Mathieu Blanc
Commissariat à l'énergie atomique et aux énergies alternatives
Network
Latest external collaboration on country level. Dive into details by clicking on the dots.
Publication
Featured researches published by Mathieu Blanc.
collaboration technologies and systems | 2006
Mathieu Blanc; Jérémy Briffaut; Patrice Clemente; M.G. El Rab; Christian Toinard
Security Management is becoming a critical aspect for large scale distributed systems. In this paper, we propose a global architecture, based on an original meta-policy approach for access control and intrusion detection, allowing to guarantee global security properties. In contrast with classical meta-policy based systems, by applying verification techniques on the meta-policy, our solution guarantees global security properties while supporting local updates of the security policy. It is thus a powerful solution that provides strong fault tolerance since the control is carried out in a complete decentralized manner. By using a meta-policy, the system can verify the respect of global security properties after meta or local modifications of the policy. Thanks to test components, our system is also able to evaluate and configure in real-time each of its functionalities while tracking self corruption by malicious hackers. Our architecture is a cooperative multi agent-based system, making it possible to activate a functionality independently from some others. It is divided into several levels, each one contributing to the automation of the security management.
Future Generation Computer Systems | 2013
Mathieu Blanc; Jean-François Lalande
hpc clusters are costly resources, hence nowadays these structures tend to be co-financed by several partners. A cluster administrator has to be designated, whose duties include, amongst others, the prevention of accidental data leakage or theft. Linux has been chosen as an operating system for the CEAs computing platforms. However, strong system security solutions such as SELinux are usually difficult to set up in large environments. This article presents how we have adapted a mac mechanism in order to enforce confidentiality and integrity between a large number of users. First we define our security objectives, and show how they direct our technical choices. Then we present how confinement was achieved using the SELinux security mechanism, and how various attack scenarios were addressed. We then focus on the use of Mandatory Categories, access control on high bandwidth network filesystems and the integration of new users and applications. We discuss some residual technical challenges. Finally, we present benchmark results and validate the acceptable performance impact of our deployment on a modern cluster.
Archive | 2014
Mathieu Blanc; Aline Bousquet; Jérémy Briffaut; Laurent Clevy; Damien Gros; Arnaud Lefray; Jonathan Rouzaud-Cornabas; Christian Toinard; Benjamin Venelle
In order to guarantee security properties, such as confidentiality and integrity, cryptographic mechanisms provide encryption and signature of data, but protection is required to control the data accesses. The recent attacks on Facebook and Twitter show that the protection must not be limited to the infrastructure i.e. the hosts and the guest virtual machines.
international conference on emerging security information, systems and technologies | 2009
Jérémy Briffaut; Jean-François Lalande; Christian Toinard; Mathieu Blanc
This paper focuses on the enforcement of security properties fitting with dynamic Mandatory Access Control policies. It adds complementary results to previous works of the authors in order to better address dynamic policies. Previous works of the authors provide several advances for enforcing the security of MAC system.An administration language for formalizing a large set of security properties is available to system administrators. That language uses several flow operators and ease the formalization of the required security properties. A solution is also available for computing the possible violations of any security property that can be formalized using our language. That solution computes several flow graphs in order to find all the allowed activities that can violate the requested properties. That paper addresses remaining problems related to the enforcement of the same kind of properties but with dynamic MAC policies. Enforcement is more much complex if we consider dynamic policies since the states of those policies are theoretically infinite. A new approach is proposed for dynamic MAC policies. The major idea is to use a meta-policy language for controlling the allowed evolutions of those dynamic policies. According to those meta-policy constraints, the computation problem becomes easier. The proposed solution adds meta-nodes within the considered flow graphs. A general algorithm is given for computing the required meta-nodes and the associated arcs. The proposed meta-graphs provide an overestimation of the possible flows between the different meta-nodes. The computation of the possible violations within the allowed dynamic policies is thus allowed. Several concrete security properties are considered using regular expressions for identifying the requested meta-contexts. The resulting violations, within the allowed meta-graphs, are computed and real violations are presented.
collaboration technologies and systems | 2006
Mathieu Blanc; Jérémy Briffaut; Christian Toinard
This paper1 presents a new infrastructure based on a novel meta-policy approach. This solution allows to deploy a MAC kernel within a distributed system. It is a completely decentralized solution that has strong fault tolerance properties. Despite a local control of the updates, each local policy satisfies global security properties. Our IDS approach add new security properties. It prevents any accidental or malicious update of the local policies. Moreover, the collaboration between the meta-policy and our IDS system enables to detect illegal sequences of legal operations.
collaboration technologies and systems | 2009
Mathieu Blanc; Kevin Guerin; Jean-François Lalande; Vincent Le Port
This paper proposes a technical solution for protecting users using a shared NFS service possibly controlled by a malicious user. The main goal is to protect the integrity and confidentiality of users resources. Moreover, we propose to solve a more difficult challenge: how to prevent a malicious user from exploiting a supposed NFS vulnerability in order to read or write the resources of another user? Thus, this paper assumes that a vulnerability might exist in the NFS protocol or software components that gives the ability to a malicious user to execute any arbitrary code on the NFS server. Technical details about the implantation of Mandatory Access Control mechanisms with Multi Categories on the server side are given. The proposed solution avoids heavy modifications of the clients and only relies on the authentication of these clients.
Proceedings of the first workshop on Changing landscapes in HPC security | 2013
Mathieu Blanc; Damien Gros; Jérémy Briffaut; Christian Toinard
The protection of High Performance Computing architectures is still an open research problem. Generally, current solutions only feature confinement using sandboxing but none address the problematic of information flow control. This is why a better integration of mandatory access control mechanisms is needed in the HPC environment. In this paper, we propose a global architecture to protect a whole cluster. This architecture uses the specific cluster technologies in order not to reduce the operating system performances. The protection of the cluster relies on three levels of protection and the use of two kinds of reference monitors. SELinux is installed on the computing nodes and deals with direct information flows. PIGA, only installed on a specific node, performs advanced flow control and detects advanced threats. We present the various components of our architecture called PIGA-Cluster, then the results of several benchmarks on a computing node that show a low impact on the operating system performances. We also apply various security properties in order to protect the computing nodes against simple and advanced attacks. This paper takes advantage of previous works dealing with workstations or virtualisation technologies and extends the concepts for the HPC environment.
international conference on high performance computing and simulation | 2010
Mathieu Blanc; Jean-François Lalande
Protecting a HPC cluster against real world cyber threats is a critical task, with the increasing trend to open and share computing resources. As partners can upload data that is confidential regarding other partners, a company managing a shared cluster has to enforce strong security measures. It has to prevent both accidental data leakage and voluntary data stealing. When using an operating system based on Linux, the offered protections are difficult to set up in large scale environments. This article presents how to use the Mandatory Access Control feature of SELinux in order to guarantee strong security properties for HPC clusters. The proposed solution is based on the use of the Multi-Category System, the confinement of user profiles and the use of a dual SSH server. The issues encountered during the implementation and the most difficult technical points are presented. Finally, this paper shows experimental results about the performance of our solution and the impact on a large scale cluster.
Journal of Computers | 2009
Mathieu Blanc; Patrice Clemente; Jonathan Rouzaud-Cornabas; Christian Toinard
This paper deals with the classification of malicious activities occurring on a network of SELinux hosts. SELinux system logs come from a high interaction distributed honeypot. An architecture is proposed to compute those events in order to assemble system sessions, such as malicious ones. Afterwards, recognition mechanisms are proposed to classify those activities. The paper presents the classification architecture using comprehensive examples. It is the first solution that supports SELinux sessions. In contrast with previous works, distributed sessions are better addressed using only SELinux logs. The results of experiments use real samples taken from our honeypot. A high performance architecture enables to compute a large amount of events captured during one year on our high interaction honeypot. Our approach enables the real-time reconstruction of system sessions. Moreover, sessions are compared to patterns in order to classify them according to specific attacks. The paper shows that the classification can be done in a linear time. An automatic recognition of new patterns is proposed.
cluster computing and the grid | 2012
Damien Gros; Mathieu Blanc; Jérémy Briffaut; Christian Toinard
Assessing the impact of Mandatory Access Control (MAC) integration in the Linux kernel performance is still an open problem. Regarding the specific paradigm of MAC in High Performance Computing, there are actually few works. Yet, guaranteeing security properties on a shared cluster is both a necessity and a challenge. This is a necessity because it is mandatory to ensure the confidentiality and integrity of data computed by the users, and a challenge because a cluster is a costly resource built with performance in mind. This paper deals with the need to integrate MAC in Linux-based operating systems for HPC clusters in an efficient way.