AVOID: A cloud platform-as-a-service for secure services deployment avoiding intrusions

Motivation

To intrude into a computer system hackers often exploit software vulnerabilities. It is confirmed that the most critical security threats to the information systems are caused by vulnerabilities of an operating system (OS) and system software (like web-servers, application and remote access servers, firewalls, etc.) rather than by vulnerabilities of application software.

Information about vulnerabilities of operating systems, system and application software can be retrieved from public vulnerability and exploit databases (NVD, CVE, OSVDB, EDB, etc). Besides, software vendors distribute information about security patches fixing particular vulnerabilities.

However, existing databases and security scanners do not notify users about forever-day vulnerabilities (i.e. newly disclosed vulnerabilities for which patches have not available yet) in particular SW products.

Project concept and architecture

The purpose of the project is to develop a framework for secure Internet browsing and secure deployment of cross-platform (e.g. Java, Python, Ruby) web-applications.

We propose to reduce risks of intrusions via a dynamic reconfiguration of the system software stack (OS, system and application software) so, that the most critical system software components will be replaced by alternative ones having fever number of critical forever-day vulnerabilities.

Unlike existing intrusion-tolerance solutions we will be able to reduce security threats and decrease risk of a system to be attacked by avoiding possible intrusions (instead of trying to tolerate them) exploiting forever-day vulnerabilities in OS, system and application software.

The project includes:

1. Forever-day vulnerability monitor/scanner providing run-time notification about newly disclosed vulnerabilities in system software;
2. Secure internet browser reducing a risk of a system to be attacked via utilizing its vulnerabilities by making use of diversity of existing internet browsers;
3. Cloud-platform "Secure PaaS" acting as a mediator between client and existing IaaS Cloud services (e.g. Amazon EC2).

Vulnerability monitor will detect system threats and performs proactive vulnerability alerting by making use of run-time monitoring of different vulnerability and exploit databases and vendor’s security bulletins together to identify forever-day vulnerabilities of operating systems and system software and their criticality.

Secure internet browser will provide a unified frontend to access the Web by dynamical switching between alternative web browsers (e.g. Chrome, Firefox, Opera, IE, etc.) running at the background. At a time the only one of those diverse web browsers having the fever number of forever-day vulnerabilities will be operating.

Cloud-platform "Secure PaaS" provides a trusted environment for secure deployment of application software and services allowing to avoid possible intrusions exploiting forever-day vulnerabilities via dynamic reconfiguration of a system software stack.

Target audience

1. Ordinary Internet users.
2. System administrators and security engineers.
3. Customers looking for secure Cloud-environment for deploying own services and Internet-applications.

The project also supports:

• developing third-parties security scanners interoperating with the Forever-day vulnerability monitor via the set of provided API;
• developing secure PaaS Cloud platform for private data-centres or on the top of existing IaaS Clouds.

Sources of revenue

1. Paid subscription to a service for on-line notification about newly disclosed forever-day vulnerabilities in system software.
2. Provisioning of a paid ‘Secure PaaS’ service on the top of existing IaaS Cloud-platforms (e.g. Amazon EC2, MS Azure, GoGrid, etc).

tage: Prototyping

1. Tarasyuk, O. From Analyzing Operating System Vulnerabilities to Designing Multiversion Intrusion-Tolerant Architectures / O. Tarasyuk, A. Gorbenko, A. Romanovsky, O. Biloborodov // IEEE Transactions on Reliability. – Vol. 69, Issue 1. – 2020. – P. 22-39.
2. Gorbenko A., Kharchenko V., Tarasyuk O., Romanovsky A. (2011) Using Diversity in Cloud-Based Deployment Environment to Avoid Intrusions. In: Troubitsyna E.A. (eds) Software Engineering for Resilient Systems. SERENE 2011. LNCS, vol 6968. Springer, Berlin, Heidelberg.