keys, and certificates. • web sites commonly use SSL to guard private
information such as credit card numbers.
• Transport Layer Security (TLS):
• successor to the SSL that adds more processes to the handshake.
28
![Page 29: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/29.jpg)
TLS handshake on the Web• A server exposes a public certificate
– This might self-signed, or signed by a trusted third-party Certificate Authority (CA) e.g. GoDaddy
• Client connects to server and sends:– supported encryption algorithms (cyphers) and hash functions– a random number
• The server responds with– shared cyphers and hash functions– a random number– its public certificate
• The client examines the certificate– may ask user to verify if self-signed or signed by an unknown CA– responds with a PreMasterKey – a new random number encrypted with the server’s
public certificate key• Only the server can decrypt the PreMasterKey with its private key• Both then generate a master key from the PreMasterKey and the previously
sent random numbers• The concluding handshake message of both parties includes a hash over all
the messages seen by the party.– Master key is used to encrypt the messages in the subsequent session.
29
![Page 30: Security in Distributed Systems](https://reader035.vdocuments.mx/reader035/viewer/2022062501/5681687f550346895ddef2f8/html5/thumbnails/30.jpg)
Java Sandbox
A Java Sandbox prohibits:
• Reading or writing to the local disk • Making network connections to any host,
except the host that hosted the applet• Creating a new process • Loading a new dynamic library and
therefore directly calling a native method
• Typically for applets• …but for P2P also ? CPU sharing etc• “Signed Applets” are trusted and treat like local code
• Also implicit in the VM model• Application thinks it sees the machine but it is just an image that can be isolated• from other other VMs on the machine, and the machine itself
30