Addressing Shortcomings of Existing DDoS Protection Software Using - - PowerPoint PPT Presentation

▶
addressing shortcomings of existing ddos protection
SMART_READER_LITE
LIVE PREVIEW

Addressing Shortcomings of Existing DDoS Protection Software Using - - PowerPoint PPT Presentation

Apr 10, 2024 200 likes •679 views

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking SSP 2018, Hildesheim Lukas Ifflnder , Stefan Geissler, Jrgen Walter, Lukas Beierlieb, Samuel Kounev 08.11.2018

slide-1
SLIDE 1

http://se.informatik.uni-wuerzburg.de/ SSP 2018, Hildesheim

Addressing Shortcomings

  • f Existing DDoS Protection Software

Using Software-Defined Networking

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 08.11.2018

slide-2
SLIDE 2

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 2

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Motivation

  • No definite defense possible, only mitigation
  • Long time security threat
  • More dangerous than ever:
  • Increasing number of IoT devices
  • Generally lower security level
  • Marginal performance increase of defense

systems hardware Need for more effective mitigation approaches

slide-3
SLIDE 3

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 3

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

EXPLANATION

SYN Flood

slide-4
SLIDE 4

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 4

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

TCP

  • TCP is a reliable transport protocol:
  • Retransmission of lost packets
  • Sorting of out-of-order packets
  • Sequence number on every packet is

necessary

  • Initial sequence numbers are established

in a three-way handshake

slide-5
SLIDE 5

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 5

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

TCP Handshake

Client Server

slide-6
SLIDE 6

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 6

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SYN Flood

Client Server

Backlog:

TCB sIP1 TCB sIP1 TCB sIP2 TCB sIP1 TCB sIP2 TCB sIP3 TCB sIP1 TCB sIP2 TCB sIP3 TCB sIP4

slide-7
SLIDE 7

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 7

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SYN Flood Explanation

  • Attacker can spoof any source IP address
  • Server has to create TCB and keep it for a while
  • SYN packets are small:
  • 14 byte (Ethernet header) + 20 byte (IP header) + 20 byte (TCP header) = 54 byte
  • 1 Mbit/s can transport 2314 pps
  • 1 Mpps requires 432 Mbit/s
slide-8
SLIDE 8

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 8

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

EXISTING DEFENSE MECHANISMS

SYN Flood

slide-9
SLIDE 9

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 9

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SYN Cookies

Client Server

MSS

  • ption

time mod 32 crypt. HASH source IP/Port dest. IP/Port

5 3 24

calculate expected cookie, compare with ackn-1

slide-10
SLIDE 10

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 10

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SYN Cookies

  • Amount of half-open connections not limited by backlog
  • CPU is burdened with hash calculations
  • TCP options are restricted
  • Only active when backlog is full
slide-11
SLIDE 11

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 11

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SYN PROXY – Connection Establishment

Client SYN PROXY Server

slide-12
SLIDE 12

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 12

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SYN PROXY – Data Transfer

Client SYN PROXY Server

slide-13
SLIDE 13

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 13

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SYN PROXY

  • Implemented as an IPtables module
  • Does not have to run on target machine
  • Only complete handshakes reach target
  • Proxy cannot predetermine server’s ISN
  • seqn/ackn translation always necessary
slide-14
SLIDE 14

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 14

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Limitations

SYN Cookies

  • Has to run on service host
  • No independent scaling

SYN PROXY

  • Stateful
  • Network bottle neck
  • Independent scaling complex
slide-15
SLIDE 15

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 15

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

In a Nutshell

  • Problem:
  • Existing solutions can not easily be scaled indepentently from the service host
  • Idea:
  • Complete handshake in proxy
  • Route subsequent packets directly
  • Benefit:
  • Server handles only established connections
  • Proxy can specialize on handshake handling
  • Action:
  • Develop proxy network function, utilize SDN, modify server kernel
slide-16
SLIDE 16

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 16

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SDN/NFV APPROACH

SYN Flood

slide-17
SLIDE 17

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 17

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SDN and NFV

Software Defined Networking

  • SDN switches’ behavior is determined by

a set of flows

  • SDN controller modify and monitor flow

sets of connected switches

  • A flow consists of:
  • Match
  • Action
  • Stats

Network Function Virtualization

  • Network functions modify packets not

addressed to them

  • Firewall
  • Switch
  • IDS
  • Virtualized NF is running on COTS

hardware (instead of being an ASIC)

slide-18
SLIDE 18

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 18

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SDN/NFV Approach

Server Gateway Attacker Client

Traditional network

slide-19
SLIDE 19

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 19

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SDN/NFV Approach

Server Gateway Attacker Client OF-switch Controller VNF

SDN enabled network

slide-20
SLIDE 20

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 20

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SDN/NFV Approach

Server Gateway Attacker Client OF-switch Controller VNF

Prio Match Action GW VNF SERV VNF VNF GW 1 VNF, daddr=s_ip SERV

slide-21
SLIDE 21

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 21

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SDN/NFV Approach

Server Gateway Attacker Client OF-switch Controller VNF

Attacker sends SYN packets with spoofed addresses

Prio Match Action GW VNF SERV VNF VNF GW 1 VNF, daddr=s_ip SERV

SYN

SYN ACK

slide-22
SLIDE 22

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 22

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

SDN/NFV Approach

Server Gateway Attacker Client OF-switch Controller VNF

Client opens connection

Prio Match Action GW VNF SERV VNF VNF GW 1 VNF, daddr=s_ip SERV

SYN

SYN ACK

ACK SYN+

SYN ACK

ACK REST OF

10 GW, from client SERV 10 SERV, to client GW

data data

slide-23
SLIDE 23

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 23

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

IMPLEMENTATION

slide-24
SLIDE 24

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 24

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Implementation: Kernel Modification

  • Simple concept
  • Only 8 lines of code
  • Kernel recompilation necessary
  • Complete handshake required
slide-25
SLIDE 25

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 25

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Implementation: VNF

VNF is split in DPDK application and Python application DPDK:

  • Handshaking

Python:

  • REST requests
  • (HTTP flood defense)
slide-26
SLIDE 26

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 26

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

INITIAL EVALUATION

slide-27
SLIDE 27

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 27

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Virtual Testbed

slide-28
SLIDE 28

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 28

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Testing Methodology

  • Attacker floods SYN packets with delay between each packet
  • Client sends 50 SYN packets in 0.5s intervals
  • Score is the amount of answered client SYN packets
slide-29
SLIDE 29

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 29

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

First Results

  • Promising results for first implementation
  • Feasability of idea verified

No Protection SYN Cookies Our Approach AVG Successfull Connections out

  • f 50

35 30.2

slide-30
SLIDE 30

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 30

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Limitations

  • Client starts sending packets right after SYN-ACK
  • At that moment still outstanding
  • Connection establishment with server
  • Adaptation of SDN-Configuration
  • First packets are lost and have to be retransmitted.
slide-31
SLIDE 31

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 31

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

CONCLUSION & FUTURE WORK

slide-32
SLIDE 32

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 32

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Conclusion

  • Approach to use SDN to mitigate SYN-Flood attacks
  • Only complete handshakes reach service
  • VNF only responsible for establishing new connection
  • Performant because of DPDK
  • Scalable, since there are no dependencies and stateless
slide-33
SLIDE 33

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 33

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Future Work

  • Evaluation with hardware NICs
  • Comparison between different archetectures for multi core
  • Move Kernel modification in standalone module
  • Analyze how to circumvent packet-loss problem
  • On demand enabling
  • Click & Use deployment (Docker/VM/Ansible)
slide-34
SLIDE 34

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 34

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Thank you for your attention!

Phone: +49 (931) 31 89947 Mail: lukas.ifflaender@uni-wuerzburg.de Web: https://go.uniwue.de/ifflaender

slide-35
SLIDE 35

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 35

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Bibliography

...

slide-36
SLIDE 36

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 36

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

BACKUP

slide-37
SLIDE 37

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 37

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Implementation: Kernel Modification

from net/ipv4/tcp_ipv4.c:

static u32 tcp_v4_init_seq(const struct sk_buff *skb) { return secure_tcp_seq(ip_hdr(skb)->daddr, ip_hdr(skb)->saddr, tcp_hdr(skb)->dest, tcp_hdr(skb)->source); }

slide-38
SLIDE 38

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 38

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Implementation: Kernel Modification

static u32 tcp_v4_init_seq(const struct sk_buff *skb) { struct tcphdr *tcph; unsigned char *payload_start, *payload_end; tcph = tcp_hdr(skb); payload_start = (unsigned char *)((unsigned char *)tcph+(tcph->doff * 4)); payload_end = skb_tail_pointer(skb); if (payload_end - payload_start == 4) return cpu_to_be32(*((u32 *)payload_start)); return secure_tcp_seq(ip_hdr(skb)->daddr, ip_hdr(skb)->saddr, tcp_hdr(skb)->dest, tcp_hdr(skb)->source); }

slide-39
SLIDE 39

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 39

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

DPDK Features

  • Poll-mode, userspace NIC drivers
  • Lockless ringbuffer
  • Cryptographic library
  • Packet processing library (e.g. Fragmentation)
  • Kernel Network Interfaces
  • Hugepage support (and requirement) for less TLB misses
  • Thread-to-core pinning
  • NUMA support
slide-40
SLIDE 40

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 40

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

DPDK Application

slide-41
SLIDE 41

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 41

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Python application

SYN Flood Defense

  • Translates address and port from pipe

into flow modification REST request

HTTP Flood Defense

  • Monitor flow statistics
  • Aggregate per IP address
  • Requeue suspicious addresses
slide-42
SLIDE 42

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 42

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

NICs and Drivers

NIC base addr length head tail RAM mempool descriptor ring pool addr 0 pool addr 1 pool addr 2 pool addr 3

T H

slide-43
SLIDE 43

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 43

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Kernel Modification Validation

echo -n -e '\x01\x23\x45\x67' > payload hping3 --count 1 --syn --dest-port 80 --data 4 --file payload 192.168.0.10

slide-44
SLIDE 44

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 44

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Kernel Modification Validation

slide-45
SLIDE 45

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 45

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

Kernel Modification Validation

slide-46
SLIDE 46

Lukas Iffländer, Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 46

Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking

THREADS Validation