TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level - - PowerPoint PPT Presentation

tenantguard scalable runtime verification of cloud wide
SMART_READER_LITE
LIVE PREVIEW

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level - - PowerPoint PPT Presentation

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Han Song SJTU May 24, 2017 Han Song TenantGuard: Scalable Runtime


slide-1
SLIDE 1

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation

Han Song

SJTU

May 24, 2017

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 1 / 28

slide-2
SLIDE 2

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation

Outline

1 Background 2 Architecture and Data Structures 3 Verification 4 Experiments 5 Conclusion 6 Q & A

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 2 / 28

slide-3
SLIDE 3

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Isolation Breaches

One of the Biggest Security Concerns in Cloud

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 3 / 28

slide-4
SLIDE 4

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Isolation Breaches

One of the Biggest Security Concerns in Cloud

Something went wrong and D is hacked!

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 4 / 28

slide-5
SLIDE 5

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Isolation Breaches

One of the Biggest Security Concerns in Cloud

OpenStack real world vulnerabilities

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 5 / 28

slide-6
SLIDE 6

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Isolation Breaches

One of the Biggest Security Concerns in Cloud

One possible solution is: network isolation verification

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 6 / 28

slide-7
SLIDE 7

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Network Isolation Verification

Challenges

Size of virtual networks: 150M+ VM pairs Diverse and distributed network functions Large data from heterogeneous sources Quickly invalidating verification results

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 7 / 28

slide-8
SLIDE 8

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Network Isolation Verification

Challenges

Size of virtual networks: 150M+ VM pairs Diverse and distributed network functions Large data from heterogeneous sources Quickly invalidating verification results

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 7 / 28

slide-9
SLIDE 9

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Network Isolation Verification

Challenges

Size of virtual networks: 150M+ VM pairs Diverse and distributed network functions Large data from heterogeneous sources Quickly invalidating verification results

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 7 / 28

slide-10
SLIDE 10

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Network Isolation Verification

Challenges

Size of virtual networks: 150M+ VM pairs Diverse and distributed network functions Large data from heterogeneous sources Quickly invalidating verification results

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 7 / 28

slide-11
SLIDE 11

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Existing Approaches

Designed for physical networks

Not suitable for VM-level pair-wise reachability

Focus on small to medium virtual infrastructure

Not designed for millions of VM pairs

Can support VM-level reachability

Taking minutes to hours for over 100 million pairs

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 8 / 28

slide-12
SLIDE 12

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Existing Approaches

Designed for physical networks

Not suitable for VM-level pair-wise reachability

Focus on small to medium virtual infrastructure

Not designed for millions of VM pairs

Can support VM-level reachability

Taking minutes to hours for over 100 million pairs

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 8 / 28

slide-13
SLIDE 13

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Existing Approaches

Designed for physical networks

Not suitable for VM-level pair-wise reachability

Focus on small to medium virtual infrastructure

Not designed for millions of VM pairs

Can support VM-level reachability

Taking minutes to hours for over 100 million pairs

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 8 / 28

slide-14
SLIDE 14

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Existing Approaches

Designed for physical networks

Not suitable for VM-level pair-wise reachability

Focus on small to medium virtual infrastructure

Not designed for millions of VM pairs

Can support VM-level reachability

Taking minutes to hours for over 100 million pairs

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 8 / 28

slide-15
SLIDE 15

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Existing Approaches

Designed for physical networks

Not suitable for VM-level pair-wise reachability

Focus on small to medium virtual infrastructure

Not designed for millions of VM pairs

Can support VM-level reachability

Taking minutes to hours for over 100 million pairs

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 8 / 28

slide-16
SLIDE 16

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Existing Approaches

Designed for physical networks

Not suitable for VM-level pair-wise reachability

Focus on small to medium virtual infrastructure

Not designed for millions of VM pairs

Can support VM-level reachability

Taking minutes to hours for over 100 million pairs

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 8 / 28

slide-17
SLIDE 17

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Assumptions

Focused on:

Verifying security properties specified by cloud tenants Not detecting any specific attack

Relies on:

The correctness of input data Existing solutions at other layers No sensitive information in the verification results

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 9 / 28

slide-18
SLIDE 18

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Assumptions

Focused on:

Verifying security properties specified by cloud tenants Not detecting any specific attack

Relies on:

The correctness of input data Existing solutions at other layers No sensitive information in the verification results

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 9 / 28

slide-19
SLIDE 19

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Assumptions

Focused on:

Verifying security properties specified by cloud tenants Not detecting any specific attack

Relies on:

The correctness of input data Existing solutions at other layers No sensitive information in the verification results

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 9 / 28

slide-20
SLIDE 20

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Assumptions

Focused on:

Verifying security properties specified by cloud tenants Not detecting any specific attack

Relies on:

The correctness of input data Existing solutions at other layers No sensitive information in the verification results

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 9 / 28

slide-21
SLIDE 21

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Assumptions

Focused on:

Verifying security properties specified by cloud tenants Not detecting any specific attack

Relies on:

The correctness of input data Existing solutions at other layers No sensitive information in the verification results

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 9 / 28

slide-22
SLIDE 22

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Assumptions

Focused on:

Verifying security properties specified by cloud tenants Not detecting any specific attack

Relies on:

The correctness of input data Existing solutions at other layers No sensitive information in the verification results

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 9 / 28

slide-23
SLIDE 23

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Assumptions

Focused on:

Verifying security properties specified by cloud tenants Not detecting any specific attack

Relies on:

The correctness of input data Existing solutions at other layers No sensitive information in the verification results

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 9 / 28

slide-24
SLIDE 24

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Highlights

TenantGuard, a VM-level network isolation verification system Pairwise reachability for over 25K VMs in 13s Built on OpenStack, a popular cloud management platform Based on a hierarchical model for virtual networks Leveraging efficient data structures, incremental verification and parallel computation

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 10 / 28

slide-25
SLIDE 25

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Highlights

TenantGuard, a VM-level network isolation verification system Pairwise reachability for over 25K VMs in 13s Built on OpenStack, a popular cloud management platform Based on a hierarchical model for virtual networks Leveraging efficient data structures, incremental verification and parallel computation

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 10 / 28

slide-26
SLIDE 26

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Highlights

TenantGuard, a VM-level network isolation verification system Pairwise reachability for over 25K VMs in 13s Built on OpenStack, a popular cloud management platform Based on a hierarchical model for virtual networks Leveraging efficient data structures, incremental verification and parallel computation

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 10 / 28

slide-27
SLIDE 27

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Background

Highlights

TenantGuard, a VM-level network isolation verification system Pairwise reachability for over 25K VMs in 13s Built on OpenStack, a popular cloud management platform Based on a hierarchical model for virtual networks Leveraging efficient data structures, incremental verification and parallel computation

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 10 / 28

slide-28
SLIDE 28

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Architecture and Data Structures

TenantGuard: Architecture

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 11 / 28

slide-29
SLIDE 29

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Architecture and Data Structures

Key Ideas

Hierarchical virtual network model (Router, subnet, VM) Top-down verification approach (from prefix-level to IP-level) Efficient data structures (Radix Trie and X-fast Binary Trie)

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 12 / 28

slide-30
SLIDE 30

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Architecture and Data Structures

Key Ideas

Hierarchical virtual network model (Router, subnet, VM) Top-down verification approach (from prefix-level to IP-level) Efficient data structures (Radix Trie and X-fast Binary Trie)

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 12 / 28

slide-31
SLIDE 31

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Architecture and Data Structures

Key Ideas

Hierarchical virtual network model (Router, subnet, VM) Top-down verification approach (from prefix-level to IP-level) Efficient data structures (Radix Trie and X-fast Binary Trie)

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 12 / 28

slide-32
SLIDE 32

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Architecture and Data Structures

Hierarchical Virtual Network Model

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 13 / 28

slide-33
SLIDE 33

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Architecture and Data Structures

Hierarchical Virtual Network Model

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 13 / 28

slide-34
SLIDE 34

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Architecture and Data Structures

Baseline Approach

Verifying every possible VM pair (e.g., over 150 million pairs!!)

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 14 / 28

slide-35
SLIDE 35

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Top-Down Verification

Step 1: Check isolation between subnets within the same tenant environment Step 2:Check isolation between different tenant environments Step 3: Check VM-isolation only for subnets found to be reachable

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 15 / 28

slide-36
SLIDE 36

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Top-Down Verification

Step 1: Check isolation between subnets within the same tenant environment Step 2:Check isolation between different tenant environments Step 3: Check VM-isolation only for subnets found to be reachable

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 15 / 28

slide-37
SLIDE 37

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Top-Down Verification

Step 1: Check isolation between subnets within the same tenant environment Step 2:Check isolation between different tenant environments Step 3: Check VM-isolation only for subnets found to be reachable

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 15 / 28

slide-38
SLIDE 38

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Top-Down Verification

Step 1: Check isolation between subnets within the same tenant environment Step 2:Check isolation between different tenant environments Step 3: Check VM-isolation only for subnets found to be reachable

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 15 / 28

slide-39
SLIDE 39

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Top-Down Verification

Step 1: Check isolation between subnets within the same tenant environment Step 2:Check isolation between different tenant environments Step 3: Check VM-isolation only for subnets found to be reachable

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 15 / 28

slide-40
SLIDE 40

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Efficient Data Structure

Radix Trie: Capturing Routing Rules

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 16 / 28

slide-41
SLIDE 41

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Efficient Data Structure

BTries: Storing Intermediary Results

Storing results of matching routing rules against IP ranges Searching is O(logL), here L is max. 32

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 17 / 28

slide-42
SLIDE 42

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Efficient Data Structure

BTries: Storing Intermediary Results

Storing results of matching routing rules against IP ranges Searching is O(logL), here L is max. 32

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 17 / 28

slide-43
SLIDE 43

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Efficient Data Structure

BTries: Storing Intermediary Results

Storing results of matching routing rules against IP ranges Searching is O(logL), here L is max. 32

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 17 / 28

slide-44
SLIDE 44

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Prefix-to-prefix Algorithm

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 18 / 28

slide-45
SLIDE 45

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

VM-to-VM Algorithm

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 19 / 28

slide-46
SLIDE 46

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Incremental Verification

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 20 / 28

slide-47
SLIDE 47

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Incremental Verification

Adding a Security Group

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 21 / 28

slide-48
SLIDE 48

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Verification

Application to OpenStack

OpenStack Kilo with one controller and 80 compute nodes Parallelization of reachability verification with Apache Ignite Integration to OpenStack Congress

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 22 / 28

slide-49
SLIDE 49

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Experiments

Experimental Settings

Test Environment

Two series of datasets

SNET (represents small to medium networks) LNET (represents large networks)

NoD (NSDI15) and a baseline algorithm

Real Cloud

Ericsson research cloud Mainly to evaluate the real world applicability of TenantGuard Only observed a minor incompatibility issue due to version mismatch

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 23 / 28

slide-50
SLIDE 50

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Experiments

Performance Evaluation

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 24 / 28

slide-51
SLIDE 51

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Experiments

Further Performance Improvement

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 25 / 28

slide-52
SLIDE 52

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Experiments

Identifying Performance Factors

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 26 / 28

slide-53
SLIDE 53

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Conclusion

Conclusion

Future Work

Integrating existing tools at other layers (physical, L2) Ensuring integrity of input data Addressing privacy issues from the verification results

Summary

TenantGuard, a VM-level network isolation verification system Integrated our approach to OpenStack Reachability for over 150 million VM pairs in 13 seconds

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 27 / 28

slide-54
SLIDE 54

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation Q & A

Thank You! Q & A?

Han Song TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation May 24, 2017 28 / 28