1 / 14

Intrusion Tolerant Server Infrastructure

Intrusion Tolerant Server Infrastructure. Dick O’Brien DARPA PI Meeting July 18, 2000. Outline. Technical Objectives Technical Approach Metrics Expected Major Achievements Major Milestones Issues Transition Plans Policy. Technical Objective.

waneta
Télécharger la présentation

Intrusion Tolerant Server Infrastructure

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Intrusion Tolerant Server Infrastructure Dick O’Brien DARPA PI Meeting July 18, 2000

  2. Outline • Technical Objectives • Technical Approach • Metrics • Expected Major Achievements • Major Milestones • Issues • Transition Plans • Policy 7/18/2000

  3. Technical Objective • Use independent network layer enforcement mechanisms to: • Reduce intrusions • Prevent propagation of intrusions that do occur • Provide automated load shifting when intrusions are detected • Support automated server recovery 7/18/2000

  4. Technical Approach • Intrusion tolerant server components • Policy Enforcing Network Interface Cards (PENs) to provide network layer controls • Availability and Integrity Controller (AIC) to manage policy on the PENs and provide recovery and restoration functions 7/18/2000

  5. Web Server 1 Netscape Solaris OS SPARC hw Web Server 2 IIS Windows 2K Intel hw AIC Intelligence Control PEN PEN PEN ITSI Architecture Network Client Client 7/18/2000

  6. Policy Enforcing NICs • PENs are network interface cards that have been enhanced to provide additional controls • Packet Filtering • IPSEC support • Network layer audit • Dynamic response capability • Host independent • Centrally managed • PENs are being developed by SCC on other programs • DARPA funded: RDPF (IA) and ADF (AIA) • DOE funded: High Speed Firewall 7/18/2000

  7. AIC Functions • PEN management • Packet filtering policies, IPSEC policies, redirection • Intrusion detection system interface • Anomaly logging and reporting • Load shifting • Response, recovery and restoration 7/18/2000

  8. Operational Approach • Separate redundant servers into compartments • Detect intrusions into or faults within those compartments • Perform selective rerouting to ensure that benign users receive uninterrupted service • Identify corrupted data and restore it • Bring the server back on line and perform load balancing 7/18/2000

  9. Metrics • Effectiveness of the approach • Metric: success rate in stopping/recovering from intrusions as measured by red team experiments • Metric: performance overhead as measured by application response time • Cost/Benefit analysis 7/18/2000

  10. Expected Achievements • Technology that provides • strong network layering to protect against host compromises • compartmentalization of intrusions • dynamic prioritization of network traffic • semi-automated recovery techniques 7/18/2000

  11. Major Milestones • 6 months: CONOPS, Architecture, Trade study • 12 months: Prototype system • 16 months: Experiments and Evaluation 7/18/2000

  12. Issues • How much functionality/intelligence needs to be on the PEN? • How does the AIC determine what the best policy is to respond to an intrusion? • How does the AIC interface with ID/IR systems? • Can DoS attacks be stopped by the PEN? • Are COTS recovery products adequate? 7/18/2000

  13. Transition Plans • Make results available to other researchers thru • Conference papers • Collaboration • Code sharing • Make results available to the DoD thru • Commercialization 7/18/2000

  14. Policy • Policy appears in the ITSI in two ways: • PENs are policy enforcers • Packet filtering, packet redirection, load balancing, IPSEC, audit • The AIC defines and distributes policy dynamically 7/18/2000

More Related