HEX Switch: Hardware-assisted security extensions of OpenFlow Taejune Park / KAIST / taejune.park@kaist.ac.kr Zhaoyan Xu / StackRox Inc. / z@stackrox.com Seungwon Shin / KAIST / claude@kaist.ac.kr
Software-Defined Networking • Centralized management • Dynamic traffic engineering • Programable network operation • High-compatibility with virtualized environments 2 /36
Software-Defined Networking • Centralized management • Dynamic traffic engineering • Programable network operation Security is still required • High-compatibility with virtualized environments 3 /36
Security in Software-Defined Networking Control-Plane Network Control Apps. Security Apps. Layer Network Application Network Application Network Application Network Application Network Application Security Application Standard Protocol (e.g., OpenFlow) Data-Plane Layer Middle-box 4 /36
Security in Software-Defined Networking •Security applications on a control plane Control-Plane Network Control Apps. Security Apps. • Applying security features network-widely Layer Network Application Network Application Network Application Network Application Network Application Security Application • Cheap price • Easy to manage Standard Protocol (e.g., OpenFlow) Data-Plane Layer Middle-box 5 /36
Security in Software-Defined Networking •Security applications on a control plane Control-Plane Network Control Apps. Security Apps. • Applying security features network-widely Layer Network Application Network Application Network Application Network Application Network Application Security Application • Cheap price • Easy to manage Standard Protocol (e.g., OpenFlow) • Limitation Data-Plane Layer • Simple security only available • Slow-path for inspection Middle-box • Controller overhead 6 /36
Security in Software-Defined Networking Control-Plane Network Control Apps. Security Apps. Layer Network Application Network Application Network Application Network Application Network Application Security Application Standard Protocol (e.g., OpenFlow) •Middle-boxes on a data plane Data-Plane Layer • Better performance • Rich features such as payload inspection • No controller overhead Middle-box 7 /36
Security in Software-Defined Networking Control-Plane Network Control Apps. Security Apps. Layer Network Application Network Application Network Application Network Application Network Application Security Application Standard Protocol (e.g., OpenFlow) • Limitation •Middle-boxes on a data plane Data-Plane Layer • Better performance • Network overhead by traffic detouring (Taking extra hops) • Rich features such as payload inspection • Require flow steering for NFs • No controller overhead Middle-box • Additional control channels for NFs 8 /36
Summary Category SDN Applications Middle-boxes Flexibility Management Deployability Performance Functionality 9 /36
Related works: Extending SDN architecture to support security • Mekky, Hesham, et al. "Network function virtualization enablement within SDN data plane.” IEEE INFOCOM 2017 (Also, HotSDN 2014) • Sonchack, John, et al. "Enabling Practical Software-defined Networking Security Applications with OFX." NDSS 2016. 10 /36
Related works: • Their security functions are not fully consolidated Extending SDN architecture to support security into a data plane • Mekky, Hesham, et al. "Network function • Application module, Tap-based interface… virtualization enablement within SDN data plane.” IEEE INFOCOM 2017 (Also, HotSDN 2014) • Sonchack, John, et al. "Enabling Practical Software-defined Networking Security Applications with OFX." NDSS 2016. 11 /36
Related works: Extending SDN architecture to support security • In essence, they are NOT different from the middle-box structure! • Mekky, Hesham, et al. "Network function • It's just a scale down! virtualization enablement within SDN data plane.” IEEE INFOCOM 2017 (Also, HotSDN 2014) • Sonchack, John, et al. "Enabling Practical Software-defined Networking Security Applications with OFX." NDSS 2016. 12 /36
Related works: UNISAFE: A union of security actions for software switches Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization. ACM, 2016 • Fully integrated security functions into a data plane, not modular one •Security functions as a set of OpenFlow actions UNISAFE (based on Open vSwitch) Flow table Execute actions MATCH Actions Flow_A sec_dos(mbps=100) , output:2 Lookup Flow table Security actions sec_dos(mbps=500),sec_scan(…) ,output:3 Flow_B 13 /36
Security actions of UNISAFE • High-compatibility with common OpenFlow actions - actions=sec_dos(mbps=1000),set_nw_src(…),output:2 • Fine-grained security enforcement per a flow - in_port=1,nw_src=10.0.0.1,tp_dst=80,actions=sec_dos(…),… - in_port=2,nw_dst=10.0.1.2,actions=sec_dpi(…),… • Easy configuration for a security service chaining - actions=sec_dos(…),sec_scan(…),sec_dpi(…),… 14 /36
Performance in UNISAFE • Achieve line-rate latency for all security Throughput 110 forwarding dos scan1 100 scan5 dpi100 dpi500 90 dpi1000 • But, lack of throughput in some actions 80 70 •Payload Inspection (DPI) throughput Throughput(%) 60 ⁃ Throughput less than 100Mbps on 1Gbps 50 40 30 20 10 0 1 10 50 100 500 1000 Bandwidth(Mbps) 15 /36
Performance in UNISAFE • Achieve line-rate latency for all security Throughput 110 forwarding dos scan1 100 scan5 dpi100 dpi500 90 dpi1000 • But, lack of throughput in some actions 80 Challenge 1: 70 •Payload Inspection (DPI) throughput Throughput(%) 60 Performance limitation ⁃ Throughput less than 100Mbps on 1Gbps 50 40 30 20 10 0 1 10 50 100 500 1000 Bandwidth(Mbps) 16 /36
Security operation in UNISAFE • Manual operation for security violations by an administrator ? Controller Manual Operation 17 /36
Security operation in UNISAFE • Manual operation for security violations by an administrator ? Challenge 2: Security operation Controller Manual Operation 18 /36
HEX Switch: Hardware-assisted security extensions of OpenFlow • Hardware-based approach for UNISAFE • Using NetFPGA • Providing line-rate performance with configurability Controller Security Actions Security Policy communication 19 /36
Intf. 2 Buffering (BRAM) Input Arbiter + Output queue Action processor Host Intf. Intf. 3 Intf. 1 Intf. 0 Inspection Data Storage Update Data Storage Read (Input selection) < HEX Security Processor > Intf. 1 (Forwarding) Policy Decision Intf. 0 Packet preprocessor Intf. 2 Intf. 3 Host Intf. Flow Table Controller Data Storage Design • Security Processor between the packet processing sequence. • Six-stages pipeline: Mainly consist of data storage and inspection logic • Flow table controller forwards flow keys, stats and action key after matching g s M t r e l Input output A s t a y Stage 1 Stage 2 Stage 3 Stage 4-5 Stage 6 t s e k , y y n e e o k k i t w w c o A o l l F F & Packet Packet bu ff er 20 /36
Flow Table Controller (Input selection) Input Arbiter + Output queue Action processor Host Intf. Intf. 3 Intf. 2 Intf. 1 Intf. 0 Inspection Data Storage Data Storage Data Storage Read Update Buffering Intf. 0 < HEX Security Processor > (Forwarding) Policy Decision Packet preprocessor (BRAM) Intf. 1 Intf. 2 Intf. 3 Host Intf. Flow Table Controller Design • Security Processor between the packet processing sequence. • Six-stages pipeline: Mainly consist of data storage and inspection logic • Flow table controller forwards flow keys, stats and action key after matching g s M t r e l Input output A s t a y Stage 1 Stage 2 Stage 3 Stage 4-5 Stage 6 t s e k , y y n e e o k k i t w w c o A o l l F F & Packet Packet bu ff er 21 /36
(BRAM) Host Intf. Data Storage Inspection Intf. 0 Intf. 1 Intf. 2 Intf. 3 Action processor Data Storage Update Data Storage Read (Forwarding) Policy Decision Input Arbiter + Output queue Update Data Storage Read Intf. 1 Data Storage (Input selection) Packet preprocessor Intf. 0 Data Storage Intf. 2 Intf. 3 Host Intf. Flow Table Controller < HEX Security Processor > Buffering (BRAM) Design • Security Processor between the packet processing sequence. • Six-stages pipeline: Mainly consist of data storage and inspection logic • Flow table controller forwards flow keys, stats and action key after matching g s M t r e l Input output A s t a y Stage 1 Stage 2 Stage 3 Stage 4-5 Stage 6 t s e k , y y n e e o k k i t w w c o A o l l F F & Packet Packet bu ff er 22 /36
Recommend
More recommend
