From 42276fca8ac9de4a80bf305567854f6bf2a5ca04 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Thu, 23 May 2024 13:08:46 +0200 Subject: [PATCH 01/30] Create scs-XXXX-vN-key-manager-standard.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 72 +++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 Standards/scs-XXXX-vN-key-manager-standard.md diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md new file mode 100644 index 000000000..360bf3c20 --- /dev/null +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -0,0 +1,72 @@ +--- +title: Key-Manager Standard +type: Standard +status: Draft +track: IaaS +--- + +## Introduction + +To encrypt user data like volumes or in the future also Images and ephemeral storage for VMs, the key is needed to be present in the infrastructure. +Therefore a key-manager is needed to store the keys and apply autorization policies on requests. +The OpenStack key-manager implemenation that can bu utilized for this is named Barbican. +This standard aims to provide a base level of security for Cloud Service Providers that integrate a key-manager into their deployments. + +## Terminology + +| Term | Meaning | +|---|---| +| API | Application Programming Interface, often referring to the REST API interfaces provided by OpenStack and related services | +| CSP | Cloud Service Provider, provider managing the OpenStack infrastructure | +| IaaS | Infrastructure-as-a-Service | +| HSM | Hardware Security Module | +| KEK | Key Encryption Key | + +## Motivation + +When user data is encrypted the keys need to be stored securely in the Infrastructure to be present, when a possible encryption or decryption needs to take place. +Key-managers like Barbican provide this functionality on IaaS-Level. +Using such a key-manger and thus provide to customers the possibility to encrypt user data is not yet implemented everywhere in IaaS deployments. +A first step towards more security is to encourage CSPs to use this service and provide the feature of using encrypted resources to customers. +It is also important to take a closer look into the key-manager and to apply aim for an appropiate level of security there. +The Key-Manager is responsible for storing the keys securely, which can be done by encrypting them with a KEK and storing them in a database and store the KEK either also encrypted in the database or to store it somewhere else. +Barbican as the OpenStack implementation of a key-manager is relying on a Master-KEK, which encrypts project-specific KEKs, which encrypt the Keys within a project. +All keys except for the Master-KEK are stored in a database. +This Master-KEK is stored differently for each plugin and needs to be protected. + +## Design Considerations + +While discussing what this standard should aim for it was discovered that some CSPs don't use Barbican or another key-manager at all and do not provide the feature to encrypt user data to their customers. +This should change, but the exact change comes with financial burden, when choosing a plugin in Barbican to store the Master-KEK. +To minimize the burden and enable more CSPs to step up and provide encryption, this standard will only make recommendations about plugins. + +### Options considered + +#### _Option 1_ + +Barbican as the OpenStack key-manager implementation offers different plugins to store the Master-KEK. +It was considered to only recommend a certain set of plugins, but this may be very prone to change if Barbican adds a new plugin and this standard would need to consider other possible key-managers as well. +As the SCS only wants to mandate the API that can be abstracted through the Castellan library in OpenStack, integrating any other key-manager implementation is not uncommon. +So this Option was disregarded. + +#### _Option 2_ + +Looking into the plugins and possible attack vectors one design decision in the plugins is very important: where and how to store the Master-KEK. +Because the Plugins might use different technologies, but most of them increase the security level by not storing the Master-KEK in plain text on the physical machine Barbican is running on. +This mechanism as a whole, is something that CSPs should aim to do. + +## Standard + +To increase the level of security and overall user data encryption CSPs SHOULD implement the key-manager API (e.g. implemented by barbican) with a security level of storing Keys encrypted and storing the KEK in another place than the Keys. + +If possible CSPs SHOULD NOT store the Master-KEK in plain-text on the physical host the key-manager is running on. + +## Related Documents + +[Barbican Plugins](https://docs.openstack.org/de/security-guide/secrets-management/barbican.html) + +## Conformance Tests + +Conformance must be tested in two steps. +1. The check whether a key-manager is present can be done in a similar way as in the mandatory OpenStack service APIs standard. +2. The check, that there is no Master-KEK present on the Barbican Node, has to be done by the CSP themself. From b1c030db6516f8d91e7521db9648fc254e157854 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Thu, 23 May 2024 13:11:11 +0200 Subject: [PATCH 02/30] Update scs-XXXX-vN-key-manager-standard.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 1 + 1 file changed, 1 insertion(+) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md index 360bf3c20..a38f23a92 100644 --- a/Standards/scs-XXXX-vN-key-manager-standard.md +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -68,5 +68,6 @@ If possible CSPs SHOULD NOT store the Master-KEK in plain-text on the physical h ## Conformance Tests Conformance must be tested in two steps. + 1. The check whether a key-manager is present can be done in a similar way as in the mandatory OpenStack service APIs standard. 2. The check, that there is no Master-KEK present on the Barbican Node, has to be done by the CSP themself. From fdedfc5ce7fc198872696b727aedc39660a4400d Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Fri, 24 May 2024 14:16:39 +0200 Subject: [PATCH 03/30] Create check-for-key-manager.py This test should be added to the mandatory service test as soon as a Key-Manager MUST be present in csc-conformant deployments. Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- .../iaas/key-manager/check-for-key-manager.py | 82 +++++++++++++++++++ 1 file changed, 82 insertions(+) create mode 100644 Tests/iaas/key-manager/check-for-key-manager.py diff --git a/Tests/iaas/key-manager/check-for-key-manager.py b/Tests/iaas/key-manager/check-for-key-manager.py new file mode 100644 index 000000000..d48f523fb --- /dev/null +++ b/Tests/iaas/key-manager/check-for-key-manager.py @@ -0,0 +1,82 @@ +"""Mandatory APIs checker +This script retrieves the endpoint catalog from Keystone using the OpenStack +SDK and checks whether all mandatory APi endpoints, are present. +The script relies on an OpenStack SDK compatible clouds.yaml file for +authentication with Keystone. +As the s3 endpoint might differ, a missing one will only result in a warning. +""" + +import argparse +import logging +import os + +import openstack + + +logger = logging.getLogger(__name__) + + +def connect(cloud_name: str) -> openstack.connection.Connection: + """Create a connection to an OpenStack cloud + :param string cloud_name: + The name of the configuration to load from clouds.yaml. + :returns: openstack.connnection.Connection + """ + return openstack.connect( + cloud=cloud_name, + ) + + +def check_presence_of_key_manager(cloud_name: str): + try: + connection = connect(cloud_name) + services = connection.service_catalog + except Exception as e: + print(str(e)) + raise Exception( + f"Connection to cloud '{cloud_name}' was not successfully. " + f"The Catalog endpoint could not be accessed. " + f"Please check your cloud connection and authorization." + ) + + for svc in services: + svc_type = svc['type'] + if svc_type == "key-manager": + # key-manager is present + return 0 + + # we did not find the key-manager service + logger.warning("There is no key-manager endpoin in the cloud.") + # we do not fail, until a key-manager MUST be present + return 0 + + +def main(): + parser = argparse.ArgumentParser( + description="SCS Mandatory IaaS Service Checker") + parser.add_argument( + "--os-cloud", type=str, + help="Name of the cloud from clouds.yaml, alternative " + "to the OS_CLOUD environment variable" + ) + parser.add_argument( + "--debug", action="store_true", + help="Enable OpenStack SDK debug logging" + ) + args = parser.parse_args() + openstack.enable_logging(debug=args.debug) + + # parse cloud name for lookup in clouds.yaml + cloud = os.environ.get("OS_CLOUD", None) + if args.os_cloud: + cloud = args.os_cloud + assert cloud, ( + "You need to have the OS_CLOUD environment variable set to your cloud " + "name or pass it via --os-cloud" + ) + + return check_presence_of_key_manager(cloud) + + +if __name__ == "__main__": + main() From b708eb35b9e134eb079841da796a36620c36d32b Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Fri, 24 May 2024 14:19:18 +0200 Subject: [PATCH 04/30] Update scs-XXXX-vN-key-manager-standard.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md index a38f23a92..ef1d29f64 100644 --- a/Standards/scs-XXXX-vN-key-manager-standard.md +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -69,5 +69,5 @@ If possible CSPs SHOULD NOT store the Master-KEK in plain-text on the physical h Conformance must be tested in two steps. -1. The check whether a key-manager is present can be done in a similar way as in the mandatory OpenStack service APIs standard. +1. The check whether a key-manager is present can be done in a similar way as in the mandatory OpenStack service APIs standard and the test should be merged into the mandatory service test as soon as a key-manager is required in scs-conformant infrastructures. 2. The check, that there is no Master-KEK present on the Barbican Node, has to be done by the CSP themself. From 178b2aa296caa812d0fcde70683949879ec66e2d Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Thu, 6 Jun 2024 11:35:41 +0200 Subject: [PATCH 05/30] Update scs-XXXX-vN-key-manager-standard.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md index ef1d29f64..f268cc455 100644 --- a/Standards/scs-XXXX-vN-key-manager-standard.md +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -44,10 +44,9 @@ To minimize the burden and enable more CSPs to step up and provide encryption, t #### _Option 1_ -Barbican as the OpenStack key-manager implementation offers different plugins to store the Master-KEK. -It was considered to only recommend a certain set of plugins, but this may be very prone to change if Barbican adds a new plugin and this standard would need to consider other possible key-managers as well. -As the SCS only wants to mandate the API that can be abstracted through the Castellan library in OpenStack, integrating any other key-manager implementation is not uncommon. -So this Option was disregarded. +It was considered to only recommend a certain set of plugins or backends for the key-manager, but this may be very prone to change if Barbican adds a new plugin. +As the SCS only wants to mandate the API that can be abstracted through the Castellan library in OpenStack, integrating any other key-manager implementation is not uncommon, so this standard needs to consider other possible key-managers as well. +Due to these reasons this Option was disregarded. #### _Option 2_ From 3e220813ba92f337f22fc0dee03eb8620f81729e Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Thu, 6 Jun 2024 11:36:51 +0200 Subject: [PATCH 06/30] Apply suggestions from code review Co-authored-by: Sven Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md index f268cc455..082df8bf1 100644 --- a/Standards/scs-XXXX-vN-key-manager-standard.md +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -8,7 +8,7 @@ track: IaaS ## Introduction To encrypt user data like volumes or in the future also Images and ephemeral storage for VMs, the key is needed to be present in the infrastructure. -Therefore a key-manager is needed to store the keys and apply autorization policies on requests. +Therefore a key-manager is needed to store the keys and apply authorization policies on requests. The OpenStack key-manager implemenation that can bu utilized for this is named Barbican. This standard aims to provide a base level of security for Cloud Service Providers that integrate a key-manager into their deployments. @@ -25,7 +25,7 @@ This standard aims to provide a base level of security for Cloud Service Provide ## Motivation When user data is encrypted the keys need to be stored securely in the Infrastructure to be present, when a possible encryption or decryption needs to take place. -Key-managers like Barbican provide this functionality on IaaS-Level. +Key-managers like Barbican provide this functionality on the IaaS-Level. Using such a key-manger and thus provide to customers the possibility to encrypt user data is not yet implemented everywhere in IaaS deployments. A first step towards more security is to encourage CSPs to use this service and provide the feature of using encrypted resources to customers. It is also important to take a closer look into the key-manager and to apply aim for an appropiate level of security there. From b5f17db836d4d74c7f274f73438733c8b0e2390a Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Wed, 12 Jun 2024 16:03:18 +0200 Subject: [PATCH 07/30] Create scs-XXXX-wN-key-manager-implementation-testing.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- ...X-wN-key-manager-implementation-testing.md | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 Standards/scs-XXXX-wN-key-manager-implementation-testing.md diff --git a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md new file mode 100644 index 000000000..72c2b83ef --- /dev/null +++ b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md @@ -0,0 +1,27 @@ +--- +title: "SCS Key Manager Standard: Implementation and Testing Notes" +type: Supplement +track: IaaS +status: Proposal +supplements: + - scs-XXXX-v1-vN-key-manager-standard.md +--- + +## Implementation + +A Key-Manager can have different backends, for Barbican there are called Plugins. +The standard plugin is simple crypto, which has the Master-KEK written in the Barbican config file. +To secure that Master-KEK it is advised to protect the Barbican config e.g. through running Barbican in an enclave. + +Another option to secure the Master-KEK would be using an HSM with a corresponding plugin in Barbican. +In that case the Master-KEK will be stored inside the HSM and encryption and decryption of the Project-KEKs will also happen in the HSM. +There are also software HSMs available, that should be tested for their integration into the Barbican workflow. + +## Automated Tests + +The check for the presence of a Key Manager is done with an test script, that checks the presence of a key manager service in the catalog endpoint of openstack. +This check can eventually be moved to the checks for the mandatory an supported service/API list, in case of a promotion of the key-manager to the mandatory list. + +## Manual Tests + +There need to be a manual test that searches the physical host of the Key-Manager host for the present of a Master-KEK in Plain-Text, e.g. in the Barbican config file. From c4a2a568f9baf69a8b0018c0185dd2fd1399bbf2 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Mon, 17 Jun 2024 08:44:41 +0200 Subject: [PATCH 08/30] Update scs-XXXX-vN-key-manager-standard.md adjusted the phrasing, as gtema said. Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 24 ++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md index 082df8bf1..410107bd1 100644 --- a/Standards/scs-XXXX-vN-key-manager-standard.md +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -7,9 +7,9 @@ track: IaaS ## Introduction -To encrypt user data like volumes or in the future also Images and ephemeral storage for VMs, the key is needed to be present in the infrastructure. -Therefore a key-manager is needed to store the keys and apply authorization policies on requests. -The OpenStack key-manager implemenation that can bu utilized for this is named Barbican. +To encrypt user data like volumes or in the future also Images and ephemeral storage for VMs, the key is need to be known in the infrastructure. +To provide the key to those operations without includign the user every time a key-manager within the infrastructure can be utilized to store the keys and apply authorization policies on requests. +OpenStack offers a key-manager implementation that is named Barbican, which provides these features. This standard aims to provide a base level of security for Cloud Service Providers that integrate a key-manager into their deployments. ## Terminology @@ -17,6 +17,7 @@ This standard aims to provide a base level of security for Cloud Service Provide | Term | Meaning | |---|---| | API | Application Programming Interface, often referring to the REST API interfaces provided by OpenStack and related services | +| Barbican | The key-manager implementation in OpenStack | | CSP | Cloud Service Provider, provider managing the OpenStack infrastructure | | IaaS | Infrastructure-as-a-Service | | HSM | Hardware Security Module | @@ -24,15 +25,16 @@ This standard aims to provide a base level of security for Cloud Service Provide ## Motivation -When user data is encrypted the keys need to be stored securely in the Infrastructure to be present, when a possible encryption or decryption needs to take place. +User data encryption requires an encryption key to be known during encryption and decryption processes. Key-managers like Barbican provide this functionality on the IaaS-Level. -Using such a key-manger and thus provide to customers the possibility to encrypt user data is not yet implemented everywhere in IaaS deployments. -A first step towards more security is to encourage CSPs to use this service and provide the feature of using encrypted resources to customers. +Not every IaaS deployment currently offers user data encryption as part of their standard offering. +A first step towards more security is to encourage CSPs to provide a better data security by offering data encryption to the customers. It is also important to take a closer look into the key-manager and to apply aim for an appropiate level of security there. -The Key-Manager is responsible for storing the keys securely, which can be done by encrypting them with a KEK and storing them in a database and store the KEK either also encrypted in the database or to store it somewhere else. -Barbican as the OpenStack implementation of a key-manager is relying on a Master-KEK, which encrypts project-specific KEKs, which encrypt the Keys within a project. -All keys except for the Master-KEK are stored in a database. -This Master-KEK is stored differently for each plugin and needs to be protected. +The Key-Manager service manages keys in a secure manner. +This can be achieved differently and is not primarily in scope of this standard. +Barbican stores keys encrypted with the project specific KEK, including the KEK itself, in the database. +The Master KEK, used to encrypt the project specific KEKs is not stored in the database and is stored differently depending on the backend storage plugin used. +This standard also abstracts from used plugins and want to ensure that the Master-KEK is protected, too. ## Design Considerations @@ -50,7 +52,7 @@ Due to these reasons this Option was disregarded. #### _Option 2_ -Looking into the plugins and possible attack vectors one design decision in the plugins is very important: where and how to store the Master-KEK. +Looking into the available Barbican plugins and possible attack vectors one design decision in the plugins is very important: where and how to store the Master-KEK. Because the Plugins might use different technologies, but most of them increase the security level by not storing the Master-KEK in plain text on the physical machine Barbican is running on. This mechanism as a whole, is something that CSPs should aim to do. From d0cc4430a8494556889ca57c2c17b6a2ab786466 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Mon, 17 Jun 2024 10:16:40 +0200 Subject: [PATCH 09/30] Update scs-XXXX-wN-key-manager-implementation-testing.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- .../scs-XXXX-wN-key-manager-implementation-testing.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md index 72c2b83ef..fd82dfa33 100644 --- a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md +++ b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md @@ -9,14 +9,19 @@ supplements: ## Implementation -A Key-Manager can have different backends, for Barbican there are called Plugins. -The standard plugin is simple crypto, which has the Master-KEK written in the Barbican config file. -To secure that Master-KEK it is advised to protect the Barbican config e.g. through running Barbican in an enclave. +A Key-Manager service can have different backends, for Barbican these are called Plugins. +The standard plugin is `simple_crypto`, which has the Master-KEK written in the Barbican config file. +To secure that Master-KEK when the `simple_crypto` plugin is used it is advised to protect the Barbican config e.g. through running Barbican in an enclave. Another option to secure the Master-KEK would be using an HSM with a corresponding plugin in Barbican. In that case the Master-KEK will be stored inside the HSM and encryption and decryption of the Project-KEKs will also happen in the HSM. There are also software HSMs available, that should be tested for their integration into the Barbican workflow. +Other Plugins in Barbican are the KMIP plugin and Vault[^1]. +They are storing the keys differently and CSPs need to make sure, that the access to the keys is configured securely. + +[^1]:[Barbican Plugins](https://docs.openstack.org/barbican/latest/install/barbican-backend.html) + ## Automated Tests The check for the presence of a Key Manager is done with an test script, that checks the presence of a key manager service in the catalog endpoint of openstack. From f9a43a820e78faa40ee46cb3b91886f5ddb7ab4a Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Mon, 17 Jun 2024 10:17:57 +0200 Subject: [PATCH 10/30] Update check-for-key-manager.py Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Tests/iaas/key-manager/check-for-key-manager.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/Tests/iaas/key-manager/check-for-key-manager.py b/Tests/iaas/key-manager/check-for-key-manager.py index d48f523fb..400835478 100644 --- a/Tests/iaas/key-manager/check-for-key-manager.py +++ b/Tests/iaas/key-manager/check-for-key-manager.py @@ -1,9 +1,8 @@ """Mandatory APIs checker This script retrieves the endpoint catalog from Keystone using the OpenStack -SDK and checks whether all mandatory APi endpoints, are present. +SDK and checks whether a key manager APi endpoint is present. The script relies on an OpenStack SDK compatible clouds.yaml file for authentication with Keystone. -As the s3 endpoint might differ, a missing one will only result in a warning. """ import argparse @@ -46,7 +45,7 @@ def check_presence_of_key_manager(cloud_name: str): return 0 # we did not find the key-manager service - logger.warning("There is no key-manager endpoin in the cloud.") + logger.warning("There is no key-manager endpoint in the cloud.") # we do not fail, until a key-manager MUST be present return 0 From 15c5ad9c7ef2dc9e6668771788d7899d5a37fa82 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Tue, 18 Jun 2024 09:15:13 +0200 Subject: [PATCH 11/30] Apply suggestions from code review Co-authored-by: Sven Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 8 ++++---- .../scs-XXXX-wN-key-manager-implementation-testing.md | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md index 410107bd1..a46f1267f 100644 --- a/Standards/scs-XXXX-vN-key-manager-standard.md +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -8,7 +8,7 @@ track: IaaS ## Introduction To encrypt user data like volumes or in the future also Images and ephemeral storage for VMs, the key is need to be known in the infrastructure. -To provide the key to those operations without includign the user every time a key-manager within the infrastructure can be utilized to store the keys and apply authorization policies on requests. +To provide the key to those operations without including the user every time a key-manager within the infrastructure can be utilized to store the keys and apply authorization policies on requests. OpenStack offers a key-manager implementation that is named Barbican, which provides these features. This standard aims to provide a base level of security for Cloud Service Providers that integrate a key-manager into their deployments. @@ -28,13 +28,13 @@ This standard aims to provide a base level of security for Cloud Service Provide User data encryption requires an encryption key to be known during encryption and decryption processes. Key-managers like Barbican provide this functionality on the IaaS-Level. Not every IaaS deployment currently offers user data encryption as part of their standard offering. -A first step towards more security is to encourage CSPs to provide a better data security by offering data encryption to the customers. +A first step towards more security is to encourage CSPs to provide better data security by offering data encryption to the customers. It is also important to take a closer look into the key-manager and to apply aim for an appropiate level of security there. The Key-Manager service manages keys in a secure manner. This can be achieved differently and is not primarily in scope of this standard. Barbican stores keys encrypted with the project specific KEK, including the KEK itself, in the database. The Master KEK, used to encrypt the project specific KEKs is not stored in the database and is stored differently depending on the backend storage plugin used. -This standard also abstracts from used plugins and want to ensure that the Master-KEK is protected, too. +This standard also abstracts the used plugins and wants to ensure that the Master-KEK is protected, too. ## Design Considerations @@ -48,7 +48,7 @@ To minimize the burden and enable more CSPs to step up and provide encryption, t It was considered to only recommend a certain set of plugins or backends for the key-manager, but this may be very prone to change if Barbican adds a new plugin. As the SCS only wants to mandate the API that can be abstracted through the Castellan library in OpenStack, integrating any other key-manager implementation is not uncommon, so this standard needs to consider other possible key-managers as well. -Due to these reasons this Option was disregarded. +Due to these reasons this option was disregarded. #### _Option 2_ diff --git a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md index fd82dfa33..21dca5c92 100644 --- a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md +++ b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md @@ -24,9 +24,9 @@ They are storing the keys differently and CSPs need to make sure, that the acces ## Automated Tests -The check for the presence of a Key Manager is done with an test script, that checks the presence of a key manager service in the catalog endpoint of openstack. +The check for the presence of a Key Manager is done with a test script, that checks the presence of a Key-Manager service in the catalog endpoint of Openstack. This check can eventually be moved to the checks for the mandatory an supported service/API list, in case of a promotion of the key-manager to the mandatory list. ## Manual Tests -There need to be a manual test that searches the physical host of the Key-Manager host for the present of a Master-KEK in Plain-Text, e.g. in the Barbican config file. +There needs to be a manual test that searches the physical host of the Key-Manager host for the presence of a Master-KEK in Plain-Text, e.g. in the Barbican config file. From 1a7d192c4d6cb3883f06090ed577946d38f633e6 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Tue, 18 Jun 2024 09:56:22 +0200 Subject: [PATCH 12/30] unify all times "Key Manager" is written Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md index a46f1267f..0e411a759 100644 --- a/Standards/scs-XXXX-vN-key-manager-standard.md +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -8,16 +8,16 @@ track: IaaS ## Introduction To encrypt user data like volumes or in the future also Images and ephemeral storage for VMs, the key is need to be known in the infrastructure. -To provide the key to those operations without including the user every time a key-manager within the infrastructure can be utilized to store the keys and apply authorization policies on requests. -OpenStack offers a key-manager implementation that is named Barbican, which provides these features. -This standard aims to provide a base level of security for Cloud Service Providers that integrate a key-manager into their deployments. +To provide the key to those operations without including the user every time a Key Manager within the infrastructure can be utilized to store the keys and apply authorization policies on requests. +OpenStack offers a Key Manager implementation that is named Barbican, which provides these features. +This standard aims to provide a base level of security for Cloud Service Providers that integrate a Key Manager into their deployments. ## Terminology | Term | Meaning | |---|---| | API | Application Programming Interface, often referring to the REST API interfaces provided by OpenStack and related services | -| Barbican | The key-manager implementation in OpenStack | +| Barbican | The Key Manager implementation in OpenStack | | CSP | Cloud Service Provider, provider managing the OpenStack infrastructure | | IaaS | Infrastructure-as-a-Service | | HSM | Hardware Security Module | @@ -26,19 +26,19 @@ This standard aims to provide a base level of security for Cloud Service Provide ## Motivation User data encryption requires an encryption key to be known during encryption and decryption processes. -Key-managers like Barbican provide this functionality on the IaaS-Level. +Key Managers like Barbican provide this functionality on the IaaS-Level. Not every IaaS deployment currently offers user data encryption as part of their standard offering. A first step towards more security is to encourage CSPs to provide better data security by offering data encryption to the customers. -It is also important to take a closer look into the key-manager and to apply aim for an appropiate level of security there. -The Key-Manager service manages keys in a secure manner. +It is also important to take a closer look into the Key Manager and to apply aim for an appropiate level of security there. +The Key Manager service manages keys in a secure manner. This can be achieved differently and is not primarily in scope of this standard. Barbican stores keys encrypted with the project specific KEK, including the KEK itself, in the database. -The Master KEK, used to encrypt the project specific KEKs is not stored in the database and is stored differently depending on the backend storage plugin used. +The Master-KEK, used to encrypt the project specific KEKs is not stored in the database and is stored differently depending on the backend storage plugin used. This standard also abstracts the used plugins and wants to ensure that the Master-KEK is protected, too. ## Design Considerations -While discussing what this standard should aim for it was discovered that some CSPs don't use Barbican or another key-manager at all and do not provide the feature to encrypt user data to their customers. +While discussing what this standard should aim for it was discovered that some CSPs don't use Barbican or another Key Manager at all and do not provide the feature to encrypt user data to their customers. This should change, but the exact change comes with financial burden, when choosing a plugin in Barbican to store the Master-KEK. To minimize the burden and enable more CSPs to step up and provide encryption, this standard will only make recommendations about plugins. @@ -46,8 +46,8 @@ To minimize the burden and enable more CSPs to step up and provide encryption, t #### _Option 1_ -It was considered to only recommend a certain set of plugins or backends for the key-manager, but this may be very prone to change if Barbican adds a new plugin. -As the SCS only wants to mandate the API that can be abstracted through the Castellan library in OpenStack, integrating any other key-manager implementation is not uncommon, so this standard needs to consider other possible key-managers as well. +It was considered to only recommend a certain set of plugins or backends for the Key Manager, but this may be very prone to change if e.g. Barbican adds a new plugin. +As the SCS only wants to mandate the API that can be abstracted through the Castellan library in OpenStack, integrating any other Key Manager implementation is not uncommon, so this standard needs to consider other possible Key Managers as well. Due to these reasons this option was disregarded. #### _Option 2_ @@ -58,9 +58,9 @@ This mechanism as a whole, is something that CSPs should aim to do. ## Standard -To increase the level of security and overall user data encryption CSPs SHOULD implement the key-manager API (e.g. implemented by barbican) with a security level of storing Keys encrypted and storing the KEK in another place than the Keys. +To increase the level of security and overall user data encryption CSPs SHOULD implement the Key Manager API (e.g. implemented by Barbican) with a security level of storing Keys encrypted and storing the Master-KEK in another place than the Keys. -If possible CSPs SHOULD NOT store the Master-KEK in plain-text on the physical host the key-manager is running on. +If possible CSPs SHOULD NOT store the Master-KEK in plain-text on the physical host the Key Manager is running on. ## Related Documents @@ -70,5 +70,5 @@ If possible CSPs SHOULD NOT store the Master-KEK in plain-text on the physical h Conformance must be tested in two steps. -1. The check whether a key-manager is present can be done in a similar way as in the mandatory OpenStack service APIs standard and the test should be merged into the mandatory service test as soon as a key-manager is required in scs-conformant infrastructures. -2. The check, that there is no Master-KEK present on the Barbican Node, has to be done by the CSP themself. +1. The check whether a Key Manager is present can be done in a similar way as in the mandatory OpenStack service APIs standard and the test should be merged into the mandatory service test as soon as a Key Manager is required in scs-conformant infrastructures. +2. The check, that there is no Master-KEK present on the Key Manager Node, has to be done by the CSP themself. From 9d7a7cbab1ef1982ef0ebc6d10e9dcf858f9cf9a Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Tue, 18 Jun 2024 09:58:02 +0200 Subject: [PATCH 13/30] Update scs-XXXX-wN-key-manager-implementation-testing.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- .../scs-XXXX-wN-key-manager-implementation-testing.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md index 21dca5c92..ad1b64e90 100644 --- a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md +++ b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md @@ -9,7 +9,7 @@ supplements: ## Implementation -A Key-Manager service can have different backends, for Barbican these are called Plugins. +A Key Manager service can have different backends, for Barbican these are called Plugins. The standard plugin is `simple_crypto`, which has the Master-KEK written in the Barbican config file. To secure that Master-KEK when the `simple_crypto` plugin is used it is advised to protect the Barbican config e.g. through running Barbican in an enclave. @@ -24,9 +24,9 @@ They are storing the keys differently and CSPs need to make sure, that the acces ## Automated Tests -The check for the presence of a Key Manager is done with a test script, that checks the presence of a Key-Manager service in the catalog endpoint of Openstack. -This check can eventually be moved to the checks for the mandatory an supported service/API list, in case of a promotion of the key-manager to the mandatory list. +The check for the presence of a Key Manager is done with a test script, that checks the presence of a Key Manager service in the catalog endpoint of Openstack. +This check can eventually be moved to the checks for the mandatory an supported service/API list, in case of a promotion of the Key Manager to the mandatory list. ## Manual Tests -There needs to be a manual test that searches the physical host of the Key-Manager host for the presence of a Master-KEK in Plain-Text, e.g. in the Barbican config file. +There needs to be a manual test that searches the physical host of the Key Manager host for the presence of a Master-KEK in Plain-Text, e.g. in the Barbican config file. From 6fe1f69340975a35dff4b437212dcf80fb62d692 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Tue, 25 Jun 2024 14:30:39 +0200 Subject: [PATCH 14/30] Rephrasing many sentences for a better understanding. Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 22 +++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md index 0e411a759..905224824 100644 --- a/Standards/scs-XXXX-vN-key-manager-standard.md +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -7,8 +7,10 @@ track: IaaS ## Introduction -To encrypt user data like volumes or in the future also Images and ephemeral storage for VMs, the key is need to be known in the infrastructure. -To provide the key to those operations without including the user every time a Key Manager within the infrastructure can be utilized to store the keys and apply authorization policies on requests. +To encrypt user data like volumes or in the future also Images and ephemeral storage for VMs, the key has to be present in the infrastructure. +A Key Manager service within the infrastructure can be utilized to store keys. +Consequently providing keys for every encryption or decryption is possible without including the user. +Also authorization policies can be applied on every request to the Key Manager servicer. OpenStack offers a Key Manager implementation that is named Barbican, which provides these features. This standard aims to provide a base level of security for Cloud Service Providers that integrate a Key Manager into their deployments. @@ -28,11 +30,11 @@ This standard aims to provide a base level of security for Cloud Service Provide User data encryption requires an encryption key to be known during encryption and decryption processes. Key Managers like Barbican provide this functionality on the IaaS-Level. Not every IaaS deployment currently offers user data encryption as part of their standard offering. -A first step towards more security is to encourage CSPs to provide better data security by offering data encryption to the customers. -It is also important to take a closer look into the Key Manager and to apply aim for an appropiate level of security there. -The Key Manager service manages keys in a secure manner. -This can be achieved differently and is not primarily in scope of this standard. -Barbican stores keys encrypted with the project specific KEK, including the KEK itself, in the database. +This standard should encourage CSPs to integrate a Key Manager and thus increase the amount of Clouds witch offerings of data encryption. +It is also important to take a closer look into the Key Manager and analyze how such a service can be configured securely. + +A Key Manager service manages keys in a secure manner, but this can be achieved differently and is not primarily in scope of this standard. +The OpenStack Key Manager Barbican stores keys encrypted with the project specific KEK, including the KEK itself, in the database. The Master-KEK, used to encrypt the project specific KEKs is not stored in the database and is stored differently depending on the backend storage plugin used. This standard also abstracts the used plugins and wants to ensure that the Master-KEK is protected, too. @@ -53,12 +55,14 @@ Due to these reasons this option was disregarded. #### _Option 2_ Looking into the available Barbican plugins and possible attack vectors one design decision in the plugins is very important: where and how to store the Master-KEK. -Because the Plugins might use different technologies, but most of them increase the security level by not storing the Master-KEK in plain text on the physical machine Barbican is running on. +Because the Plugins might use different technologies there are many locations for the Master KEK possible. +Most of the Plugins increase the security level by not storing the Master-KEK in plain text on the physical machine Barbican is running on. This mechanism as a whole, is something that CSPs should aim to do. ## Standard -To increase the level of security and overall user data encryption CSPs SHOULD implement the Key Manager API (e.g. implemented by Barbican) with a security level of storing Keys encrypted and storing the Master-KEK in another place than the Keys. +To increase security and allow user data encryption, CSPs SHOULD implement the Key Manager API (e.g. implemented by Barbican). +The Keys managed by this Key Manager MUST be stored encrypted and the Master-KEK of the Key Manager MUST be stored in another place than the Keys. If possible CSPs SHOULD NOT store the Master-KEK in plain-text on the physical host the Key Manager is running on. From 22d456d72f1f4745634c94176228300408317598 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Tue, 25 Jun 2024 15:07:06 +0200 Subject: [PATCH 15/30] Rephrasing Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- .../scs-XXXX-wN-key-manager-implementation-testing.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md index ad1b64e90..91c4be20e 100644 --- a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md +++ b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md @@ -9,9 +9,11 @@ supplements: ## Implementation -A Key Manager service can have different backends, for Barbican these are called Plugins. +A Key Manager service can have different backends. +For Barbican these are called Plugins. The standard plugin is `simple_crypto`, which has the Master-KEK written in the Barbican config file. -To secure that Master-KEK when the `simple_crypto` plugin is used it is advised to protect the Barbican config e.g. through running Barbican in an enclave. +In that case the Master-KEK needs additional protection. +When the `simple_crypto` plugin is used, securing the Master-KEK can be achieved through protection of the Barbican config e.g. through running Barbican in an enclave. Another option to secure the Master-KEK would be using an HSM with a corresponding plugin in Barbican. In that case the Master-KEK will be stored inside the HSM and encryption and decryption of the Project-KEKs will also happen in the HSM. @@ -29,4 +31,6 @@ This check can eventually be moved to the checks for the mandatory an supported ## Manual Tests -There needs to be a manual test that searches the physical host of the Key Manager host for the presence of a Master-KEK in Plain-Text, e.g. in the Barbican config file. +It is not possible to check a deployment for a correctly protected Master KEK automatically from the outside. +Even audits would need to check the complete host for plain-text keys. +CSPs are responsible for ensuring the protection of the Master KEK and they have to make at least their architecture for that protection auditable. From 8c86fe8bf2aa8b364b70f56a2b3ac43c3eefe712 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Wed, 3 Jul 2024 14:38:25 +0200 Subject: [PATCH 16/30] Add section for the Key Manager Policies Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 34 ++++++++++++++++--- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md index 905224824..5162e8dc1 100644 --- a/Standards/scs-XXXX-vN-key-manager-standard.md +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -1,5 +1,5 @@ --- -title: Key-Manager Standard +title: Key Manager Standard type: Standard status: Draft track: IaaS @@ -24,6 +24,7 @@ This standard aims to provide a base level of security for Cloud Service Provide | IaaS | Infrastructure-as-a-Service | | HSM | Hardware Security Module | | KEK | Key Encryption Key | +| RBAC | Role Based Access Control | ## Motivation @@ -46,26 +47,51 @@ To minimize the burden and enable more CSPs to step up and provide encryption, t ### Options considered -#### _Option 1_ +#### Recommend or even mandate specific Key Manager plugins It was considered to only recommend a certain set of plugins or backends for the Key Manager, but this may be very prone to change if e.g. Barbican adds a new plugin. As the SCS only wants to mandate the API that can be abstracted through the Castellan library in OpenStack, integrating any other Key Manager implementation is not uncommon, so this standard needs to consider other possible Key Managers as well. Due to these reasons this option was disregarded. -#### _Option 2_ +#### Recommendation regarding the handling of the Master KEK Looking into the available Barbican plugins and possible attack vectors one design decision in the plugins is very important: where and how to store the Master-KEK. Because the Plugins might use different technologies there are many locations for the Master KEK possible. Most of the Plugins increase the security level by not storing the Master-KEK in plain text on the physical machine Barbican is running on. This mechanism as a whole, is something that CSPs should aim to do. -## Standard +#### Standardization of the Key Manager Policy + +Because this standards recommends or even eventually mandates the presence of a Key Manager, the situation about the policy of the Key Manager needs to be discussed. +The policy of an IaaS service should use the same roles as the other IaaS services. +Unfortunately this does not apply to the Key Manager implementation Barbican. +It has the roles 'reader', 'audit' and 'creator', which are not present in the Keystone role concept. +The roles a customer usually gets through the Identity API is 'member'. +Leaving it this way will prevent users from creating and using secrets even when a Key Manager is integrated. + +To unify the roles among all IaaS services, there is currently work done in the OpenStack Community. +This initiative is called secure RBAC[^1]. +Also the SCS is discussing a standard concerning the roles[^2]. +When this is done, there is no further work needed. +But as of the 2024.1 release, this is still under development. + +In conclusion this standard should mandate everyone who uses a Key Manager that does not include the secure RBAC, to adjust the policies to have a mapping between the internal 'creator' and the identity-based 'member' role. +This will result in a 'member' being allowed to do everything a 'creator' can do. + +[^1]: [Secure RBAC work in OpenStack](https://etherpad.opendev.org/p/rbac-goal-tracking) +[^2]: [Issue for a role standard in SCS](https://github.com/SovereignCloudStack/issues/issues/396) + +## Key Manager Standard To increase security and allow user data encryption, CSPs SHOULD implement the Key Manager API (e.g. implemented by Barbican). The Keys managed by this Key Manager MUST be stored encrypted and the Master-KEK of the Key Manager MUST be stored in another place than the Keys. If possible CSPs SHOULD NOT store the Master-KEK in plain-text on the physical host the Key Manager is running on. +### Key Manager Policies + +If a Key Manager without secure RBAC enabled is used, the policies MUST be adjusted to let the 'member' role of the Identity service be equivalent to the Key Manager internal 'creator' role. + ## Related Documents [Barbican Plugins](https://docs.openstack.org/de/security-guide/secrets-management/barbican.html) From 86ddfc5d6e61bacd12089b9b8ca3a803b316c2ed Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Wed, 3 Jul 2024 14:40:33 +0200 Subject: [PATCH 17/30] Update scs-XXXX-vN-key-manager-standard.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md index 5162e8dc1..cf8d3ff69 100644 --- a/Standards/scs-XXXX-vN-key-manager-standard.md +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -80,7 +80,7 @@ This will result in a 'member' being allowed to do everything a 'creator' can do [^1]: [Secure RBAC work in OpenStack](https://etherpad.opendev.org/p/rbac-goal-tracking) [^2]: [Issue for a role standard in SCS](https://github.com/SovereignCloudStack/issues/issues/396) - + ## Key Manager Standard To increase security and allow user data encryption, CSPs SHOULD implement the Key Manager API (e.g. implemented by Barbican). From 0acc7b42ed0282688f269c1a8dd837fdd0b92e92 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Wed, 3 Jul 2024 15:02:57 +0200 Subject: [PATCH 18/30] add policies to the implementation notes Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- .../scs-XXXX-wN-key-manager-implementation-testing.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md index 91c4be20e..75de66151 100644 --- a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md +++ b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md @@ -24,6 +24,15 @@ They are storing the keys differently and CSPs need to make sure, that the acces [^1]:[Barbican Plugins](https://docs.openstack.org/barbican/latest/install/barbican-backend.html) +### Policies + +When a Key Manager is used, but it uses the old policies and does not enforce the new secure RBAC work, the roles between Barbican and the other IaaS services differ. +This can be done with a small change in the policy.yaml file. The `creator` has to be defined like this: + +``` +"creator": "role:member" +``` + ## Automated Tests The check for the presence of a Key Manager is done with a test script, that checks the presence of a Key Manager service in the catalog endpoint of Openstack. From 5f9d30cb19af9c12d4e629559ccb04e65ffe799c Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Wed, 3 Jul 2024 15:04:42 +0200 Subject: [PATCH 19/30] Update scs-XXXX-vN-key-manager-standard.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md index cf8d3ff69..b37b13682 100644 --- a/Standards/scs-XXXX-vN-key-manager-standard.md +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -65,8 +65,8 @@ This mechanism as a whole, is something that CSPs should aim to do. Because this standards recommends or even eventually mandates the presence of a Key Manager, the situation about the policy of the Key Manager needs to be discussed. The policy of an IaaS service should use the same roles as the other IaaS services. Unfortunately this does not apply to the Key Manager implementation Barbican. -It has the roles 'reader', 'audit' and 'creator', which are not present in the Keystone role concept. -The roles a customer usually gets through the Identity API is 'member'. +It has the roles `reader`, `audit` and `creator`, which are not present in the Keystone role concept. +The roles a customer usually gets through the Identity API is `member`. Leaving it this way will prevent users from creating and using secrets even when a Key Manager is integrated. To unify the roles among all IaaS services, there is currently work done in the OpenStack Community. @@ -75,8 +75,8 @@ Also the SCS is discussing a standard concerning the roles[^2]. When this is done, there is no further work needed. But as of the 2024.1 release, this is still under development. -In conclusion this standard should mandate everyone who uses a Key Manager that does not include the secure RBAC, to adjust the policies to have a mapping between the internal 'creator' and the identity-based 'member' role. -This will result in a 'member' being allowed to do everything a 'creator' can do. +In conclusion this standard should mandate everyone who uses a Key Manager that does not include the secure RBAC, to adjust the policies to have a mapping between the internal `creator` and the identity-based `member` role. +This will result in a `member` being allowed to do everything a `creator` can do. [^1]: [Secure RBAC work in OpenStack](https://etherpad.opendev.org/p/rbac-goal-tracking) [^2]: [Issue for a role standard in SCS](https://github.com/SovereignCloudStack/issues/issues/396) @@ -90,7 +90,7 @@ If possible CSPs SHOULD NOT store the Master-KEK in plain-text on the physical h ### Key Manager Policies -If a Key Manager without secure RBAC enabled is used, the policies MUST be adjusted to let the 'member' role of the Identity service be equivalent to the Key Manager internal 'creator' role. +If a Key Manager without secure RBAC enabled is used, the policies MUST be adjusted to let the `member` role of the Identity service be equivalent to the Key Manager internal `creator` role. ## Related Documents From 11befc801aa80cdef68f7385b455196ea7dfdcdc Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Wed, 3 Jul 2024 15:12:09 +0200 Subject: [PATCH 20/30] Update scs-XXXX-wN-key-manager-implementation-testing.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-wN-key-manager-implementation-testing.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md index 75de66151..32305eb8f 100644 --- a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md +++ b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md @@ -29,7 +29,7 @@ They are storing the keys differently and CSPs need to make sure, that the acces When a Key Manager is used, but it uses the old policies and does not enforce the new secure RBAC work, the roles between Barbican and the other IaaS services differ. This can be done with a small change in the policy.yaml file. The `creator` has to be defined like this: -``` +```yaml "creator": "role:member" ``` From 6405a42aa9d00c94cb308bbbfcd20b34c0d24fce Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Thu, 4 Jul 2024 10:49:43 +0200 Subject: [PATCH 21/30] Update check-for-key-manager.py Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- .../iaas/key-manager/check-for-key-manager.py | 54 +++++++++++++++++++ 1 file changed, 54 insertions(+) diff --git a/Tests/iaas/key-manager/check-for-key-manager.py b/Tests/iaas/key-manager/check-for-key-manager.py index 400835478..add112dbc 100644 --- a/Tests/iaas/key-manager/check-for-key-manager.py +++ b/Tests/iaas/key-manager/check-for-key-manager.py @@ -49,6 +49,60 @@ def check_presence_of_key_manager(cloud_name: str): # we do not fail, until a key-manager MUST be present return 0 +def check_key_manager_permissions(conn: openstack.connection.Connection + ) -> None: + """ + Limits the authentication to the "member" role using an application + credentials restricted to that role and verifies that the member role + has sufficient access to the Key Manager API functionality. + """ + secret_name = "scs-member-role-test-secret" + + def _find_secret(secret_name_or_id: str): + """Replacement method for finding secrets. + + Mimicks the behavior of Connection.key_manager.find_secret() + but fixes an issue with the internal implementation raising an + exception due to an unexpected microversion parameter. + """ + secrets = conn.key_manager.secrets() + for s in secrets: + if s.name == secret_name_or_id or s.id == secret_name_or_id: + return s + return None + + try: + existing_secret = _find_secret(secret_name) + if existing_secret: + conn.key_manager.delete_secret(existing_secret) + + conn.key_manager.create_secret( + name=secret_name, + payload_content_type="text/plain", + secret_type="opaque", + payload="foo" + ) + + new_secret = _find_secret(secret_name) + assert new_secret, ( + f"Secret created with name '{secret_name}' was not discoverable by " + f"the user" + ) + conn.key_manager.delete_secret(new_secret) + except openstack.exceptions.ForbiddenException as e: + print( + "Users of the 'member' role can use Key Manager API: FAIL" + ) + print( + f"ERROR: {str(e)}" + ) + exit(1) + finally: + delete_application_credential(conn, APP_CREDENTIAL_NAME) + print( + "Users of the 'member' role can use Key Manager API: PASS" + ) + def main(): parser = argparse.ArgumentParser( From 559425e70b2e2e5c23ff9bc526c892b7ac8404be Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Thu, 4 Jul 2024 10:59:30 +0200 Subject: [PATCH 22/30] Update check-for-key-manager.py Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Tests/iaas/key-manager/check-for-key-manager.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Tests/iaas/key-manager/check-for-key-manager.py b/Tests/iaas/key-manager/check-for-key-manager.py index add112dbc..2ed387c03 100644 --- a/Tests/iaas/key-manager/check-for-key-manager.py +++ b/Tests/iaas/key-manager/check-for-key-manager.py @@ -42,6 +42,9 @@ def check_presence_of_key_manager(cloud_name: str): svc_type = svc['type'] if svc_type == "key-manager": # key-manager is present + # now we want to check whether a user with member role + # can create and access secrets + check_key_manager_permissions(connection) return 0 # we did not find the key-manager service @@ -49,6 +52,7 @@ def check_presence_of_key_manager(cloud_name: str): # we do not fail, until a key-manager MUST be present return 0 + def check_key_manager_permissions(conn: openstack.connection.Connection ) -> None: """ @@ -97,8 +101,6 @@ def _find_secret(secret_name_or_id: str): f"ERROR: {str(e)}" ) exit(1) - finally: - delete_application_credential(conn, APP_CREDENTIAL_NAME) print( "Users of the 'member' role can use Key Manager API: PASS" ) From aa607f189fc4c5b4620d4f002dd88e262247645e Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Tue, 16 Jul 2024 15:02:56 +0200 Subject: [PATCH 23/30] Update check-for-key-manager.py Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- .../iaas/key-manager/check-for-key-manager.py | 57 ++++++++++++++++++- 1 file changed, 55 insertions(+), 2 deletions(-) diff --git a/Tests/iaas/key-manager/check-for-key-manager.py b/Tests/iaas/key-manager/check-for-key-manager.py index 2ed387c03..8d5a59e82 100644 --- a/Tests/iaas/key-manager/check-for-key-manager.py +++ b/Tests/iaas/key-manager/check-for-key-manager.py @@ -6,6 +6,7 @@ """ import argparse +import json import logging import os @@ -26,6 +27,54 @@ def connect(cloud_name: str) -> openstack.connection.Connection: ) +def check_for_member_role(conn: openstack.connection.Connection + ) -> None: + """Method to check whether the current user has the member role. + :param connection: + The current connection to an OpenStack cloud. + :returns: boolean, when role with most priviledges is member + """ + + auth_data = conn.auth + auth_dict = { + "identity" : { + "methods" : ["password"], + "password": { + "user" : { + "name" : auth_data['username'], + "domain": { "name": auth_data['project_domain_name'] }, + "password": auth_data['password'] + } + }, + }, + "scope":{ + "project":{ + "domain": {"name": auth_data['project_domain_name']}, + "name": auth_data['project_name'] + } + } + } + + has_member_role = False + if ident_endpoint: + request = conn.session.request(auth_data['auth_url'] + '/v3/auth/tokens', + 'POST', + json={'auth':auth_dict}) + for role in json.loads(request.content)["token"]["roles"]: + role_name = role["name"] + if role_name == "admin" or role_name == "manager": + return False + elif role_name == "member": + print("User has member role.") + has_member_role = True + elif role_name == "reader": + print("User has reader role.") + else: + print("User has custom role.") + return False + return has_member_role + + def check_presence_of_key_manager(cloud_name: str): try: connection = connect(cloud_name) @@ -56,11 +105,15 @@ def check_presence_of_key_manager(cloud_name: str): def check_key_manager_permissions(conn: openstack.connection.Connection ) -> None: """ - Limits the authentication to the "member" role using an application - credentials restricted to that role and verifies that the member role + After checking that the current user only has the member and maybe the + reader role, this method verifies that the user with a member role has sufficient access to the Key Manager API functionality. """ secret_name = "scs-member-role-test-secret" + if not check_for_member_role(conn): + logger.warning(f"Cannot test key-manager permissions. " + f"User has wrong roles") + return None def _find_secret(secret_name_or_id: str): """Replacement method for finding secrets. From ad9e3f93d3b539539ce0960eca6fa7eaee101cf8 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Wed, 17 Jul 2024 07:38:19 +0200 Subject: [PATCH 24/30] Update check-for-key-manager.py Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- .../iaas/key-manager/check-for-key-manager.py | 65 +++++++++---------- 1 file changed, 32 insertions(+), 33 deletions(-) diff --git a/Tests/iaas/key-manager/check-for-key-manager.py b/Tests/iaas/key-manager/check-for-key-manager.py index 8d5a59e82..f8f1d9559 100644 --- a/Tests/iaas/key-manager/check-for-key-manager.py +++ b/Tests/iaas/key-manager/check-for-key-manager.py @@ -37,41 +37,40 @@ def check_for_member_role(conn: openstack.connection.Connection auth_data = conn.auth auth_dict = { - "identity" : { - "methods" : ["password"], - "password": { - "user" : { - "name" : auth_data['username'], - "domain": { "name": auth_data['project_domain_name'] }, - "password": auth_data['password'] - } - }, - }, - "scope":{ - "project":{ + "identity": { + "methods": ["password"], + "password": { + "user": { + "name" : auth_data['username'], "domain": {"name": auth_data['project_domain_name']}, - "name": auth_data['project_name'] + "password": auth_data['password'] } - } - } + }, + }, + "scope": { + "project": { + "domain": {"name": auth_data['project_domain_name']}, + "name": auth_data['project_name'] + } + } + } has_member_role = False - if ident_endpoint: - request = conn.session.request(auth_data['auth_url'] + '/v3/auth/tokens', - 'POST', - json={'auth':auth_dict}) - for role in json.loads(request.content)["token"]["roles"]: - role_name = role["name"] - if role_name == "admin" or role_name == "manager": - return False - elif role_name == "member": - print("User has member role.") - has_member_role = True - elif role_name == "reader": - print("User has reader role.") - else: - print("User has custom role.") - return False + request = conn.session.request(auth_data['auth_url'] + '/v3/auth/tokens', + 'POST', + json={'auth':auth_dict}) + for role in json.loads(request.content)["token"]["roles"]: + role_name = role["name"] + if role_name == "admin" or role_name == "manager": + return False + elif role_name == "member": + print("User has member role.") + has_member_role = True + elif role_name == "reader": + print("User has reader role.") + else: + print("User has custom role.") + return False return has_member_role @@ -111,8 +110,8 @@ def check_key_manager_permissions(conn: openstack.connection.Connection """ secret_name = "scs-member-role-test-secret" if not check_for_member_role(conn): - logger.warning(f"Cannot test key-manager permissions. " - f"User has wrong roles") + logger.warning("Cannot test key-manager permissions. " + "User has wrong roles") return None def _find_secret(secret_name_or_id: str): From 438a257ab85e30cfab1d625709a032f38c12a7eb Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Wed, 17 Jul 2024 07:56:21 +0200 Subject: [PATCH 25/30] Update check-for-key-manager.py Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Tests/iaas/key-manager/check-for-key-manager.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/Tests/iaas/key-manager/check-for-key-manager.py b/Tests/iaas/key-manager/check-for-key-manager.py index f8f1d9559..ded63d114 100644 --- a/Tests/iaas/key-manager/check-for-key-manager.py +++ b/Tests/iaas/key-manager/check-for-key-manager.py @@ -39,14 +39,14 @@ def check_for_member_role(conn: openstack.connection.Connection auth_dict = { "identity": { "methods": ["password"], - "password": { - "user": { - "name" : auth_data['username'], - "domain": {"name": auth_data['project_domain_name']}, - "password": auth_data['password'] - } - }, + "password": { + "user": { + "name": auth_data['username'], + "domain": {"name": auth_data['project_domain_name']}, + "password": auth_data['password'] + } }, + }, "scope": { "project": { "domain": {"name": auth_data['project_domain_name']}, @@ -58,7 +58,7 @@ def check_for_member_role(conn: openstack.connection.Connection has_member_role = False request = conn.session.request(auth_data['auth_url'] + '/v3/auth/tokens', 'POST', - json={'auth':auth_dict}) + json={'auth': auth_dict}) for role in json.loads(request.content)["token"]["roles"]: role_name = role["name"] if role_name == "admin" or role_name == "manager": From 5025d74e82c96fbb8ceb4e7429c60bd3ee5e4aa3 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Thu, 15 Aug 2024 11:25:19 +0200 Subject: [PATCH 26/30] Update check-for-key-manager.py Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Tests/iaas/key-manager/check-for-key-manager.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Tests/iaas/key-manager/check-for-key-manager.py b/Tests/iaas/key-manager/check-for-key-manager.py index ded63d114..6b5a5b70a 100644 --- a/Tests/iaas/key-manager/check-for-key-manager.py +++ b/Tests/iaas/key-manager/check-for-key-manager.py @@ -29,7 +29,8 @@ def connect(cloud_name: str) -> openstack.connection.Connection: def check_for_member_role(conn: openstack.connection.Connection ) -> None: - """Method to check whether the current user has the member role. + """Checks whether the current user has at maximum privileges + of the member role. :param connection: The current connection to an OpenStack cloud. :returns: boolean, when role with most priviledges is member From 7a1e49f1244833d76cb52c62e0ccbb4e0fb973b9 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Thu, 15 Aug 2024 13:53:52 +0200 Subject: [PATCH 27/30] Adjust Spelling and some phrases. Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-vN-key-manager-standard.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-XXXX-vN-key-manager-standard.md index b37b13682..55d74f0d0 100644 --- a/Standards/scs-XXXX-vN-key-manager-standard.md +++ b/Standards/scs-XXXX-vN-key-manager-standard.md @@ -10,7 +10,7 @@ track: IaaS To encrypt user data like volumes or in the future also Images and ephemeral storage for VMs, the key has to be present in the infrastructure. A Key Manager service within the infrastructure can be utilized to store keys. Consequently providing keys for every encryption or decryption is possible without including the user. -Also authorization policies can be applied on every request to the Key Manager servicer. +Also authorization policies can be applied on every request to the Key Manager service. OpenStack offers a Key Manager implementation that is named Barbican, which provides these features. This standard aims to provide a base level of security for Cloud Service Providers that integrate a Key Manager into their deployments. @@ -31,19 +31,20 @@ This standard aims to provide a base level of security for Cloud Service Provide User data encryption requires an encryption key to be known during encryption and decryption processes. Key Managers like Barbican provide this functionality on the IaaS-Level. Not every IaaS deployment currently offers user data encryption as part of their standard offering. -This standard should encourage CSPs to integrate a Key Manager and thus increase the amount of Clouds witch offerings of data encryption. +This standard should encourage CSPs to integrate a Key Manager and thus increase the amount of Clouds with offerings of data encryption. It is also important to take a closer look into the Key Manager and analyze how such a service can be configured securely. A Key Manager service manages keys in a secure manner, but this can be achieved differently and is not primarily in scope of this standard. -The OpenStack Key Manager Barbican stores keys encrypted with the project specific KEK, including the KEK itself, in the database. +The OpenStack Key Manager Barbican stores keys encrypted with a project specific KEK in the database. +The KEKs are also stored encrypted in the same database. The Master-KEK, used to encrypt the project specific KEKs is not stored in the database and is stored differently depending on the backend storage plugin used. This standard also abstracts the used plugins and wants to ensure that the Master-KEK is protected, too. ## Design Considerations While discussing what this standard should aim for it was discovered that some CSPs don't use Barbican or another Key Manager at all and do not provide the feature to encrypt user data to their customers. -This should change, but the exact change comes with financial burden, when choosing a plugin in Barbican to store the Master-KEK. -To minimize the burden and enable more CSPs to step up and provide encryption, this standard will only make recommendations about plugins. +This should change, but the exact change comes with financial burden, when choosing a plugin in Barbican to store the Master-KEK or choosing to integrate another Key Manager service instead. +To minimize the burden and enable more CSPs to step up and provide encryption, this standard will only make recommendations about plugins from Barbican. ### Options considered From 725d37fa0a5e90474dad947e0d3c17ea56dd2c88 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Wed, 21 Aug 2024 15:34:23 +0200 Subject: [PATCH 28/30] Update scs-XXXX-wN-key-manager-implementation-testing.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- Standards/scs-XXXX-wN-key-manager-implementation-testing.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md index 32305eb8f..c9b7a4dd0 100644 --- a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md +++ b/Standards/scs-XXXX-wN-key-manager-implementation-testing.md @@ -22,6 +22,12 @@ There are also software HSMs available, that should be tested for their integrat Other Plugins in Barbican are the KMIP plugin and Vault[^1]. They are storing the keys differently and CSPs need to make sure, that the access to the keys is configured securely. +:::tip + +Barbican supports deploying out-of-tree drivers what enables operators to satisfy their specific needs. + +::: + [^1]:[Barbican Plugins](https://docs.openstack.org/barbican/latest/install/barbican-backend.html) ### Policies From b4b6d7e4e3c5915b61d6b03ed96703b5aac88de6 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Mon, 26 Aug 2024 09:45:57 +0200 Subject: [PATCH 29/30] Rename scs-XXXX-vN-key-manager-standard.md to scs-0116-v1-key-manager-standard.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- ...ey-manager-standard.md => scs-0116-v1-key-manager-standard.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename Standards/{scs-XXXX-vN-key-manager-standard.md => scs-0116-v1-key-manager-standard.md} (100%) diff --git a/Standards/scs-XXXX-vN-key-manager-standard.md b/Standards/scs-0116-v1-key-manager-standard.md similarity index 100% rename from Standards/scs-XXXX-vN-key-manager-standard.md rename to Standards/scs-0116-v1-key-manager-standard.md From d103ea33a49e7116b7708694aadd1b27e7ca57f7 Mon Sep 17 00:00:00 2001 From: josephineSei <128813814+josephineSei@users.noreply.github.com> Date: Mon, 26 Aug 2024 09:46:53 +0200 Subject: [PATCH 30/30] Update and rename scs-XXXX-wN-key-manager-implementation-testing.md to scs-0116-w1-key-manager-implementation-testing.md Signed-off-by: josephineSei <128813814+josephineSei@users.noreply.github.com> --- ...ing.md => scs-0116-w1-key-manager-implementation-testing.md} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename Standards/{scs-XXXX-wN-key-manager-implementation-testing.md => scs-0116-w1-key-manager-implementation-testing.md} (98%) diff --git a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md b/Standards/scs-0116-w1-key-manager-implementation-testing.md similarity index 98% rename from Standards/scs-XXXX-wN-key-manager-implementation-testing.md rename to Standards/scs-0116-w1-key-manager-implementation-testing.md index c9b7a4dd0..0ca20bf2e 100644 --- a/Standards/scs-XXXX-wN-key-manager-implementation-testing.md +++ b/Standards/scs-0116-w1-key-manager-implementation-testing.md @@ -4,7 +4,7 @@ type: Supplement track: IaaS status: Proposal supplements: - - scs-XXXX-v1-vN-key-manager-standard.md + - scs-0116-v1-key-manager-standard.md --- ## Implementation