Search

International audience; In order to guarantee security properties, such as confidentiality and integrity, cryptographic mechanisms provide encryption and signature of data, but protection is required to control the data accesses. The recent attacks on Facebook and Twitter show that the protection must not be limited to the infrastructure i.e. the hosts and the guest virtual machines.

International audience; HPC clusters are costly resources, hence nowadays these structures tend to be co-financed by several partners. A cluster administrator has to be designated, whose duties include, amongst others, the prevention of accidental data leakage or theft. Linux has been chosen as an operating system for the CEA's computing platforms. However, strong system security solutions such as SELinux are usually difficult to set up in large environments. This article presents how we have adapted a MAC mechanism in order to enforce confidentiality and integrity between a large number of users. First we define our security objectives, and show how they direct our technical choices. Then we present how confinement was achieved using the SELinux security mechanism, and how various attack scenarios were addressed. We then focus on the use of Mandatory Categories, access control on high bandwidth network filesystems and the integration of new users and applications. We discuss some residual technical challenges. Finally, we present benchmark results and validate the acceptable performance impact of our deployment on a modern cluster.

International audience; Modern operating systems continue to be the victims of attacks and information leaks. Emerging architectures such as cloud computing or HPC are complex to set up and face many kinds of security threats. However, they still rely on traditional access control mechanisms to protect the system and users' data, whereas these mechanisms can be misconfigured and easily defeated. In this article, we present a full architecture to enhance the protection of H P C clusters. It provides three levels of access control in order to allow the users control over their files while enforcing advanced security properties. More specifically, the integration of mandatory access control enables to control direct information flows, and a new and specific reference monitor deals with indirect information flows. In order to keep a low impact on operating system performances, we propose to centralize this second reference monitor on a dedicated node, controlling the flows on all other nodes through the low latency network. We present the whole architecture and the results of several benchmarks that indicate a low impact on performances. Then we expose how we make this architecture fault-tolerant. This study takes advantage of previous works dealing with access control on workstations or virtualisation technologies, and extends the concepts to the HPC environment.

International audience; Assessing the impact of Mandatory Access Control (MAC) integration on the Linux kernel performance is still an open problem. Regarding the specific paradigm of MAC in High Performance Computing, there are actually few works. Yet, guaranteeing security properties on a shared cluster is both a necessity and a challenge. This is a necessity because it is mandatory to ensure the confidentiality and integrity of data computed by the users, and a challenge because a cluster is a costly resource built with performance in mind. This paper deals with the need to integrate MAC in Linux-based operating systems for HPC clusters in an efficient way.

International audience; The security of shared High Performance Com- puting clusters is still an open research problem. Existing solutions deal with sandboxing and Discretionary Access Con- trol for controlling remote connections. Guaranteeing security properties for a shared cluster is complex since users demand an environment at the same time efficient and preventing confidentiality and integrity violations. This paper studies two different approaches for protecting remote interactive accesses against malicious operations. Those two approaches leverage the SELinux protection. They have been successfully implemented using standard MAC from SELinux, and guar- antee supplementary security properties thanks to our PIGA HIPS. The paper compares those two different approaches. It presents a real use case for the security of a shared cluster that allows interactive connections for users while preventing confidentiality and integrity violations. We propose a new approach to extend the protection offered by SELinux. One of the two policies studied previously is used as a basis, and PIGA is used to define new security properties that cannot be guaranteed by SELinux. These new properties are defined in the article, in a language specific to PIGA. Their objective is to prevent complex or indirect malicious activities that use combinations of processes and covert channels. Then PIGA analyses the SELinux policy and finds the remaining allowed illegal activities, either direct or indirect. Finally the article shows how PIGA can be used as an HIPS to enforce these new security properties that cannot be enforced by SELinux alone.

International audience; Protecting a HPC cluster against real world cyber threats is a critical task, with the increasing trend to open and share computing resources. As partners can upload data that is confidential regarding other partners, a company managing a shared cluster has to enforce strong security measures. It has to prevent both accidental data leakage and voluntary data stealing. When using an operating system based on Linux, the offered protections are difficult to set up in large scale environments. This article presents how to use the Mandatory Access Control feature of SELinux in order to guarantee strong security properties for HPC clusters. The proposed solution is based on the use of the Multi-Category System, the confinement of user profiles and the use of a dual SSH server. The issues encountered during the implementation and the most difficult technical points are presented. Finally, this paper shows experimental results about the performance of our solution and the impact on a large scale cluster.

International audience; This paper focuses on the enforcement of security properties fitting with dynamic mandatory access control policies. It adds complementary results to previous works of the authors in order to better address dynamic policies. Previous works of the authors provide several advances for enforcing the security of MAC system.An administration language for formalizing a large set of security properties is available to system administrators. That language uses several flow operators and ease the formalization of the required security properties. A solution is also available for computing the possible violations of any security property that can be formalized using our language. That solution computes several flow graphs in order to find all the allowed activities that can violate the requested properties. That paper addresses remaining problems related to the enforcement of the same kind of properties but with dynamic MAC policies. Enforcement is more much complex if we consider dynamic policies since the states of those policies are theoretically infinite. A new approach is proposed for dynamic MAC policies. The major idea is to use a meta-policy language for controlling the allowed evolutions of those dynamic policies. According to those meta-policy constraints, the computation problem becomes easier. The proposed solution adds meta-nodes within the considered flow graphs. A general algorithm is given for computing the required meta-nodes and the associated arcs. The proposed meta-graphs provide an overestimation of the possible flows between the different meta-nodes. The computation of the possible violations within the allowed dynamic policies is thus allowed. Several concrete security properties are considered using regular expressions for identifying the requested meta-contexts. The resulting violations, within the allowed meta-graphs, are computed and real violations are presented.

International audience; This paper proposes a technical solution for protecting users using a shared NFS service possibly controlled by a malicious user. The main goal is to protect the integrity and confidentiality of user's resources. Moreover, we propose to solve a more difficult challenge: how to prevent a malicious user from exploiting a supposed NFS vulnerability in order to read or write the resources of another user? Thus, this paper assumes that a vulnerability might exist in the NFS protocol or software components that gives the ability to a malicious user to execute any arbitrary code on the NFS server. Technical details about the implantation of Mandatory Access Control mechanisms with Multi Categories on the server side are given. The proposed solution avoids heavy modifications of the clients and only relies on the authentication of these clients.

Multi-Level Security (MLS) has been widely used in order to implement confidentiality policies inside organizations, especially into military ones. More recently, some works have been done about the use of MLS inside Security Enhanced Linux (SELinux) operating systems. The main motivation is to have MLS open source system without rewriting applications to work under such OS. Although the MLS mechanisms have been implemented at the operating system level, that doesn't imply that the system is usable, from an end-user point-of-view. In this paper, we survey the state of the art and technology about the support of MLS under SELinux operating systems. Keeping in mind the main objectives of MLS (i.e., preventing information flows between users), we will deeply experiment OS level mechanisms for MLS control and applications compatibility with such controls. We will discuss remaining issues and future directions to explore.

International audience; This paper deals with the classification of malicious activities occurring on a network of SELinux hosts. SELinux system logs come from a high interaction distributed honeypot. An architecture is proposed to compute those events in order to assemble system sessions, such as malicious ones. Afterwards, recognition mechanisms are proposed to classify those activities. The paper presents the classification architecture using comprehensive examples. It is the first solution that supports SELinux sessions. In contrast with previous works, distributed sessions are better addressed using only SELinux logs. The results of experiments use real samples taken from our honeypot. A high performance architecture enables to compute a large amount of events captured during one year on our high interaction honeypot. Our approach enables the real-time reconstruction of system sessions. Moreover, sessions are compared to patterns in order to classify them according to specific attacks. The paper shows that the classification can be done in a linear time. An automatic recognition of new patterns is proposed.

Security Management is becoming a critical aspect for large scale distributed systems. In this paper, we propose a global architecture, based on an original meta-policy approach for access control and intrusion detection, allowing to guarantee global security properties. In contrast with classical meta-policy based systems, by applying verification techniques on the meta-policy, our solution guarantees global security properties while supporting local updates of the security policy. It is thus a powerful solution that provides strong fault tolerance since the control is carried out in a complete decentralized manner. By using a meta-policy, the system can verify the respect of global security properties after meta or local modifications of the policy. Thanks to test components, our system is also able to evaluate and configure in real-time each of its functionalities while tracking self corruption by malicious hackers. Our architecture is a cooperative multi agent-based system, making it possible to activate a functionality independently from some others. It is divided into several levels, each one contributing to the automation of the security management.

This paper presents a novel intrusion detection approach and a new infrastructure to enforce the security policy within a distributed system. The solution guaranties the consistency of the security policy and prevents any accidental or malicious update (of the local policies). The control is carried out locally (in each host) in accordance with a meta-policy that enables a distributed control to update a global security policy while satisfying global security properties. The solution is more robust in terms of fault-tolerance and resists to denial of service attacks since the solutions carries out all the control locally. Two levels of intrusion detection are proposed to guaranty the integrity and the consistency of the distributed policy. The first level (meta-level, or administration level) guarantees that each local policy evolves according to the global security properties. This level detects attacks trying inadequate alterations of the local security policies. The second level corresponds to a classical intrusion detection system. But, it can take advantages of the local policy to detect attacks that violate the security objectives. That second level enables to integrate and to adjust various classical IDS. Our approach enforces the security of large scale systems.