SysML-Sec Attack Graphs: Compact Representations for Complex Attacks Institut Ludovic Apvrille Mines-Telecom ludovic.apvrille@telecom-paristech.fr Yves Roudier yves.roudier@eurecom.fr GraMSec’2015
Context: Security for Embedded Systems Attack trees Contribution Conclusion Outline Context: Security for Embedded Systems Embedded systems SysML-Sec Attack trees Contribution Conclusion 2/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Examples of Threats Transport systems Use of exploits in Flight Management System (FMS) to control ADS-B/ACARS [Teso 2013] Internet of Things (C) aviationweek.com Proof of concept of attack on IZON camera [Stanislav 2013] Medical appliances Infusion pump vulnerability, April 2015. http://www.scip.ch/en/?vuldb.75158 (C) Hospira 3/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Designing Safe and Secure Embedded Systems: SysML-Sec Main idea ◮ Holistic approach : bring together experts in embedded system architects, system designers and security experts Common issues (addressed by SysML-Sec): ◮ Adverse effects of security over safety/real-time/performance properties ◮ Commonly: only the design of security mechanisms ◮ Hardware/Software partitioning ◮ Commonly: no support for this in tools/approaches in MDE and security approaches 4/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion SysML-Sec: Methodology Functional view Architectural view Functional view Architectural view Simulation Formal analysis Requirements Mapping view Requirements Mapping view Simulation Formal analysis SW/HW Partitioning Attacks Attacks Simulation Formal analysis Simulation Structural view Behavioral view Structural view Behavioral view Formal analysis Deployment view Test Deployment view System Design System Design Fully supported by TTool 5/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Outline Context: Security for Embedded Systems Attack trees Attack trees Contribution Conclusion 6/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Google-izing Attack Trees 7/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Attack Trees Definition and purpose ◮ Originate from fault trees, introduced by Bruce Schneier (1999) ◮ Depict how a system element can be attacked ◮ Helps finding attack countermeasures ◮ Root attack, children, leaves ◮ OR and AND relations between children 8/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Attack Trees: Related Work ◮ Generation of ATs from other formalisms [Vigo 2014] ◮ Semantics extensions ◮ [Khand 2009] ◮ PAND , k-out-of-n , CSUB , SEQ , . . . ◮ [Zhao 2014] ◮ Permissions and capabilities on nodes ◮ Applied to malware analysis ◮ Security assessment ◮ Privilege graphs [Dacier 1996] ◮ Petri nets [Dalton 2006] [Pudar 2009] ◮ Markov processes [Pi` etre-Cambac´ ed` es 2010] 9/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Attack Trees: A Few Issues Semantics Relation with other development stages ◮ Semantics of AND and OR is limited to express complex ◮ No relation with (security) attack scenarios requirements ◮ No ordering between ◮ More generally, not attacks integrated into ◮ No temporal operators methodologies ◮ No relation between attacks and the HW/SW components of the system ◮ Difficult to figure out the where and which of countermeasures 10/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Outline Context: Security for Embedded Systems Attack trees Contribution New operators Conclusion 11/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Overview (with an Example) <<block>> AttackerSystem <<block>> AttackerPC <<root attack>> IllegalBankAccountTransactionBasedOnT oken ◮ SysML Parametric <<SEQUENCE>> 1 2 <<block>> AttackerWebServer diagram <<attack>> <<attack>> LogOnBankAccount PerformT okenBasedAuthentication <<attack>> GenerateFakeBankWebsite ◮ Asset = Block <<attack>> <<BEFORE>> 2 SendTANT oServer 120 1 ◮ Attacks = <<block>> <<attack>> AttackedSystem <<block>> RetrieveUserLoginAndPassword UserMobilePhone_Android <<AND>> Attributes of blocks <<attack>> <<block>> RetrieveTransactionTAN UserPC ◮ Relation between <<attack>> <<attack>> InstallKeyLogger ControlFakeHTTPBankURL <<SEQUENCE>> 1 2 attacks = <<block>> Browser <<attack>> <<block>> SilentlyInterceptSMS Windows_Win32 <<attack>> Constraints InstallMaliciousPlugin <<attack>> <<attack>> InstallTrojan UserInstallsFakeBankApplication <<attack>> ◮ Formal semantics RedirectHTTPRequestFromBankT oFakeBank <<attack>> 1 ExploitVulnerability <<attack>> <<SEQUENCE>> 2 RequestUserT oInstallMobileFakeBankApplication ◮ Timed automata <<XOR>> <<attack>> ExploitVunerability <<block>> <<attack>> OtherSoftwareApplications ExploitVulnerability 12/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Semantics ◮ Attacks ◮ Intermediate attacks ◮ Root attack ◮ Constraints ◮ AND, OR, XOR, SEQUENCE, BEFORE, AFTER 13/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Semantics of Attacks Attack Intermediate Attack 14/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Semantics of Constraints AND SEQUENCE 15/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Semantics of Constraints (Cont.) OR XOR 16/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Semantics of Constraints (Cont.) BEFORE AFTER 17/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Formal Verification ◮ Reachability of an attack a ◮ Liveness of an attack a ◮ a 1 Leads to a 2 ( a 1 � a 2 ) 18/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Disabling Attacks ◮ Right click to disable/enable an attack <<block>> UserMobilePhone_Android <<attack>> RetrieveTransactionTAN <<SEQUENCE>> 1 2 <<attack>> SilentlyInterceptSMS disabled <<attack>> UserInstallsFakeBankApplication 19/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Temporal Compatibility ◮ Temporal constraints may impact attacks reachability/liveness <<attack>> final <<BEFORE>> 10 1 2 <<AFTER>> <<attack>> 15 attack01 1 2 <<attack>> <<attack>> attack03 attack02 20/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Outline Context: Security for Embedded Systems Attack trees Contribution Conclusion Conclusion, future work and references 21/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion Conclusion and Future Work Achievements ◮ Extended and formally defined attack trees ◮ Integrated into SysML-Sec ◮ Fully supported by TTool ◮ Applied to different domains, e.g., malware, automotive systems Future work ◮ Handling new situations ◮ Cycles, nb of iterations, priorities ◮ Quantitative assessments of threats 22/23 July, 2015 Institut Mines-Telecom
Context: Security for Embedded Systems Attack trees Contribution Conclusion To Go Further ... Web sites ◮ https://sysml-sec.telecom-paristech.fr ◮ https://ttool.telecom-paristech.fr References (SysML-Sec) ◮ Ludovic Apvrille, Yves Roudier, ”SysML-Sec: A SysML Environment for the Design and Development of Secure Embedded Systems”, Proceedings of the INCOSE/APCOSEC 2013 Conference on system engineering, Yokohama, Japan, September 8-11, 2013. 23/23 July, 2015 Institut Mines-Telecom
Recommend
More recommend
