Effiziente Client-basierte Handover-Verfahren zur Steigerung der Verfügbarkeit von Cloud-Diensten

Transkript

1 ITG Fachgruppentreffen an der FH Flensburg Effiziente Client-basierte Handover-Verfahren zur Steigerung Fakultät Elektrotechnik und Informationstechnik Prof. Dr.-Ing. Christian Wietfeld

2 Agenda Motivation Sec2-Middleware Solution Security Engine Mobility Engine Conclusion Slide 2

3 Motivation Company B with Freelancer Company A Private Use Problem Statement: Users have absolutely no control about their data due to outsourcing of data to cloud storage Cloud storages only offer end-to-end security Insecure Channel Deployment of standard mobility solutions has high economics and technical cost UMTS LTE WLAN Insecure Channel IP based Network (Internet) Security and high availabibilty still an open issue in heterogeneous networks Cost-effective and feasible solution is needed Untrusted Cloud Storage Services Slide 3

4 Agenda Motivation Sec2-Middleware Solution Security Engine Mobility Engine Conclusion Slide 4

5 Sec2 System Architecture [1] Responsible for enand decryption of XML payload and key data Based on XML Encryption Slide 5

6 Sec2 System Architecture Stores a list of available keys Keys are stored in SmartCard Slide 6

7 Sec2 System Architecture Provides highly secure storage for confidential key data Accelerates cryptographic operations Slide 7

8 Sec2 System Architecture Stores all cluster keys and is able to provide them to authorized clients Slide 8

9 Sec2 System Architecture Supports seamless service communication Slide 9

10 Sec2 System Architecture Existing cloud storage providers Providers have no control about user s encrypted data No changes are needed Slide 10

11 Sec2 System Architecture Properties of Sec2: Sec2- is integrated transparently between application and mobility layer No trust relationship between users and cloud service provider required Mobility Support to increase availability of cloud storage Slide 11

12 Key Concept 1 Each participant owns private/public key-pair Used for authentication and secure key transport Public key is deposited at Key Server Private Key is stored in SmartCard at client side Slide 12

13 Key Concept 2 Cluster key protects cluster domains Authorizes users to decrypt documents in cluster Slide 13

14 Key Concept 3 To protect document, cluster key encrypt so called document keys Document keys encrypt content of XML document Slide 14

15 Key Concept 4 Every document has its own key In case of compromise of document, only particular XML document is concerned Slide 15

16 Sec2 System Architecture User Interface Connection Management Routing Manager Transport Management URL Listener Decision Manager Queue Manager Interface Monitor Manager Data Stream Manager HTTP / HTTPS TCP Routing Table UMTS Interface WiFi Interface LAN Interface CSH-MU: Client Based Secure Handoff Solution for Mobile Units Slide 16

17 System Architecture of CSH-MU (Mobility Engine) User Interface [2, 3] Monitor the RSSI and connection state of available interfaces Connection Management Routing Manager Transport Management URL Listener Decision Manager Queue Manager CSH-MU Interface Monitor Manager Data Stream Manager HTTP / HTTPS Application TCP Transport Routing Table Network UMTS Interface WiFi Interface LAN Interface Link TCP/IP Protocol Suite Slide 17

18 System Architecture of CSH-MU (Mobility Engine) User Interface [2, 3] Decides as to which interface provides best connection prospects Connection Management Routing Manager Decision Manager Transport Management URL Listener Queue Manager CSH-MU Interface Monitor Manager Data Stream Manager HTTP / HTTPS Application TCP Transport Routing Table Network UMTS Interface WiFi Interface LAN Interface Link TCP/IP Protocol Suite Slide 18

19 System Architecture of CSH-MU (Mobility Engine) User Interface [2, 3] Update routing table to prioritize recommended interface Connection Management Routing Manager Decision Manager Transport Management URL Listener Queue Manager CSH-MU Interface Monitor Manager Data Stream Manager HTTP / HTTPS Application TCP Transport Routing Table Network UMTS Interface WiFi Interface LAN Interface Link TCP/IP Protocol Suite Slide 19

20 System Architecture of CSH-MU (Mobility Engine) User Interface [2, 3] Received URLs are checked for validity Connection Management Routing Manager Transport Management URL Listener Decision Manager Queue Manager CSH-MU Interface Monitor Manager Data Stream Manager HTTP / HTTPS TCP Routing Table Application Transport Network UMTS Interface WiFi Interface LAN Interface Link TCP/IP Protocol Suite Slide 20

21 System Architecture of CSH-MU (Mobility Engine) User Interface [2, 3] URLs are put in a queue and are processed by First-In- First-Out (FIFO) principle. Connection Management Routing Manager Decision Manager Transport Management URL Listener Queue Manager CSH-MU Interface Monitor Manager Data Stream Manager HTTP / HTTPS Application TCP Transport Routing Table Network UMTS Interface WiFi Interface LAN Interface Link TCP/IP Protocol Suite Slide 21

22 System Architecture of CSH-MU (Mobility Engine) User Interface [2, 3] Start, stop and resume data transfers Connection Management Routing Manager Transport Management URL Listener Decision Manager Queue Manager CSH-MU Interface Monitor Manager Data Stream Manager CSH-MU runs in Application Mobility is only managed locally by mobile client Security is based on mutual authentication using SSL/TLS HTTP / HTTPS TCP Routing Table Application Transport Network UMTS Interface WiFi Interface LAN Interface Link TCP/IP Protocol Suite Slide 22

23 Communication Procedure of CSH-MU Process Example: User Interface 1. User enters URL 2. Queue Manager forwards URL Connection Management Routing Manager Transport Management URL Listener 3. Data Stream Manager creates connection to server and starts data transfer 4. Interface-Monitor Manager recognizes status change of interface 5. Decision Manager pauses the data transfer and selects the best available interface 6. Routing Manager modifies routing table entries 7. Connection to server via new connection, transfer resumed Decision Manager Queue Manager Interface Monitor Manager Data Stream Manager HTTP / HTTPS TCP Routing Table UMTS Interface WiFi Interface LAN Interface CSH-MU Application Transport Network Link TCP/IP Protocol Suite Slide 23

24 Communication Procedure of CSH-MU Process Example: User Interface 1. User enters URL 2. Queue Manager forwards URL Connection Management Routing Manager Transport Management URL Listener 3. Data Stream Manager creates connection to server and starts data transfer 4. Interface-Monitor Manager recognizes status change of interface 5. Decision Manager pauses the data transfer and selects the best available interface 6. Routing Manager modifies routing table entries 7. Connection to server via new connection, transfer resumed Decision Manager Queue Manager Interface Monitor Manager Data Stream Manager HTTP / HTTPS TCP Routing Table UMTS Interface WiFi Interface LAN Interface CSH-MU Application Transport Network Link TCP/IP Protocol Suite Slide 24

25 Heterogeneous Network Testbed for Performance Evaluation What is measured? Handoff delay T HO: T HO T IMM T T DeM RM THPS Detect status change of IF Handover Decision Change Routing Data Transfer Slide 25

26 Comparison to Standard Solutions T HO Handoff Delay is compared with other standard mobility protocols Measured handoff delays with MIPv6/NEMO and msctp are based on real testbed Results without security mechanisms: CSH-MU solution is not only better, but is less expensive than MIPv6/NEMO or msctp, as it does not rely on any changes on part of the network Due to its implementation design, CSH-MU can be readily deployed NEMO:= Network Mobility (NEMO) Protocol msctp:= mobile Stream Control Transmission Protocol Slide 26

27 Agenda Motivation Sec2-Middleware Solution Security Engine Mobility Engine Conclusion Slide 27

28 Conclusion Problem Statement: Security and high availabibilty still an open issue in heterogeneous networks Sec2 Solution: Security Engine: User has full control about their data No trusted relationship between user and cloud service provider Mobiliy Engine No changes on part of underlying network infrastructure Complete handover logic on mobile client side Results: CSH-MU performs better compared to standard mobility solutions (i.e. MIPv6/NEMO, msctp) Due to its implementation design, Sec2 and its engines can be readily deployed Slide 28

29 Thank you for your attention! der Verfügbarkeit von Cloud-Diensten Questions? Slide 29

30 References [1] Christopher, M.,Somorovsky, J., Driessen, B., Schwenk, J., Tran, T., Wietfeld, C.: Sec2: Ein mobiles Nutzer-kontrolliertes Sicherheitskonzept für Cloud-Storage, Proceeding of D-A-CH Security 2011, Oldenburg, September [2] Tran, T., Yousaf, F. Z., Wietfeld, C.: CSH-MU: Client Based Secure Handoff Solution for Mobile Units, 21st IEEE International Symposium on Personal, Indoor and Mobile Radio Communication (PIMRC), IEEE, pp , Istanbul, Turkey, September [3] Tran, T., Yousaf, F. Z., Wietfeld, C., Performance Evaluation of enhanced CSH-MU Solution in a Heterogeneous Network Environment, IEEE Symposium on Computers and Communications (ISCC), IEEE, Kerkyra (Corfu), Greece, June Slide 30