Policy Routing using Process-Level Identifiers IEEE International - - PowerPoint PPT Presentation

▶
policy routing using process level identifiers
SMART_READER_LITE
LIVE PREVIEW

Policy Routing using Process-Level Identifiers IEEE International - - PowerPoint PPT Presentation

May 03, 2023 482 likes •1.31k views

Policy Routing using Process-Level Identifiers IEEE International Symposium on Software Defined Systems April 4th, 2016, Berlin, Germany Oliver Michel, Eric Keller Networking and Security Research Group Network Policies 2 Network Policies

slide-1
SLIDE 1

IEEE International Symposium on Software Defined Systems

April 4th, 2016, Berlin, Germany

Oliver Michel, Eric Keller

Networking and Security Research Group

Policy Routing using Process-Level Identifiers

slide-2
SLIDE 2

Network Policies

2

slide-3
SLIDE 3

Network Policies

2

Load Balancing

slide-4
SLIDE 4

Network Policies

2

Address Translation

slide-5
SLIDE 5

Network Policies

2

Intrusion Detection

slide-6
SLIDE 6

Network Policies

2

Firewalling

slide-7
SLIDE 7

Limited Identifiers

3

IP

Ethernet TCP/UDP

slide-8
SLIDE 8

Limited Identifiers

3

IP

Ethernet TCP/UDP

Source Destination EtherType

slide-9
SLIDE 9

Limited Identifiers

3

IP

Ethernet TCP/UDP

Source Destination EtherType Source Destination DSCP Protocol ECN

slide-10
SLIDE 10

Limited Identifiers

3

IP

Ethernet TCP/UDP

Source Destination EtherType Source Destination DSCP Protocol ECN Source Destination

slide-11
SLIDE 11

Peter

cn=Peter Pan, ou=CS, o=UColorado

LDAP User

BLOCK

Why fine-grained identifiers?

4

  • Uniquely identifying user sessions
slide-12
SLIDE 12

Peter

cn=Peter Pan, ou=CS, o=UColorado

LDAP User

BLOCK

Why fine-grained identifiers?

4

  • Uniquely identifying user sessions

MAC IP

slide-13
SLIDE 13

Peter

cn=Peter Pan, ou=CS, o=UColorado

LDAP User

BLOCK

Why fine-grained identifiers?

4

  • Uniquely identifying user sessions

MAC IP

UID

slide-14
SLIDE 14

Peter

cn=Peter Pan, ou=CS, o=UColorado

LDAP User

BLOCK

Why fine-grained identifiers?

4

  • Uniquely identifying user sessions

MAC IP

UID LDAP Controller

slide-15
SLIDE 15

Why fine-grained identifiers?

5

  • Isolating vulnerable software
slide-16
SLIDE 16

Why fine-grained identifiers?

6

  • Isolating vulnerable software
slide-17
SLIDE 17

Why fine-grained identifiers?

6

$ openssl sha1 /usr/sbin/httpd

SHA1(/usr/sbin/httpd)=5fdbdb587fce265656fd3e2960a6293262efedb7

  • Isolating vulnerable software
slide-18
SLIDE 18

Why fine-grained identifiers?

6

Executable Fingerprint

$ openssl sha1 /usr/sbin/httpd

SHA1(/usr/sbin/httpd)=5fdbdb587fce265656fd3e2960a6293262efedb7

  • Isolating vulnerable software
slide-19
SLIDE 19

Why fine-grained identifiers?

6

Executable Fingerprint

$ openssl sha1 /usr/sbin/httpd

SHA1(/usr/sbin/httpd)=5fdbdb587fce265656fd3e2960a6293262efedb7

Controller

  • Isolating vulnerable software
slide-20
SLIDE 20

Fine-Grained Information

7

Process Process Network Interface IP/MAC

user space

  • perating

system

slide-21
SLIDE 21

Fine-Grained Information

7

Process Process Network Interface IP/MAC Port

user space

  • perating

system

slide-22
SLIDE 22

Fine-Grained Information

7

PID Process Process Network Interface IP/MAC Port

user space

  • perating

system

slide-23
SLIDE 23

Fine-Grained Information

7

GID PID Process Process Network Interface IP/MAC Port

user space

  • perating

system

slide-24
SLIDE 24

Fine-Grained Information

7

UID GID PID Process Process Network Interface IP/MAC Port

user space

  • perating

system

slide-25
SLIDE 25

Fine-Grained Information

7

UID GID PID cgroups Process Process Network Interface IP/MAC Port

user space

  • perating

system

slide-26
SLIDE 26

Fine-Grained Information

7

UID GID PID cgroups

  • pen files

Process Process Network Interface IP/MAC Port

user space

  • perating

system

slide-27
SLIDE 27

Fine-Grained Information

7

UID GID PID cgroups

  • pen files

exe fingerprint Process Process Network Interface IP/MAC Port

user space

  • perating

system

slide-28
SLIDE 28

Fine-Grained Information

8

user space

  • perating

system network

Process Process

IP Source IP Destination EtherType MAC Source MAC Destination Protocol TCP/UDP Source TCP/UDP Destination

Network Interface IP/MAC UID GID PID cgroups

  • pen files

exe fingerprint

slide-29
SLIDE 29

Fine-Grained Information

8

user space

  • perating

system network

Process Process

IP Source IP Destination EtherType MAC Source MAC Destination Protocol TCP/UDP Source TCP/UDP Destination

Network Interface IP/MAC UID GID PID cgroups

  • pen files

exe fingerprint

slide-30
SLIDE 30
  • Uniquely identifying user sessions
  • Isolating vulnerable software

Benefiting Scenarios

9

slide-31
SLIDE 31
  • Uniquely identifying user sessions
  • Isolating vulnerable software
  • Identifying services

Benefiting Scenarios

9

slide-32
SLIDE 32
  • Uniquely identifying user sessions
  • Isolating vulnerable software
  • Identifying services
  • Quality of Service

Benefiting Scenarios

9

slide-33
SLIDE 33
  • Uniquely identifying user sessions
  • Isolating vulnerable software
  • Identifying services
  • Quality of Service
  • Forensic Analysis

Benefiting Scenarios

9

slide-34
SLIDE 34

PRPL

\ˈpər-pəl\

Policy Routing using Process-Level Identifiers

slide-35
SLIDE 35

PRPL Overview

11

slide-36
SLIDE 36

PRPL Overview

controller

11

slide-37
SLIDE 37

PRPL Overview

controller

Distributing and configuring Policy

11

slide-38
SLIDE 38

PRPL Overview

controller

Distributing and configuring Policy

11

slide-39
SLIDE 39

PRPL Overview

Tagging Packets

controller

Distributing and configuring Policy

11

slide-40
SLIDE 40

PRPL Overview

Tagging Packets

controller

Distributing and configuring Policy Forwarding

11

slide-41
SLIDE 41

Tagging

Ethernet IP TCP/UDP

  • Insert a custom header containing a token associated

with some policy

12

slide-42
SLIDE 42

Tagging

Ethernet IP TCP/UDP

  • Insert a custom header containing a token associated

with some policy

12

slide-43
SLIDE 43

Tagging

Ethernet IP TCP/UDP

PRPL

  • Insert a custom header containing a token associated

with some policy

12

slide-44
SLIDE 44

Tagging

Ethernet IP TCP/UDP

PRPL

0x12d4f7e3 3 2 b i t s

  • Insert a custom header containing a token associated

with some policy

12

slide-45
SLIDE 45

Tagging

13

Process

Policy Controller Host

user domain admin domain

slide-46
SLIDE 46

Tagging

13

PRPL Agent

Process

Policy Controller Host

user domain admin domain

slide-47
SLIDE 47

Tagging

13

PRPL Agent

Process

Policy Controller Host

request communication stream user domain admin domain

slide-48
SLIDE 48

Tagging

13

PRPL Agent

Process

Policy Controller Host

request communication stream

  • btain token

user domain admin domain

slide-49
SLIDE 49

Tagging

13

PRPL Agent classify/mark tag/forward

configure

Process

Policy Controller Host

request communication stream

  • btain token

user domain admin domain

slide-50
SLIDE 50
  • Programmable Hardware


[Kangaroo INFOCOM ’10, SDN Chip SIGCOMM ’13, Intel FM6000 switch silicon]

  • Dataplane Forwarding Model

in P4 [SIGCOMM CCR 2014]

Forwarding

14

slide-51
SLIDE 51

PRPL token

action

0xa4..23

drop reroute

0xd3..42

  • Programmable Hardware


[Kangaroo INFOCOM ’10, SDN Chip SIGCOMM ’13, Intel FM6000 switch silicon]

  • Dataplane Forwarding Model

in P4 [SIGCOMM CCR 2014]

Forwarding

14

slide-52
SLIDE 52

PRPL token

action

0xa4..23

drop reroute

0xd3..42

  • Programmable Hardware


[Kangaroo INFOCOM ’10, SDN Chip SIGCOMM ’13, Intel FM6000 switch silicon]

  • Dataplane Forwarding Model

in P4 [SIGCOMM CCR 2014]

Forwarding

14

slide-53
SLIDE 53

Implementation

15

slide-54
SLIDE 54
  • Linux on-board tools: iptables, custom routing, tunnel

devices

Implementation

15

slide-55
SLIDE 55
  • Linux on-board tools: iptables, custom routing, tunnel

devices

  • P4: Matching on token

Implementation

15

slide-56
SLIDE 56
  • Linux on-board tools: iptables, custom routing, tunnel

devices

  • P4: Matching on token
  • Prototype
  • P4 behavioral model
  • tag based on uid
  • forward or drop

Implementation

15

slide-57
SLIDE 57

Implementation

direct transmission using PRPL

200 400 600 800 1000 1200 1400 50 100 150 200 packet size [Bytes] TCP throughput [Mbit/s]

  • No performance penalty for packets < 200 Bytes

16

slide-58
SLIDE 58

Future Work and Conclusion

17

slide-59
SLIDE 59
  • Network Management can greatly benefit from fine-

grained process-level information

Future Work and Conclusion

17

slide-60
SLIDE 60
  • Network Management can greatly benefit from fine-

grained process-level information

  • System Architecture and Prototype enabling packet

processing based on such information


Future Work and Conclusion

17

slide-61
SLIDE 61
  • Network Management can greatly benefit from fine-

grained process-level information

  • System Architecture and Prototype enabling packet

processing based on such information


  • Future work: expansion beyond current examples, more

complex policies

Future Work and Conclusion

17

slide-62
SLIDE 62

Source Code

18

https://github.com/nsr-colorado/prpl

slide-63
SLIDE 63

Backup Slides

slide-64
SLIDE 64
  • Study feasibility of more complex policy scenarios
  • Granularity of Tokens
  • Controller - Agent Interface
  • Proactive vs. reactive configuration
  • Trust in tagging process

Future Work

20

slide-65
SLIDE 65
  • Token sizes between 16 bits and 32 bits sufficient even

for large networks

Tagging

21

500 servers 2000 servers 10000 servers

1 5 10 50 100 5 10 15 20 25 number of policy rules per host (log.) minimum token size [bits]

slide-66
SLIDE 66
  • new custom ASICs can achieve such flexibility at

terabit speeds [Kangaroo INFOCOM ’10, SDN Chip SIGCOMM ’13,

Intel FM6000 switch silicon]

  • some switches are more programmable than others:
  • FPGA (Xilinx, Altera, Corsa)
  • NPU (Ezchip, Netronome)
  • CPU (OVS, …)

Programmable Hardware

22

slide-67
SLIDE 67
  • P4 program configures

forwarding behavior (abstract forwarding model)

  • express serial dependencies

(e.g. ARP/L3 Routing)

  • P4 compiler translates into a

target-specific representation

  • OF can still be used to install

and query rules once forwarding model is defined

P4 Language

23

slide-68
SLIDE 68

P4 Forwarding Model / Runtime

24

Switch Parser Match/Action Tables Packet Metadata Egress Queues

slide-69
SLIDE 69

P4 Forwarding Model / Runtime

24

L2L3.p4 Switch Parser Match/Action Tables Packet Metadata Egress Queues

slide-70
SLIDE 70

P4 Forwarding Model / Runtime

24

L2L3.p4 Switch Parser Match/Action Tables Packet Metadata Egress Queues COMPILE

slide-71
SLIDE 71

P4 Forwarding Model / Runtime

24

L2L3.p4 Switch Parser Match/Action Tables Packet Metadata Egress Queues COMPILE Eth VLAN IP4 IP6 TCP UDP

slide-72
SLIDE 72

P4 Forwarding Model / Runtime

24

L2L3.p4 Switch Parser Match/Action Tables Packet Metadata Egress Queues COMPILE Eth VLAN IP4 IP6 TCP UDP Controller Routing Firewall NAT

slide-73
SLIDE 73

P4 Forwarding Model / Runtime

24

L2L3.p4 Switch Parser Match/Action Tables Packet Metadata Egress Queues COMPILE Eth VLAN IP4 IP6 TCP UDP Controller Routing Firewall NAT

slide-74
SLIDE 74

P4 Forwarding Model / Runtime

24

L2L3.p4 Switch Parser Match/Action Tables Packet Metadata Egress Queues COMPILE Eth VLAN IP4 IP6 TCP UDP Controller Routing Firewall NAT

slide-75
SLIDE 75

P4 Forwarding Model / Runtime

24

Switch Parser Match/Action Tables Packet Metadata Egress Queues COMPILE Eth VLAN IP4 IP6 TCP UDP Controller Routing Firewall NAT

slide-76
SLIDE 76

P4 Forwarding Model / Runtime

24

Switch Parser Match/Action Tables Packet Metadata Egress Queues COMPILE Eth VLAN IP4 IP6 TCP UDP Controller Routing Firewall NAT OF1-3.p4

slide-77
SLIDE 77

P4 Forwarding Model / Runtime

24

Switch Parser Match/Action Tables Packet Metadata Egress Queues COMPILE Eth VLAN IP4 IP6 TCP UDP Controller Routing Firewall NAT OF1-3.p4

Open Flow 1.3

slide-78
SLIDE 78

Architecture

25

Network Policy Controller Directory Service verify existence install flow entries Gateway Switch Internet user domain admin domain PRPL Agent Process Process Socket Socket Switch request stream/

  • btain token

ANNOTATING PACKET STREAMS PRPL FORWARDING CONTROLLING/DISTRIBUTING POLICY

A

PRPL token

action

0xa4..23

drop reroute

0xd3..42

B C

Process Socket classify/mark annotate/forward configure

slide-79
SLIDE 79

P4 Parsing

26

Ethernet Policy Token IP ... Eth PRPL TCP UDP 0xd3...42 drop 0xa4...29 reroute continue 0xa6...76 IP 10.0.1/24 10.0.2/24 1 2 Routing Table Policy Table Parsing FSM Incoming Packet

slide-80
SLIDE 80

P4 Implementation

27

table prpl { reads { prpl.token : exact; } actions { _nop; _drop; forward; } size : 128; } header_type prpl_t { fields { token : 8; } } header prpl_t prpl; parser start { return parse_ethernet; } parser parse_ethernet { extract(ethernet); return parse_prpl; } parser parse_prpl { extract(prpl); return ingress; } table_set_default prpl _nop table_add prpl _nop 0x00000001 => table_add prpl _drop 0x00000002 => table_add prpl forward 0x00000001 => 4

slide-81
SLIDE 81

iptables

28

iptables OUTPUT chain

  • -uid-owner1003
  • -set-mark 0xd2

1003 process policy_d2 default dev tun2 policy_54 default dev tun5 from all mark 0xd2 lookup policy_d2 routing rules

/etc/iproute2 /rt_tables

tun2 Policy Agent Network tun5 admin domain user domain