Critical Software Security Through Replication and Virtualization A Research Proposal Dennis Edwards Sharon Simmons Arangamanikkannan Manickam

Original Work  Multi-Level Security Model Architecture  Secure national power distribution grid  Designed for “System after next”, “Beyond SCADA”  Supported by  Department of Energy  FSU – Center for Advanced Power Systems Research July 9, 20092NCA09 - BIOCOMS

Background  Combine ideas into new architecture  Software mutation – agent diversity  Computation replication – fault tolerance  Software voting – fault detection  Focus on strengthening security triad  Prevention : anticipate and thwart attacks  Detection : recognize penetrations  Correction : recover while limiting consequences  Evolve security to prevent / deter recurrence July 9, 20093NCA09 - BIOCOMS

Security Model Fall 2009 ShowcaseUWF - Simmons4 SCADA Sensors & Actuators Communication Agent Distribution/ Voting Agent Replicated Computational Agent Replicated Computational Agent Replicated Computational Agent Monitor/ Resurrection Agent Mutation Agent Source network serial Hardware Protected Normal I/O Control Signals Computational Agent

Previous Results  Computational agents  Mutated and replicated  Different random mutation for each  Prevents multiple Byzantine failures  Faults result in crash failures  Distribution/Voting agent  Replicate input to computation agents  Combines output into majority decision  Identifies faulty/failed computational agents Fall 2009 ShowcaseUWF - Simmons5

Previous Results  Communication agent  Implements encryption, validation  Only entrance into system  Monitor/resurrection agent  Monitors health of other agents  Rebuilds faulty/failed agents  Implemented in hardware Fall 2009 ShowcaseUWF - Simmons6

Model Limitations  Specialized prevention  Buffer overflow attacks  Software failures  Designed for agent-based systems  Dynamic port binding not supported  Server processes not supported  Operating system remains vulnerable  Required hardware protection  M/R agent is single-point-of-failure Fall 2009 ShowcaseUWF - Simmons7

Proposed System  Multi-layered security model  Build from previous success  Provides for replication and voting  Replicated processes  Computationally equivalent  Executed on different virtual platforms  Platform targeted attack ineffective  Implementation targeted attack ineffective  Platform weaknesses mitigated  Failures isolated and identified  Failed system recovered Fall 2009 ShowcaseUWF - Simmons8

Proposed System  Guest OS  Assigned private IP address  Monitors health of server processes  Server processes  Perform duties as if in isolation  Results used as votes  Host OS  Assigned public IP address  Uses NAT to map public  private Ips  Monitors health of guest OSes  Limites consequences of attack to Guest OS Fall 2009 ShowcaseUWF - Simmons9

Proposed Model Fall 2009 ShowcaseUWF - Simmons10 Communication Interface network Server Guest OS 1 Virtual Machine Host OS NAT Server Guest OS 3 Server Guest OS 2

Prototype  Host OS  Macintosh OS X  Virtual Machine  Sun’s Virtual Box  Guest OSes  Windows XP  Linux Fedora 10  Solaris  Server  Apache web server (httpd)  Each server on port 80 of private IP Fall 2009 ShowcaseUWF - Simmons11

Prototype  External communication  Via communication interface  Port 80 on well-known IP  Specialized NAT replicated input (NAT now client)  Responses from Apache  Sent to NAT (client)  NAT tallies votes and returns decision to real client  Prototype status  In experimentation/design phase  Communication with dual servers  Voting not yet implemented Fall 2009 ShowcaseUWF - Simmons12

Demonstration Prototype Fall 2009 ShowcaseUWF - Simmons13 Communication Interface (Distribution & Voting) network Apache Windows XP VirtualBox OS X NAT Apache Solaris Apache Linux F10

Summary Previous success with power distribution grid Known limitations of system Proposed system will – Take advantage of multiple execution cores – Use virtualization for system replication – Provide distinct execution bases for each replicate – Use voting to identify faulty components – Recover from faults with no externally visible effects – Contain consequences to virtual host Fall 2009 ShowcaseUWF - Simmons14

Contact Information Dennis Edwards Sharon Simmons Fall 2009 ShowcaseUWF - Simmons15