• No results found

Appendix A. X-Bone Surety Assessment Report. Developer Architectures and Application Screenshots ISI X-Bone Software Architecture Diagram.

N/A
N/A
Info
Download
Protected

Academic year: 2021

Share "Appendix A. X-Bone Surety Assessment Report. Developer Architectures and Application Screenshots ISI X-Bone Software Architecture Diagram."

Copied!
10
0
0

Loading.... (view fulltext now)

Download now ( 10 Page )

Full text

(1)

Appendix A

Developer Architectures and Application Screenshots

ISI X-Bone Software Architecture Diagram

(2)

ISI X-Bone Communications Architecture

Figure 7

ISI X-Bone GUI Control Page

(3)

ISI X-Bone GUI Resource Discovery Page

(4)

ISI X-Bone GUI Overlay Creation Page

(5)

ISI X-Bone GUI Overlay Status Page

(6)

IDART

™

X-Bone Component Communications Sequence

Note: The optional DNS components are not shown in this sequence.

X-Bone Component Communication Diagram

Web Server

Browser

Client

OM

API

Overlay

Manager

Resource

Daemon

Web Server / Overlay Manager Server /

Overlay DNS Server

Resource 1

Resource

Daemon

Resource 3

Resource

Daemon

Resource 4

1.

Browser builds and submits

overlay configuration

request

Host-based firewall

X-Bone

CGI

User

Interface

Resource

Daemon

Resource 2

1.

Browser builds and submits

overlay configuration

request

2.

CGI submits requested

configuration description to

OM. OM-API parses and

verifies request.

3.

OM multi-casts invitations

on base network.

4.

RDs that can participate

send UDP replies.

5.

OM sends configuration

information to RDs

6.

RDs send configuration

result status to OM

7.

OM sends overlay result

status to CGI for display to

client

TCP

TCP-SSL

UDP-S/MIME

Figure 12

(7)

X -Bone Com ponent Com m unication D iagram

W eb Server

Brow ser

C lient

O M

A PI

Overlay

M anager

Resource

Daem on

W eb Server / O verlay M anager Server /

O verlay D NS Server

R esource 1

R esource

D aem on

Resource 3

Resource

D aem on

R esource 4

H ost-based firewall

X -Bone

CG I

User

Interface

R esource

Daem on

Resource 2

T CP T CP-SSL U D P-S/M IM E

1. Browser builds and submits overlay configuration request 2. CG I submits requested configuration description to O M . O M -A PI parses and verifies request. 3. O M multi-casts invitations on base network. 4. RD s that can participate

send U D P replies. 5. O M sends configuration

information to RD s 6. RD s send configuration

result status to O M 7. O M sends overlay result

status to CG I for display to client

Figure 13

X -Bone Com ponent Com m unication D iagram

W eb Server

Brow ser

C lient

O M

A PI

Overlay

M anager

Resource

Daem on

W eb Server / O verlay M anager Server /

O verlay D NS Server

R esource 1

R esource

D aem on

Resource 3

Resource

D aem on

R esource 4

H ost-based firewall

X -Bone

CG I

User

Interface

R esource

Daem on

Resource 2

T CP T CP-SSL U D P-S/M IM E

1. Browser builds and submits overlay configuration request 2. CG I submits requested configuration description to O M . O M -A PI parses and verifies request. 3. O M multi-casts invitations on base network.

4. RD s that can participate send U D P replies. 5. O M sends configuration

information to RD s 6. RD s send configuration

result status to O M 7. O M sends overlay result

status to CG I for display to client

(8)

X -B one C om ponent C om m unication D iagram

W eb Server

B row ser

C lient

O M

A PI

O verlay

M anager

R esource

D aem on

W eb Server / O verlay M anager Server /

O verlay D N S Server

R esource 1

R esource

D aem on

R esource 3

R esource

D aem on

R esource 4

H ost-based firew all

X -B one

C G I

U ser

Interface

R esource

D aem on

R esource 2

T CP T CP -SSL U D P -S/M IM E

1. B row ser builds and subm its overlay configuration request

2. C G I sub m its requested configuration description to O M . O M -A P I parses and verifies request. 3. O M m ulti-casts in vitations

on base netw ork.

4. R D s that can participate send U D P replies.

5. O M sends configuration inform ation to R D s 6. R D s send configuration

result status to O M 7. O M sends overla y result

status to C G I for display to client

Figure 15

X -Bone Com ponent Com m unication D iagram

W eb Server

Brow ser

C lient

O M

A PI

Overlay

M anager

Resource

Daem on

W eb Server / O verlay M anager Server /

O verlay D NS Server

R esource 1

R esource

D aem on

Resource 3

Resource

D aem on

R esource 4

H ost-based firewall

X -Bone

CG I

User

Interface

R esource

Daem on

Resource 2

1. Browser builds and submits overlay configuration request 2. CG I submits requested configuration description to O M . O M -A PI parses and verifies request. 3. O M multi-casts invitations on base network. 4. RD s that can participate

send U D P replies.

5. O M sends configuration information to RD s

6. RD s send configuration result status to O M 7. O M sends overlay result

status to CG I for display to client T CP T CP-SSL U D P-S/M IM E

Figure 16

(9)

X -Bone Com ponent Com m unication D iagram

W eb Server

Brow ser

C lient

O M

A PI

Overlay

M anager

Resource

Daem on

W eb Server / O verlay M anager Server /

O verlay D NS Server

R esource 1

R esource

D aem on

Resource 3

Resource

D aem on

R esource 4

H ost-based firewall

X -Bone

CG I

User

Interface

R esource

Daem on

Resource 2

1. Browser builds and submits overlay configuration request 2. CG I submits requested configuration description to O M . O M -A PI parses and verifies request. 3. O M multi-casts invitations on base network. 4. RD s that can participate

send U D P replies. 5. O M sends configuration

information to RD s

6. RD s send configuration result status to O M

7. O M sends overlay result status to CG I for display to client T CP T CP-SSL U D P-S/M IM E

Figure 17

X -Bone Com ponent Com m unication D iagram

W eb Server

Brow ser

C lient

O M

A PI

Overlay

M anager

Resource

Daem on

W eb Server / O verlay M anager Server /

O verlay D NS Server

R esource 1

R esource

D aem on

Resource 3

Resource

D aem on

R esource 4

H ost-based firewall

X -Bone

CG I

User

Interface

R esource

Daem on

Resource 2

1. Browser builds and submits overlay configuration request 2. CG I submits requested configuration description to O M . O M -A PI parses and verifies request. 3. O M multi-casts invitations on base network. 4. RD s that can participate

send U D P replies. 5. O M sends configuration

information to RD s 6. RD s send configuration

result status to O M

7. O M sends overlay result status to CG I for display to client T CP T CP-SSL U D P-S/M IM E

Figure 18

(10)

Appendix C

IDART

™

X-Bone Brainstorm Attack Graph

X-Bone

Attack Graph

Non-RD Host (Remote)

Intermediate Non-RD Host e.g. ISP Router

Send packets from one overlay address to another. Use multi-OL host to crossover Route tunnel packets out "real"

interface

Fail all configs.

Exfiltrate/Add data btw. decryption/ encryption Drop RD configuration results Become network device MITM Create many overlays (uses resources) Pump LOTS of data through overlay Request LOTS of resources for overlays Attack Web Server

through CGI (open connection) through firewall

Use WWW Server to talk to OM API

User tries to create the overlay again (same name)

RD gets invitation with same name as existing overlay

RD will now refuse to set up this overlay suspecting

replay attack Drop UDP

heartbeats Steal valid user

cert. DNS Zone transfer (through tunnel) Snoop/Disrupt/etc. traffic on real Internet Replace virtual IPs

w/ real IPs or cross over OL IPs Modify DNS records Own DNS Server Attack DNS Server (unfirewalled) over tunnel If an overlay setup fails some RDs have the overlay name set up Pipe Info out to

home (spy central) Spoof IP packets

on virtual network

Accept all invites Spoof RIP Messages (DYNAMIC ROUTING REQUIRED) Use OM SSL key to ...???????????? Crack OM SSL key Become RD Negotiate weak SSL alg/key with OM Guess overlay names Reverse DNS lookups to enumerate overlay hosts Use DNS to discover overlay hosts Identify RD node Break into RD Steal cert. from

RD Non-RD host on OM

segment

R-D Host DoS Block Systemfrom Eliminating O.L.s DoS Block Users

from building Overlay Leak in Overlay Breach Overlay Assumptions: Authentication Encryption Host firewalls

Attack hosts on other overlays through DNS Server (Breach Overlay)

Attack hosts on other overlays through DNS Server (Breach Overlay)

References

Download now ( PDF - 10 Page - 595.65 KB )

Related documents

Penerapan Batas Ramp-Rate dengan Menggunakan Kombinasi Metode FDP (Forward Dynamic Programming) dan QP (Quadratic Programming) pada Unit Commitment-Economic Dispatch

Metode yang digunakan adalah complete enumeration dengan forward dynamic programming pada unit commitment dan quadratic programming pada economic dispatch.. Metode

Anaplastic Transformation of Papillary Thyroid Carcinoma in a Young Man: A Case Study with Immunohistochemical and BRAF Analysis.

The BRAF V600E (c.1799T >A) and a low level of the BRAF V600V (c.1800G >A) mutation are found in the initially diagnosed papillary thyroid carcinoma (A) and poorly

UNICASE Trace Client: ACASE Tool Integrating Requirements Engineering, Project Management and Code Implementation

First, the developer selects a work item from his/her list of assigned work items. While working on the work item and implementing new code or changing existing code, all re-

Scabies outbreaks in ten care homes for elderly people: a prospective study of clinical features, epidemiology, and treatment outcomes.

We did a prospective observational study between Jan 23, 2014, and April 13, 2015, in residential care homes for elderly people in southeast England that reported scabies

Change Management. ProPath. Office of Information and Technology

Overview: The process map for Change Management cycles through the following process and review activities: CHG-1 Initiate Change CHG-2 Analyze/Plan Change CHG-3 Approve Change

POLITIK LUAR NEGERI AMERIKA SERIKAT DALAM MENJAGA STABILITAS KEAMANAN DI TIMUR TENGAH (Studi Kasus Nuklir Iran)

Bukan hanya itu kepentingan yang lebih penting dari Amerika bahkan dapat bekerjasama dengan Iran yaitu kepentingan mengenai nuklir, bukan hanya mengenai nuklir

Descriptive profile of the academic integrity of Australian occupational therapy students

The aim was to establish a baseline of academic dishon- esty among occupational therapy students as and to investigate any links between academic dishonesty and unprofessional

Workforce Recruitment Program for College Students with Disabilities Paid Summer & Full-Time Jobs Available

Information from these candidate interviews is compiled in a searchable website that is available to federal Human Resources Specialists, Equal Employment Opportunity Specialists,