Jobber Automating Inter-Tenant Trust in The Cloud Andy Sayler - - PowerPoint PPT Presentation

▶
jobber
SMART_READER_LITE
LIVE PREVIEW

Jobber Automating Inter-Tenant Trust in The Cloud Andy Sayler - - PowerPoint PPT Presentation

Jun 25, 2023 393 likes •1.01k views

Jobber Automating Inter-Tenant Trust in The Cloud Andy Sayler Eric Keller Dirk Grunwald How can we make the Data Center... more efficient? more secure? more manageable? Over 50% Enterprise Companies Use Cloud Infrastructure* * Cohen,

slide-1
SLIDE 1

Jobber

Automating Inter-Tenant Trust in The Cloud

Andy Sayler Eric Keller Dirk Grunwald

slide-2
SLIDE 2

How can we make the Data Center... more efficient? more secure? more manageable?

slide-3
SLIDE 3

* Cohen, Reuven. The Cloud Hits the Mainstream: More than Half of U.S. Businesses Now Use Cloud

  • Computing. Forbes. April 16th, 2013.

Over 50%

Enterprise Companies Use Cloud Infrastructure*

slide-4
SLIDE 4

* BALLANI, H., JANG, K., AND KARAGIANNIS, T. Chatty Tenants and the Cloud Network Sharing Problem.

  • Proc. of NSDI (2013).

10% to 40%

  • f all Data Center Traffic

is Inter-Tenant Traffic*

slide-5
SLIDE 5

Ad Network ↔ Web Host CDN ↔ ISP NSA ↔ Google, Yahoo, Etc

slide-6
SLIDE 6

Tenant A Tenant B Tenant C

emphasis is on isolation hindering inter-tenant traffic

slide-7
SLIDE 7

all traffic is untrusted

Tenant A Tenant B Tenant C

slide-8
SLIDE 8

Tenant A Tenant B Tenant C

manual static configuration

slide-9
SLIDE 9

misconfiguration

is a major security problem

Tenant A Tenant B Tenant C

slide-10
SLIDE 10

Tenant A Tenant B Tenant C

extra overhead untapped potential prone to error

slide-11
SLIDE 11

Tenant A Tenant B Tenant C

  • ptimize trusted traffic
slide-12
SLIDE 12

Tenant A Tenant B Tenant C

  • ptimize trusted traffic

while filtering untrusted traffic

slide-13
SLIDE 13

Tenant A Tenant B Tenant C

automatically

slide-14
SLIDE 14

Jobber

a dynamic network security architecture designed to handle the volatile nature of the cloud and the desire for

  • ptimized inter-tenant communication
slide-15
SLIDE 15

Jobber Components

slide-16
SLIDE 16

How can we

securely

designate trusted and untrusted traffic?

slide-17
SLIDE 17

trust networks

slide-18
SLIDE 18

Introduction Based Routing* Social Relationships Behavioral Reputation ...

* FRAZIER, G., DUONG, Q., WELLMAN, M., AND PETERSEN, E. Incentivizing responsible networking via introduction-based routing. Trust and Trustworthy Computing 6740 (2011).

slide-19
SLIDE 19

Introduction Based Routing

Host Q Host M Host G

slide-20
SLIDE 20

Introduction Based Routing

Host Q Host M Host G

slide-21
SLIDE 21

Introduction Based Routing

Host Q Host M Host G

slide-22
SLIDE 22

Introduction Based Routing

Host Q Host M Host G

X

slide-23
SLIDE 23

How can we

automatically

ascertain and track reputation?

slide-24
SLIDE 24

sensor frameworks

slide-25
SLIDE 25

Open Source Frameworks (nagios, ...) Platform-Specific Frameworks (Amazon CloudWatch, ...) Custom Solutions (Big Data analytic tools, ..)

slide-26
SLIDE 26

Jobber Sensor Framework

Data Collection Interface Intrusion Detection System Host System Logs Firewall Alerts

...

Router Status Etc

slide-27
SLIDE 27

Jobber Sensor Framework

Data Collection Interface Intrusion Detection System Host System Logs Firewall Alerts

...

Router Status Etc Sampling and Throttling Layer Behavior Classification Layer

slide-28
SLIDE 28

Jobber Sensor Framework

Data Collection Interface Intrusion Detection System Host System Logs Firewall Alerts

...

Router Status Etc Sampling and Throttling Layer Behavior Classification Layer Tenant Reputation Database Tenant Aggregation Layer

slide-29
SLIDE 29

Jobber Sensor Framework

Data Collection Interface Intrusion Detection System Host System Logs Firewall Alerts

...

Router Status Etc Sampling and Throttling Layer Behavior Classification Layer Tenant Reputation Query Interface Tenant Reputation Database

Jobber Server

Tenant Aggregation Layer

slide-30
SLIDE 30

How can we

control

network and resource access?

slide-31
SLIDE 31

programmable routing

slide-32
SLIDE 32

Standardized Interfaces (OpenFlow, MPLS, GRE, ...) Cloud Platforms (EC2, OpenStack, ...) Vendor Systems (Cisco, HP, ...)

slide-33
SLIDE 33
slide-34
SLIDE 34

Jobber Architectures

slide-35
SLIDE 35

Data Center

Legacy vs Future

Host

Modified vs Unmodified

Jobber Routing

Active vs Passive

IBR

Distributed vs Centralized

slide-36
SLIDE 36

Legacy Data Center

Host Aware

slide-37
SLIDE 37

Virtual Machine Security Middlebox Jobber Client Jobber Server

Tenant A

Local Firewall Local Apps Virtual Machine Jobber Client Local Firewall Local Apps

Tenant B

Virtual Machine Jobber Client Local Firewall Local Apps Jobber Server Security Middlebox

slide-38
SLIDE 38

Virtual Machine Security Middlebox Jobber Client Jobber Server

Tenant A

Local Firewall Local Apps Virtual Machine Jobber Client Local Firewall Local Apps

Tenant B

Virtual Machine Jobber Client Local Firewall Local Apps Jobber Server Security Middlebox 1

slide-39
SLIDE 39

Virtual Machine Security Middlebox Jobber Client Jobber Server

Tenant A

Local Firewall Local Apps Virtual Machine Jobber Client Local Firewall Local Apps

Tenant B

Virtual Machine Jobber Client Local Firewall Local Apps Jobber Server Security Middlebox 1 2

slide-40
SLIDE 40

Virtual Machine Security Middlebox Jobber Client Jobber Server

Tenant A

Local Firewall Local Apps Virtual Machine Jobber Client Local Firewall Local Apps

Tenant B

Virtual Machine Jobber Client Local Firewall Local Apps Jobber Server Security Middlebox 1 2 3

slide-41
SLIDE 41

Legacy

Aware

Legacy

Agnostic

SDN

Agnostic

Deployable Today Yes Unmodified Host No Passive Routing No Central IBR Coordination No

slide-42
SLIDE 42

Legacy Data Center

Host Unaware

slide-43
SLIDE 43

Virtual Machine Security Middlebox Jobber Server

Tenant A

Local Firewall Local Apps Virtual Machine Local Firewall Local Apps

Tenant B

Virtual Machine Local Firewall Local Apps Jobber Server Security Middlebox VPC Router VPC Router Sensor Framework Sensor Framework

slide-44
SLIDE 44

Virtual Machine Security Middlebox Jobber Server

Tenant A

Local Firewall Local Apps Virtual Machine Local Firewall Local Apps

Tenant B

Virtual Machine Local Firewall Local Apps Jobber Server Security Middlebox 1 VPC Router VPC Router Sensor Framework Sensor Framework

slide-45
SLIDE 45

Virtual Machine Security Middlebox Jobber Server

Tenant A

Local Firewall Local Apps Virtual Machine Local Firewall Local Apps

Tenant B

Virtual Machine Local Firewall Local Apps Jobber Server Security Middlebox 1 2 VPC Router VPC Router Sensor Framework Sensor Framework

slide-46
SLIDE 46

Virtual Machine Security Middlebox Jobber Server

Tenant A

Local Firewall Local Apps Virtual Machine Local Firewall Local Apps

Tenant B

Virtual Machine Local Firewall Local Apps Jobber Server Security Middlebox 1 2 3 VPC Router VPC Router Sensor Framework Sensor Framework

slide-47
SLIDE 47

Legacy

Aware

Legacy

Agnostic

SDN

Agnostic

Deployable Today Yes Yes Unmodified Host No Yes Passive Routing No No Central IBR Coordination No No

slide-48
SLIDE 48

SDN Data Center

Host Unaware

slide-49
SLIDE 49

Virtual Machine Security Middlebox Jobber Server

Tenant A

Local Firewall Local Apps Virtual Machine Local Firewall Local Apps

Tenant B

Virtual Machine Local Firewall Local Apps Jobber Server Security Middlebox Provider SDN Switch Provider SDN Controller Provider Jobber Client

Data Center Network

Sensor Framework Sensor Framework

slide-50
SLIDE 50

Virtual Machine Security Middlebox Jobber Server

Tenant A

Local Firewall Local Apps Virtual Machine Local Firewall Local Apps

Tenant B

Virtual Machine Local Firewall Local Apps Jobber Server Security Middlebox 1 Provider SDN Switch Provider SDN Controller Provider Jobber Client

Data Center Network

Sensor Framework Sensor Framework

slide-51
SLIDE 51

Virtual Machine Security Middlebox Jobber Server

Tenant A

Local Firewall Local Apps Virtual Machine Local Firewall Local Apps

Tenant B

Virtual Machine Local Firewall Local Apps Jobber Server Security Middlebox 1 2 Provider SDN Switch Provider SDN Controller Provider Jobber Client

Data Center Network

Sensor Framework Sensor Framework

slide-52
SLIDE 52

Virtual Machine Security Middlebox Jobber Server

Tenant A

Local Firewall Local Apps Virtual Machine Local Firewall Local Apps

Tenant B

Virtual Machine Local Firewall Local Apps Jobber Server Security Middlebox 1 2 3 Provider SDN Switch Provider SDN Controller Provider Jobber Client

Data Center Network

Sensor Framework Sensor Framework

slide-53
SLIDE 53

Legacy

Aware

Legacy

Agnostic

SDN

Agnostic

Deployable Today Yes Yes No Unmodified Host No Yes Yes Passive Routing No No Yes Central IBR Coordination No No Yes

slide-54
SLIDE 54

Current Status

slide-55
SLIDE 55

Complete Multi-Architecture Design Proof-of-concept Prototype In Progress Full-system Prototype for SDN Arch. Partial Prototypes for Legacy Archs. To Do Performance Analysis & Evaluation Usability Analysis & Evaluation

slide-56
SLIDE 56

How can we make the datacenter... more efficient? more secure? more manageable?

slide-57
SLIDE 57

Jobber Provides... efficiency

via direct inter-tenant communication

security

via introduction-based-routing

manageability

via automatic network control

slide-58
SLIDE 58

Questions

slide-59
SLIDE 59

Graduated or Binary Trust Designations? Acceptable Overhead? Performance Requirements? Best Architecture? Jobber as a Service? Economics of IBR?