1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
.. This work is licensed under a Creative Commons Attribution 4.0 International License.
.. http://creativecommons.org/licenses/by/4.0
.. (c) ruan.he@orange.com & thomas.duval@orange.com
****************************
OPNFV MOON platform overview
****************************
.. toctree::
:numbered:
:maxdepth: 2
Moon: Toward a Policy-based User-centric Security Management System for Cloud Infrastructure
Introduction
------------
Cloud infrastructure is able to provision a set of different cloud resources/services for
cloud service consumers. Trust over the provided cloud resources/services becomes a new challenge.
In order to avoid losing control over IT assets that consumers put in the cloud, we design and develop
Moon, a policy-based user-centric security management system for cloud infrastructure.
Administrator can define policies in Moon, which will be enforced through different mechanisms
in the cloud infrastructure.
### Why security management system?
A security management system is a combine system that integrates mechanisms of different security aspects.
It first has a security policy that specifies users’ security requirements.
It enforces the security policy through various mechanisms like authorization for access control,
firewall for networking, isolation for storage, logging for traceability, etc.
###Why policy-based approach?
Cloud computing embeds a various set of heterogeneous resources into resource pools.
Such a mechanism makes a management system hard through one standard interface.
Alternatively, the policy-based approach bypasses the heterogeneity, the management is achieved
through a standard policy instead of a standard interface.
Each module of a cloud infrastructure only needs to accept the policy.
###Why user-centric?
The flexibility of resource pool for cloud computing makes users custom cloud resources/services
for their own purpose. However, the current management system is not able to support this flexibility.
A user-centric management system enables users to define, configure and manipulate on the management layer,
in order to adapt to their usage and requirements.
Drawbacks of OpenStack
----------------------
The first version of Moon is implemented in OpenStack. However, we also plan to make Moon
protect other cloud infrastructure like VMware vCloud Director, etc in the future.
Considering the current state of OpenStack (release Juno), several drawbacks related
to the security management are identified:
###No centralized control
The OpenStack platform is divided into different services, like Nova for computing, Swift for storage,
Neutron for networking, etc. Each service uses a configuration file with the corresponding security policy.
But it lacks a synchronization mechanism between there configuration file. This may bring conflict.
###No dynamic control
Currently, each service of OpenStack is managed by a “Policy.JSON” file, all the modification
should be done manually and reboot is necessary after the modification. On the other side,
the authentication and authorization are achieved through the token mechanism, but there isn’t any
token revocation mechanism. Once a user gets an authorization token, we will not have any control
over the user. It lacks dynamic control at runtime in OpenStack.
###No customization and flexibility
Each user of OpenStack consumes their resource pool in their own manner, but it lacks customization
for the management system. In OpenStack, user cannot configure their resources and define their own
policy for each resource pool (called project in OpenStack). Users may also be a software application,
it also lacks an automated policy enforcement mechanism in OpenStack.
###No fine-granularity
Finally, the granularity of authorization in OpenStack is not enough fine. Currently, it’s at the API-level.
This means that we can authorize or deny a user from using an API like launch any VM. But we need the
granularity to be pushed to the resource-level, authorize or deny a user from using a specific
resource through the API, e.g. allowing a user to launch a dedicated VM.
Moon Description
----------------
For all the listed reason, we decided to build a security management system to monitor,
control and project the OpenStack infrastructure.
###Functional architecture
Moon can be considered as a management layer over OpenStack.
We can dynamically create security modules in Moon and assign these modules to protect different
tenants in OpenStack.
###Policy engine
The core part of the security management layer is its policy engine.
The policy engine should be at same time generic to support a large set of security models
used by consumers and robust so that all the manipulations on the policy engine need to be proved correct.
For all these purposes, we designed EMTAC (Extensible Multi-tenancy Access Control) meta-model,
which defines policy specification, policy administration, inter-policy collaboration and administration
over this collaboration.
###User-centric
At the same time, Moon enables administrators or a third-party application to define, configure and manage
its policies. Such a user-centric aspect helps users to define their own manner in using
OpenStack’s resources.
###Authorization enforcement in OpenStack
As the first step, the security policy in Moon is enforced by authorization mechanism in Keystone and Nova
and Swift.
All the operations in Keystone and Nova and Swift are controlled and validated by Moon.
In OpenStack, we implemented 3 hooks respectively for Keystone and Nova and Swift, the hooks will
redirect all authorization requests to Moon and return decision from Moon.
###Log System
Traceability and accountability are also handled in Moon, all the operations and interactions
are logged and can be consulted for any purpose.
###Separation of management layer from OpenStack
The separation of management layer from OpenStack makes the management system totally
independent from OpenStack. We can install Moon in client’s local so that Moon can be
locally administrated by clients and remotely project their data which are hosted in
Cloud Service Provider’s datacenter.
Roadmap
-------
Even if Moon can now work with OpenStack as a security management system,
several blueprints are planned for its improvement.
###Technical improvements
* Update Moon’s policy engine with Prolog/Datalog: in the last version of Moon, we use a hard-coded Python policy engine. We will collaborate with VMware and their “Congress” policy engine.
* Networking enforcement: other important improvement is to enable network management by Moon. Based on the defined policy, Moon will configure Neutron, FWaaS, etc, in OpenStack.
* Storage enforcement: storage protect is another important aspect, access to storage blocks or files will be control by Moon.
* IDS/IPS and self-protection: as Moon’s security module will protect each tenant,
###Contribution to OpenStack
We have worked in the OpenStack community since 1 year and half, our next step is to integrate
with the community and contribute Moon to OpenStack/Keystone.
Once Moon is integrated in OpenStack, the community, together with its developers will
maintain Moon’s evolution.
###Contribution to European project “SuperCloud”
The H2020 European project “SuperCloud” will start this year, its objective is to provide
360 degree protection on cloud infrastructure. Moon and its policy meta-model will be contributed
as core security management system in this project.
###Contribution to OPNFV
OPNFV ([OPNFV]) wants to build a reference cloud-based architecture for NFV
(Network Function Virtualization) based on OpenStack.
Orange will propose a “security management” project in OPNFV.
Moon is supposed to be the base module to develop and manage dedicated security mechanisms for vNF
(virtualized Network Functions).
See: [OPNFV-MOON]
[OPNFV]:http://www.opnfv.org
[OPNFV-MOON]:https://wiki.opnfv.org/moon
Revision: _sha1_
Build date: |today|
|
