Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks Jiří Novotný Pavel Čeleda Radek Krejčí novotny@ics.muni.cz celeda@ics.muni.cz krejci@liberouter.org DeepSec – In-Depth Security Conference 2010 – November 25, 2010, Vienna, Austria
Part I Motivation Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 2 / 41
World Is Changing Quickly Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 3 / 41
World Is Changing Quickly Cyber security become to be very important . Income from cyber crime is higher than from drugs . Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 3 / 41
World Is Changing Quickly Cyber security become to be very important . Income from cyber crime is higher than from drugs . SPAM, phishing, social engineering, stealing of confidential information and many others. Botnet business (e.g. Chuck Norris botnet). Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 3 / 41
World Is Changing Quickly Cyber security become to be very important . Income from cyber crime is higher than from drugs . SPAM, phishing, social engineering, stealing of confidential information and many others. Botnet business (e.g. Chuck Norris botnet). DDoS attacks against Estonia and Georgia. Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 3 / 41
World Is Changing Quickly Cyber security become to be very important . Income from cyber crime is higher than from drugs . SPAM, phishing, social engineering, stealing of confidential information and many others. Botnet business (e.g. Chuck Norris botnet). DDoS attacks against Estonia and Georgia. Internet is battlefield of today. Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 3 / 41
How Well Do You Know Your Network? Do you know what is happening on your network? Are you sure that your network is secure ? Are you able to detect and prove network incidents? Or does your network looks like Pandora’s box? Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 4 / 41
Network Monitoring in Time Originally Basic functionality Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 5 / 41
Network Monitoring in Time Originally Then Incident handling Basic functionality Network forensics Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 5 / 41
Network Monitoring in Time Originally Then Now Incident handling Intrusion detection Basic functionality Network forensics Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 5 / 41
Present Computer Security Main Issues Huge amount of data passing through network. Huge amount of monitoring data. Software-only monitoring solutions are not fast enough . Many of security tools are too complex for configuration. Hardware appliances are not flexible enough . Data from network devices have no sufficient quality . Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 6 / 41
Our Vision of the Network Security Monitoring System Security Operations Center - SOC 2 NetFlow Deep Packet Lawful Firewall ... Analysis Inspection Interception Rules CSIRT Access Access Network Network 10Gbps 10Gbps 1 1 Core HAMOC HAMOC Network Bad Guys Victims Users HAMOC 1 High-speed acceleration – COMBOv2 hardware accelerator. Flexibility – Server PC box with monitoring software. Security Operations Center. 2 Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 7 / 41
Part II Hardware Accelerated Monitoring Center (HAMOC) Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 8 / 41
HAMOC Goals Makes use of hardware acceleration more user-friendly . Set of third-party tools tunned to work with COMBOv2. Use-cases and best practices how to work with COMBOv2. Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 9 / 41
HAMOC Hardware – COMBOv2 Family COMBOI-1G4 – 4x1 Gb/s COMBOI-10G2 – 2x10 Gb/s COMBOI-10G4TXT – 4x10 Gb/s Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 10 / 41
RAM ... Interface 0 COMBOv2 TX HANIC FW ibuf obuf 10 Gb/s Interface 1 ibuf obuf 10 Gb/s with core Hash-based Packet Distribution 16KiB 16KiB 16KiB RX DMA 1 RX DMA 2 RX 16KiB Acceleration 8 Interface 2 DMA ibuf obuf COMBOv2 card SZE TX NETWORK RX TX Port0 sze0:0 16 KiB Interface 1 DMA BURST/SINGLE 16 KiB 16 KiB packet transfer 64 MiB 64 MiB RX DMA TX DMA 16 KiB DMA Firmware NetCOPE – SDK for the COMBO Hardware Accelerator RX TX PCI express RAM BUS Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 11 / 41
COMBOv2 ibuf TX 8 DMA RX with HANIC FW ibuf obuf 10 Gb/s Interface 1 obuf Acceleration 10 Gb/s Interface 0 16KiB Hash-based Packet Distribution 16KiB 16KiB 16KiB RX DMA 1 RX core 16 KiB 2 Interface 2 DMA ibuf obuf COMBOv2 card SZE TX NETWORK RX TX Port0 sze0:0 16 KiB Interface 1 DMA BURST/SINGLE 16 KiB 16 KiB packet transfer 64 MiB 64 MiB RX DMA TX DMA DMA Firmware NetCOPE – SDK for the COMBO Hardware Accelerator RX TX PCI express RAM BUS Hardware Accelerated NIC (HANIC) Firmware RAM ... Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 11 / 41
applications SZE Linux TCP/IP stack sze0:1 sze0:0 ceth0 ceth1 applications standard interface native ethernet RAM FPGA PCAP applications ceth0 libpcap ceth1 sze0:0 szedata2-cv2 szedata2 built in modules sze0:1 sze0:0 libpcap-sze libsze2 sze0:1 HANIC firmware COMBO card control modules: combov2, combo6core Software Architecture RX TX RX TX Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 12 / 41
Remote Configuration HAMOC Box #1 Security Operations Center NETCONF Agent HAMOC NETCONF Manager Configuration Local Configuration Daemon Datastore SSH connection HAMOC Box #N NETCONF Agent HAMOC Configuration Local Configuration configuration data Daemon Datastore status information, notifications NETCONF Protocol Secured data transport over SSH ( Secure Shell ) version 2. XML data format. Event notifications capability. Separated configuration datastores: startup, running, candidate. Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 13 / 41
Connection to Network HAMOC HAMOC pass 0 on 1 pass 2 on 1 pass 1 on 0 pass 3 on 0 Forward to SW Port 0 Port 1 Port 0 Port 1 TAP In-line Mode 10 Gb/s TAP Mode 10 Gb/s Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 14 / 41
HAMOC – Test Results HANIC Single Port Throughput Results at 10 Gb/s Ethernet 12 120 Measured Throughput Measured CPU Load 10 100 Throughput [Gb/s] 8 80 CPU Load [%] 6 60 4 40 2 20 0 0 64 128 256 512 800 1024 1280 1518 Packet Length [B] Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 15 / 41
HAMOC Summary Based on COMBOv2 hardware accelerators . Uses NetCOPE platform for rapid firmware development . Changing filtering rules without packet loss . Several API for applications (standard stack, PCAP , SZE2 ). Uses third party well known applications (e.g. Wireshark). Simple development of new applications. Remote configuration via NETCONF. Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 16 / 41
Part III Use Cases – Deep Packet Inspection Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 17 / 41
Nanosecond Timestamps – I Motivation COMBOv2 hardware supports nanosecond timestamps . COMBO-LXT RAM correction NTP server algorithm tsuctl (tik.cesnet.cz) Host CLK+PPS CPU Bridge C L PPS K NIC PCIe GPS receiver COMBOL-GPS BUS (GARMIN 18 LVC) Problem libpcap library supports microsecond timestamps only . Wireshark supports nanoseconds PCAP file format. Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 18 / 41
Nanosecond Timestamps – II Solution sze2pcap tool – writes network traffic to wireshark nanosecond PCAP format with nanosecond precision . SZE sze0:0 RAM sze0:1 libsze2 Port 1 Port 0 timestamp timestamp libpcap-sze ss. nsec ss. usec tcpdump, tshark, wireshark sze2pcap TAP 10 Gb/s Ethernet Jiří Novotný et al. Hardware Acceleration: An Essential Part of Cyber Security in High-Speed Networks 19 / 41
Recommend
More recommend
