Hyperledger Foundation Hyperledger Global Forum 2022, 6 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Demo: A Real-time, Cybersecurity Application on the Ledger to Protect... Anusha Iyer & David Mazary

Description

Demo: A Real-time, Cybersecurity Application on the Ledger to Protect APIs - Anusha Iyer & David Mazary, Corsha, Inc

Come join us for a demo of a real-time, cybersecurity application on the Ledger, where we build an API Identity and Access Platform to provide dynamic identities and fully-automated Multi-factor Authenticator for pure machine-to-machine API traffic. Cyber attacks against APIs are accelerating because security isn’t keeping up with automation when it comes to API authentication and access. We’ve put together a platform using Hyperledger Fabric to provide dynamic identity and authentication even for the scale and latency needs of real-time APIs. We’ll walk through our design of the platform and chaincode, demo the API Security platform, how we simulate and test it, and the trust model we’ve put in place with Hyperledger to address a high-scale, real-time, cybersecurity need across enterprises.

Sessions Details & Slides (if available): https://sched.co/15wgN
Access All Sessions: https://events.linuxfoundation.org/hyperledger-global-forum/program/schedule/
----
Hyperledger – Open Source Blockchain Technologies

Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use

Discord: https://discord.gg/rVCn4j7UFd
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory

Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter

Follow-us on Twitter @Hyperledger

Learn about Hyperledger Membership: https://www.hyperledger.org/about/join

#Hyperledger #Blockchain
License
Creative Commons Attribution license (reuse allowed)

A

uh Thank you for coming to the demo, um I'm Anusha Iyer and I'm David and uh we're with corsha it's a cyber security company based in the Washington DC area, and we are using hyperledger fabric to develop a cyber security application and we'll talk through a little bit about the problem space. How we've architected courshia, obviously do a demo and hopefully save some time for a question or two at the end.

A

A

So here's the problem space so essentially what we are trying to solve for is stopping the use, stopping unauthorized access into systems and services through the use of stolen API credentials, because how many of you in the applications and Frameworks and platforms that you're building leverage apis Today show of hands pretty much everyone today, primarily API authentication is done via a handful of ways. One is a static, API key I'm sure you've.

A

If you've used Cloud platforms, you've probably generated an AWS API key, for example, right another is using a token based format, something like an oauth 2.0, oauth tokens or Json web Tokens The Challenge here is these end up still being rooted in a static secret right. So there's a client secret that you have to leverage to request a token and then certainly pki certificates for doing Mutual. Tls is another way to do authentication again.

A

The challenge there and the challenge with a lot of these approaches is these are oftentimes long-lived sometimes set to rarely if ever expire and can be reused right so they're kind of prone to the bearer model of authentication. If I have it, I can use it from anywhere pretty much and adversaries are really kind of wising up to this and almost shifting their focus in attacks from Human, usernames and passwords to API Secrets because oftentimes, they also are larger pipes and access to information.

A

So increasingly we're seeing organizations trying to put in API security strategies in place, and so at Corsa we're focusing on authentication, machine, identity and so forth, and so, as we were, putting the platform together, it was very natural for us to leverage something like hyperledger fabric is a core part of our platform to manage machine identity, and that's essentially what we do so we have built this API security platform.

A

We've been working with fabric since about 2018, and the platform builds out Dynamic machine identities for API clients, I'm sure you all are familiar with multi-factor authentication on the human side right, so the idea of a Google authenticator or an RSA token, or some form of of totp, that layers on to basic username, password authentication. Well, what we've developed at Corsa is a way to do fully automated MFA, using these Dynamic machine identities on The Ledger.

A

So that means that every API request can go with a one-time use credential and essentially so you know just to walk you through the flow a little bit. What we actually do is we're very agnostic to kind of what the flavor or the form factor of the API client can be. It could be anything from a kubernetes pod to a Docker container, a virtual machine, uh even an industrial iot device.

A

We're actually doing some work right now with the U.S Air Force sustainment Center, where we're protecting API access from Industrial iot Equipment sitting on a shop floor right, so anything where there isn't necessarily a human identity to back and protect or validate verify the access.

A

And so what we do is we hook in at the time of deployment. Just like a Google authenticator, we have a Corsa authenticator that deploys with the API client, it's uniquely seated at that time of deployment and then starts establishing a dynamic identity, Against The Ledger. Essentially what this means is. It sends off a cryptographic heartbeat off to The Ledger on a configurable interval, so think on the order of hours.

A

Let's say each beat beat, builds off of the previous one and forms essentially a chained Identity, On The Ledger now in front of the API Services, where you want to enforce MFA. What you do is you place our proxy right and that proxy is going to be looking for these MFA credentials on API requests. They just come in as custom headers and the client can now based off of its chained identity. Its moving identity produce. These one-time use credentials comes into the proxy proxy picks off the MFA credential.

A

That's actually built off of that identity, checks, It, Against, The Ledger, and if there's a match with that machine's identity, you let the call through otherwise you block it so very similar to kind of how an out-of-band totp check would work, and here we're using hyperledger fabric for that out of band Element, and so it's The Ledger, that's kind of allowing us to do the Automation and maintain these identities going forward, and even do things like provide the ability to. uh You know, monitor, halt, resume, API access so and we'll show this during the demo.

A

In fact, so, let's say, for example, you know these are workloads that are pushed up to AWS and they're, doing some analytic processing, maybe processing on some data sending results back home and all of a sudden. There is a security event in AWS that comes in on M2 right through having this kind of mechanism in place.

A

Where you have a fine-grained ability to control the machines, you can actually, through the Management console remotely halt API access for M2 right, investigate, see if there's actually an issue and if it is take the machine down or resume it, but it gives it really allows you to minimize and mitigate the impact of any kind of API security, authentication, type incidents.

A

um The platform itself is based on kubernetes, so we've built it where we deploy fabric to kubernetes and really try to stay platform agnostic so that we can deploy to all of the major platform platform providers.

A

So that's AWS, gcp Google, both on the public and the government clouds, as well as on esxi infrastructure, even air gapped, on-prem environments, as you can imagine, some of our customers on the U.S government side are sort of sensitive about where they put things out, and so we even have completely air gap deployments that we run um and it's very much a drop in solution.

A

So you know, that's been an important part of our usage of fabric is to make it seamless, not require code change on either the client or the service side, and really abstract away a lot of that interaction with The Ledger.

A

And with that we'll go into the demo and then hop over and dive a little bit deeper into what the architecture looks like at the end. Let me see if I can pass this.

A

So if you just want to use this, thank.

B

You hello, okay, so I'm going to show it in action. So what we have here today is a demo of pending API access to trusted machines. What we've done is also in the cloud set up a mock API service that represents a service that we would be calling, with course, of protection. Also in the cloud I've set up a mock API consumer here in the bottom left, and that's going to be a machine. That's deployed with a tightly coupled course Authenticator.

B

Since it has a question authenticator. It's able to call this API service, which has two endpoints. The first endpoint without Corsa just requires a simple API key we've added a second endpoint with Corsa that requires that API key, but also your Dynamic one-time use, corset credential, then I'm going to show, as an outsider, an attack where I steal these credentials when I hit the without question endpoint I I'm able to make that privileged call I'm going to hit the with Corsa, even stealing.

B

That uh Second factor of the course of credential is insufficient to make the call to the with Corsa endpoint so switch over here to the browser, and we have a little web front ends on the front and the back end. It's on the front end. This is what's making the request. It's looking up fingerprint results, let's say from a sensitive database on uh you know personal fingerprints uh and on the back end, we've just configured it in the front end to log its uh requested.

B

It receives so for this first uh attempt I'm going to turn off quotient protection and not use a valid Corsa cred and, let's see what happens, we send our requests over and we get back a little Json response and in the back end we see our request for the purposes of the demo. Here. We're logging, this API key and the request object that was sent well now. I'm an adversary and I see hey these guys log, their API in the clear I'm going to steal it.

B

So here you go I'm going to copy it come over to here to a tool called Postman which lets you kind of mock out test, HTTP rest apis. If you're familiar and I'm hitting the same back, end, endpoint and now I can fill in this API key and I can make a request of my own.

B

And send it off and sure enough right using the same static, API key lets the request through when I go back. I can see in this back end. I have two different requests from two different IP addresses, so here's my adversary attacking with its own request.

B

So now, let's flip back to the client and turn on corset protection turn it on I use a valid Corsa cred, but now my user, my trusted user is using corset protection, we're heading a separate endpoint here and we're getting back the same data and we can see it in the back end going through.

B

So once again, we've logged our API key, but also again for the purposes of the demonstration we've logged. Our one-time use, Dynamic question credential: this is a long base64. Encoded string copy it now.

B

My life is more difficult as an adversary, because I have to go into headers and try to paste that in.

B

Cleanly and once again steal the API key, which is still static.

B

And we'll send it off and all we really see is the attackers 403 Forbidden we're not really going to tell them. Why and sure enough, we don't even see the traffic reach the Epi service on the back end.

A

Quests through the mock client just to show that the credentials really are different, every single time sure.

B

Thing yes, yeah, so every time I send one and again we're logging it on the back end, we're logging it and.

B

A

If you get into the content.

B

Of it you're going to be changing every single time there you go once you get past the headers. You see the part that changes.

B

And so uh let's say we don't. uh We find a reason that I no longer trust these clients. So we have the ability of Corsa, as the new show mentioned, to kind of turn off and on and monitor this API traffic.

B

So I as an administrator will log into the course administrative console and look at my set of machines and this this little proxy that I've been egressing through I. Don't trust it anymore, so I'm going to Halt it so I need to make really sure.

B

And now it has a status of halted. This updates the status of this machine's identity in this fabric blockchain.

B

So now, even though I'm I was a trusted client, everything I send, gets blocked.

B

So, as the administrator, let's say, I go back and what I thought was. Malicious behavior was just a little hiccup I'm, going to turn the access back on I've root, caused it I'm no longer worried so I resume access.

B

Once every Zoom access you can see a little low level, but we enter the status of needs rotation. What we do is we rotate the underlying pki. Every time we halt or resume every time we resume the machine or on demand if he wants to periodically refresh the pki the underfit kind of represents the identity for this machine.

B

It's another rotated it and resumed. It.

B

We can get through right with a brand new, fresh stream and everybody's happy.

A

You know the the idea here is that we provide a lot of the abstraction and security hygiene around identity management, for purely machine to machine communication. Where really you don't have to worry about pki certificates or you know, even within fabricate themselves. You know the certificates expiring between nodes between any kind of components where you're relying on good hygiene around those things.

B

That's a matter of fact.

A

Every time, okay and uh I think we are out of time but happy to talk. Through this later, we have figured out a way to deploy Fabric and put a fair amount into orchestration that we're happy to share. We actually have a talk tomorrow around integrating with cert manager, but standing up.

A

One of these environments for us takes us about 10 to 15 minutes and we've done it on all of the major Cloud, proud forums, both public and gov air gapped, fully on-prem and now are you know, obviously, dealing with a real-time application, like authentication, are able to support on the load of thousands of transactions per second and keep latency down to a handful of milliseconds per request.

A

Thank you for the time.