1. Critical Software Security Through Replication and Virtualization A Research Proposal Dennis Edwards Sharon Simmons Arangamanikkannan Manickam

2. Original Work  Multi-Level Security Model Architecture  Secure national power distribution grid  Designed for “System after next”, “Beyond SCADA”  Supported by  Department of Energy  FSU – Center for Advanced Power Systems Research July 9, 20092NCA09 - BIOCOMS

3. Background  Combine ideas into new architecture  Software mutation – agent diversity  Computation replication – fault tolerance  Software voting – fault detection  Focus on strengthening security triad  Prevention : anticipate and thwart attacks  Detection : recognize penetrations  Correction : recover while limiting consequences  Evolve security to prevent / deter recurrence July 9, 20093NCA09 - BIOCOMS

4. Security Model Fall 2009 ShowcaseUWF - Simmons4 SCADA Sensors & Actuators Communication Agent Distribution/ Voting Agent Replicated Computational Agent Replicated Computational Agent Replicated Computational Agent Monitor/ Resurrection Agent Mutation Agent Source network serial Hardware Protected Normal I/O Control Signals Computational Agent

5. Previous Results  Computational agents  Mutated and replicated  Different random mutation for each  Prevents multiple Byzantine failures  Faults result in crash failures  Distribution/Voting agent  Replicate input to computation agents  Combines output into majority decision  Identifies faulty/failed computational agents Fall 2009 ShowcaseUWF - Simmons5

6. Previous Results  Communication agent  Implements encryption, validation  Only entrance into system  Monitor/resurrection agent  Monitors health of other agents  Rebuilds faulty/failed agents  Implemented in hardware Fall 2009 ShowcaseUWF - Simmons6

7. Model Limitations  Specialized prevention  Buffer overflow attacks  Software failures  Designed for agent-based systems  Dynamic port binding not supported  Server processes not supported  Operating system remains vulnerable  Required hardware protection  M/R agent is single-point-of-failure Fall 2009 ShowcaseUWF - Simmons7

8. Proposed System  Multi-layered security model  Build from previous success  Provides for replication and voting  Replicated processes  Computationally equivalent  Executed on different virtual platforms  Platform targeted attack ineffective  Implementation targeted attack ineffective  Platform weaknesses mitigated  Failures isolated and identified  Failed system recovered Fall 2009 ShowcaseUWF - Simmons8

9. Proposed System  Guest OS  Assigned private IP address  Monitors health of server processes  Server processes  Perform duties as if in isolation  Results used as votes  Host OS  Assigned public IP address  Uses NAT to map public  private Ips  Monitors health of guest OSes  Limites consequences of attack to Guest OS Fall 2009 ShowcaseUWF - Simmons9

10. Proposed Model Fall 2009 ShowcaseUWF - Simmons10 Communication Interface network Server Guest OS 1 Virtual Machine Host OS NAT Server Guest OS 3 Server Guest OS 2

11. Prototype  Host OS  Macintosh OS X  Virtual Machine  Sun’s Virtual Box  Guest OSes  Windows XP  Linux Fedora 10  Solaris  Server  Apache web server (httpd)  Each server on port 80 of private IP Fall 2009 ShowcaseUWF - Simmons11

12. Prototype  External communication  Via communication interface  Port 80 on well-known IP  Specialized NAT replicated input (NAT now client)  Responses from Apache  Sent to NAT (client)  NAT tallies votes and returns decision to real client  Prototype status  In experimentation/design phase  Communication with dual servers  Voting not yet implemented Fall 2009 ShowcaseUWF - Simmons12

13. Demonstration Prototype Fall 2009 ShowcaseUWF - Simmons13 Communication Interface (Distribution & Voting) network Apache Windows XP VirtualBox OS X NAT Apache Solaris Apache Linux F10

14. Summary Previous success with power distribution grid Known limitations of system Proposed system will – Take advantage of multiple execution cores – Use virtualization for system replication – Provide distinct execution bases for each replicate – Use voting to identify faulty components – Recover from faults with no externally visible effects – Contain consequences to virtual host Fall 2009 ShowcaseUWF - Simmons14

15. Contact Information Dennis Edwards dedwards@uwf.edu Sharon Simmons ssimmons2@uwf.edu Fall 2009 ShowcaseUWF - Simmons15