Tencrypt: Encrypting Tenant-Traffic in OpenShift Forschungsprojekt - - PowerPoint PPT Presentation

▶
tencrypt encrypting tenant traffic in openshift
SMART_READER_LITE
LIVE PREVIEW

Tencrypt: Encrypting Tenant-Traffic in OpenShift Forschungsprojekt - - PowerPoint PPT Presentation

Jul 09, 2023 8 likes •1.26k views

Dominik Pataky Faculty of Computer Science, Institute of Systems Architecture, Chair of Computer Networks Tencrypt: Encrypting Tenant-Traffic in OpenShift Forschungsprojekt Anwendung // Dresden, 15th November, 2018 Contents Introduction Red

slide-1
SLIDE 1

Dominik Pataky Faculty of Computer Science, Institute of Systems Architecture, Chair of Computer Networks

Tencrypt: Encrypting Tenant-Traffic in OpenShift

Forschungsprojekt Anwendung // Dresden, 15th November, 2018

slide-2
SLIDE 2

Contents

Introduction Red Hat OpenShift Networking, Security Security requirements and threat model Encrypting traffic between Pods Fundamentals, ideas and possible approaches Using Minishift for experimental implementations Implementation concepts Proof of concept implementation Throughput measurements Conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 2/32

slide-3
SLIDE 3

Introduction Red Hat OpenShift Networking, Security Security requirements and threat model Encrypting traffic between Pods Fundamentals, ideas and possible approaches Using Minishift for experimental implementations Implementation concepts Proof of concept implementation Throughput measurements Conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 3/32

slide-4
SLIDE 4

Overview

  • Virtualisation of computing resources is a trending and advancing topic
  • In the recent years, virtualisation and emulation of hardware („virtual

machines“) was steadily replaced by containerisation

  • Containerisation uses different techniques to isolate applications running on

the same kernel, saving the emulation overhead

  • Whole ecosystems revolve around these engines (e.g. Docker), enabling

faster deployment and development

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 4/32

slide-5
SLIDE 5

Overview

  • Virtualisation of computing resources is a trending and advancing topic
  • In the recent years, virtualisation and emulation of hardware („virtual

machines“) was steadily replaced by containerisation

  • Containerisation uses different techniques to isolate applications running on

the same kernel, saving the emulation overhead

  • Whole ecosystems revolve around these engines (e.g. Docker), enabling

faster deployment and development

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 4/32

slide-6
SLIDE 6

Overview

  • Virtualisation of computing resources is a trending and advancing topic
  • In the recent years, virtualisation and emulation of hardware („virtual

machines“) was steadily replaced by containerisation

  • Containerisation uses different techniques to isolate applications running on

the same kernel, saving the emulation overhead

  • Whole ecosystems revolve around these engines (e.g. Docker), enabling

faster deployment and development

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 4/32

slide-7
SLIDE 7

Overview

  • Virtualisation of computing resources is a trending and advancing topic
  • In the recent years, virtualisation and emulation of hardware („virtual

machines“) was steadily replaced by containerisation

  • Containerisation uses different techniques to isolate applications running on

the same kernel, saving the emulation overhead

  • Whole ecosystems revolve around these engines (e.g. Docker), enabling

faster deployment and development

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 4/32

slide-8
SLIDE 8

Tencrypt

  • 1. Explores possibilities for transparent encryption of traffic

between Pods of the same Project (Tenants)

  • 2. Deep-dive into OpenShift and related technologies
  • 3. Security requirements and anticipated threat model
  • 4. Collection of ideas and possible approaches
  • 5. Evaluating Minishift as development environment
  • 6. Implementation concept parts
  • 7. Proof of concept implementation in Go
  • 8. Throughput measurements and conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 5/32

slide-9
SLIDE 9

Tencrypt

  • 1. Explores possibilities for transparent encryption of traffic

between Pods of the same Project (Tenants)

  • 2. Deep-dive into OpenShift and related technologies
  • 3. Security requirements and anticipated threat model
  • 4. Collection of ideas and possible approaches
  • 5. Evaluating Minishift as development environment
  • 6. Implementation concept parts
  • 7. Proof of concept implementation in Go
  • 8. Throughput measurements and conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 5/32

slide-10
SLIDE 10

Tencrypt

  • 1. Explores possibilities for transparent encryption of traffic

between Pods of the same Project (Tenants)

  • 2. Deep-dive into OpenShift and related technologies
  • 3. Security requirements and anticipated threat model
  • 4. Collection of ideas and possible approaches
  • 5. Evaluating Minishift as development environment
  • 6. Implementation concept parts
  • 7. Proof of concept implementation in Go
  • 8. Throughput measurements and conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 5/32

slide-11
SLIDE 11

Tencrypt

  • 1. Explores possibilities for transparent encryption of traffic

between Pods of the same Project (Tenants)

  • 2. Deep-dive into OpenShift and related technologies
  • 3. Security requirements and anticipated threat model
  • 4. Collection of ideas and possible approaches
  • 5. Evaluating Minishift as development environment
  • 6. Implementation concept parts
  • 7. Proof of concept implementation in Go
  • 8. Throughput measurements and conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 5/32

slide-12
SLIDE 12

Tencrypt

  • 1. Explores possibilities for transparent encryption of traffic

between Pods of the same Project (Tenants)

  • 2. Deep-dive into OpenShift and related technologies
  • 3. Security requirements and anticipated threat model
  • 4. Collection of ideas and possible approaches
  • 5. Evaluating Minishift as development environment
  • 6. Implementation concept parts
  • 7. Proof of concept implementation in Go
  • 8. Throughput measurements and conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 5/32

slide-13
SLIDE 13

Tencrypt

  • 1. Explores possibilities for transparent encryption of traffic

between Pods of the same Project (Tenants)

  • 2. Deep-dive into OpenShift and related technologies
  • 3. Security requirements and anticipated threat model
  • 4. Collection of ideas and possible approaches
  • 5. Evaluating Minishift as development environment
  • 6. Implementation concept parts
  • 7. Proof of concept implementation in Go
  • 8. Throughput measurements and conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 5/32

slide-14
SLIDE 14

Tencrypt

  • 1. Explores possibilities for transparent encryption of traffic

between Pods of the same Project (Tenants)

  • 2. Deep-dive into OpenShift and related technologies
  • 3. Security requirements and anticipated threat model
  • 4. Collection of ideas and possible approaches
  • 5. Evaluating Minishift as development environment
  • 6. Implementation concept parts
  • 7. Proof of concept implementation in Go
  • 8. Throughput measurements and conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 5/32

slide-15
SLIDE 15

Tencrypt

  • 1. Explores possibilities for transparent encryption of traffic

between Pods of the same Project (Tenants)

  • 2. Deep-dive into OpenShift and related technologies
  • 3. Security requirements and anticipated threat model
  • 4. Collection of ideas and possible approaches
  • 5. Evaluating Minishift as development environment
  • 6. Implementation concept parts
  • 7. Proof of concept implementation in Go
  • 8. Throughput measurements and conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 5/32

slide-16
SLIDE 16

Introduction Red Hat OpenShift Networking, Security Security requirements and threat model Encrypting traffic between Pods Fundamentals, ideas and possible approaches Using Minishift for experimental implementations Implementation concepts Proof of concept implementation Throughput measurements Conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 6/32

slide-17
SLIDE 17

OpenShift, Kubernetes and Docker

  • Docker: wrapper for Linux kernel namespaces and cgroup features.

Introduces features like reproducible images (Dockerfiles), image registries and toolchain

  • Kubernetes: uses Docker as containerisation engine for multi-node

application deployment

  • OpenShift: uses Kubernetes as the app orchestration engine, adding more

features for a smoother workflow

  • Not mentioned: multiple other APIs, engines and projects with similar

toolchains and goals

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 7/32

slide-18
SLIDE 18

OpenShift, Kubernetes and Docker

  • Docker: wrapper for Linux kernel namespaces and cgroup features.

Introduces features like reproducible images (Dockerfiles), image registries and toolchain

  • Kubernetes: uses Docker as containerisation engine for multi-node

application deployment

  • OpenShift: uses Kubernetes as the app orchestration engine, adding more

features for a smoother workflow

  • Not mentioned: multiple other APIs, engines and projects with similar

toolchains and goals

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 7/32

slide-19
SLIDE 19

OpenShift, Kubernetes and Docker

  • Docker: wrapper for Linux kernel namespaces and cgroup features.

Introduces features like reproducible images (Dockerfiles), image registries and toolchain

  • Kubernetes: uses Docker as containerisation engine for multi-node

application deployment

  • OpenShift: uses Kubernetes as the app orchestration engine, adding more

features for a smoother workflow

  • Not mentioned: multiple other APIs, engines and projects with similar

toolchains and goals

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 7/32

slide-20
SLIDE 20

OpenShift, Kubernetes and Docker

  • Docker: wrapper for Linux kernel namespaces and cgroup features.

Introduces features like reproducible images (Dockerfiles), image registries and toolchain

  • Kubernetes: uses Docker as containerisation engine for multi-node

application deployment

  • OpenShift: uses Kubernetes as the app orchestration engine, adding more

features for a smoother workflow

  • Not mentioned: multiple other APIs, engines and projects with similar

toolchains and goals

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 7/32

slide-21
SLIDE 21

What is Red Hat OpenShift?

  • Available as open source project OKD (formerly Origin)
  • Supported instances by Red Hat as „Online“, „Dedicated“ or „Container

Platform“

  • Hardware resources called Nodes connect to Master and host Pods

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 8/32

slide-22
SLIDE 22

What is Red Hat OpenShift?

  • Available as open source project OKD (formerly Origin)
  • Supported instances by Red Hat as „Online“, „Dedicated“ or „Container

Platform“

  • Hardware resources called Nodes connect to Master and host Pods

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 8/32

slide-23
SLIDE 23

What is Red Hat OpenShift?

  • Available as open source project OKD (formerly Origin)
  • Supported instances by Red Hat as „Online“, „Dedicated“ or „Container

Platform“

  • Hardware resources called Nodes connect to Master and host Pods

Related tools Related technologies

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 8/32

slide-24
SLIDE 24

Components of OpenShift

  • Nodes (RHEL)
  • Master (APIs, Authentication, Storage, Scheduling, Scaling)
  • Pods (grouping of Containers, Users/Projects, Policies)
  • Container image Registry
  • Persistent Storage (Volumes, NFS/GlusterFS/Ceph/Clouds)
  • Service Layer with Service Discovery (Load-Balancing, virtual IPs)
  • Routing Layer (HAProxy, routing external access, egress routing, A/B testing)

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 9/32

slide-25
SLIDE 25

Components of OpenShift

  • Nodes (RHEL)
  • Master (APIs, Authentication, Storage, Scheduling, Scaling)
  • Pods (grouping of Containers, Users/Projects, Policies)
  • Container image Registry
  • Persistent Storage (Volumes, NFS/GlusterFS/Ceph/Clouds)
  • Service Layer with Service Discovery (Load-Balancing, virtual IPs)
  • Routing Layer (HAProxy, routing external access, egress routing, A/B testing)

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 9/32

slide-26
SLIDE 26

Components of OpenShift

  • Nodes (RHEL)
  • Master (APIs, Authentication, Storage, Scheduling, Scaling)
  • Pods (grouping of Containers, Users/Projects, Policies)
  • Container image Registry
  • Persistent Storage (Volumes, NFS/GlusterFS/Ceph/Clouds)
  • Service Layer with Service Discovery (Load-Balancing, virtual IPs)
  • Routing Layer (HAProxy, routing external access, egress routing, A/B testing)

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 9/32

slide-27
SLIDE 27

Components of OpenShift

  • Nodes (RHEL)
  • Master (APIs, Authentication, Storage, Scheduling, Scaling)
  • Pods (grouping of Containers, Users/Projects, Policies)
  • Container image Registry
  • Persistent Storage (Volumes, NFS/GlusterFS/Ceph/Clouds)
  • Service Layer with Service Discovery (Load-Balancing, virtual IPs)
  • Routing Layer (HAProxy, routing external access, egress routing, A/B testing)

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 9/32

slide-28
SLIDE 28

Components of OpenShift

  • Nodes (RHEL)
  • Master (APIs, Authentication, Storage, Scheduling, Scaling)
  • Pods (grouping of Containers, Users/Projects, Policies)
  • Container image Registry
  • Persistent Storage (Volumes, NFS/GlusterFS/Ceph/Clouds)
  • Service Layer with Service Discovery (Load-Balancing, virtual IPs)
  • Routing Layer (HAProxy, routing external access, egress routing, A/B testing)

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 9/32

slide-29
SLIDE 29

Components of OpenShift

  • Nodes (RHEL)
  • Master (APIs, Authentication, Storage, Scheduling, Scaling)
  • Pods (grouping of Containers, Users/Projects, Policies)
  • Container image Registry
  • Persistent Storage (Volumes, NFS/GlusterFS/Ceph/Clouds)
  • Service Layer with Service Discovery (Load-Balancing, virtual IPs)
  • Routing Layer (HAProxy, routing external access, egress routing, A/B testing)

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 9/32

slide-30
SLIDE 30

Components of OpenShift

  • Nodes (RHEL)
  • Master (APIs, Authentication, Storage, Scheduling, Scaling)
  • Pods (grouping of Containers, Users/Projects, Policies)
  • Container image Registry
  • Persistent Storage (Volumes, NFS/GlusterFS/Ceph/Clouds)
  • Service Layer with Service Discovery (Load-Balancing, virtual IPs)
  • Routing Layer (HAProxy, routing external access, egress routing, A/B testing)

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 9/32

slide-31
SLIDE 31

Networking in OpenShift

  • Internal DNS servers for Services
  • Split DNS with SkyDNS
  • Container Networking Interface (CNI)
  • Software Defined Networking (SDN)

– Flat network: all Pods reach each other – Multi-Tenant: isolated traffic on Project-level by Virtual Network ID (VNID) – Network policy: granular policy-rules for Projects/Pods

  • VXLAN overlay for Pod-to-Pod by Open vSwitch (OVS)

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 10/32

slide-32
SLIDE 32

Networking in OpenShift

  • Internal DNS servers for Services
  • Split DNS with SkyDNS
  • Container Networking Interface (CNI)
  • Software Defined Networking (SDN)

– Flat network: all Pods reach each other – Multi-Tenant: isolated traffic on Project-level by Virtual Network ID (VNID) – Network policy: granular policy-rules for Projects/Pods

  • VXLAN overlay for Pod-to-Pod by Open vSwitch (OVS)

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 10/32

slide-33
SLIDE 33

Networking in OpenShift

  • Internal DNS servers for Services
  • Split DNS with SkyDNS
  • Container Networking Interface (CNI)
  • Software Defined Networking (SDN)

– Flat network: all Pods reach each other – Multi-Tenant: isolated traffic on Project-level by Virtual Network ID (VNID) – Network policy: granular policy-rules for Projects/Pods

  • VXLAN overlay for Pod-to-Pod by Open vSwitch (OVS)

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 10/32

slide-34
SLIDE 34

Networking in OpenShift

  • Internal DNS servers for Services
  • Split DNS with SkyDNS
  • Container Networking Interface (CNI)
  • Software Defined Networking (SDN)

– Flat network: all Pods reach each other – Multi-Tenant: isolated traffic on Project-level by Virtual Network ID (VNID) – Network policy: granular policy-rules for Projects/Pods

  • VXLAN overlay for Pod-to-Pod by Open vSwitch (OVS)

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 10/32

slide-35
SLIDE 35

Networking in OpenShift

  • Internal DNS servers for Services
  • Split DNS with SkyDNS
  • Container Networking Interface (CNI)
  • Software Defined Networking (SDN)

– Flat network: all Pods reach each other – Multi-Tenant: isolated traffic on Project-level by Virtual Network ID (VNID) – Network policy: granular policy-rules for Projects/Pods

  • VXLAN overlay for Pod-to-Pod by Open vSwitch (OVS)

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 10/32

slide-36
SLIDE 36

Node Pod

eth0 vethA br0 vxlan0 tun0 vethB

NAT VXLAN

  • verlay

Underlaying network C C C C C

Internet

Figure 1: Overview of networking of Nodes, Pods and Containers

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 11/32

slide-37
SLIDE 37

Security in OpenShift

  • Policies for Container deployment
  • Multi-tenancy through Users and Projects
  • Container host pinning
  • Additional mechanisms to secure Container image creation
  • Secret Management through secured storage in Master

– Access within Pods through ENV or mounts

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 12/32

slide-38
SLIDE 38

Security in OpenShift

  • Policies for Container deployment
  • Multi-tenancy through Users and Projects
  • Container host pinning
  • Additional mechanisms to secure Container image creation
  • Secret Management through secured storage in Master

– Access within Pods through ENV or mounts

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 12/32

slide-39
SLIDE 39

Security in OpenShift

  • Policies for Container deployment
  • Multi-tenancy through Users and Projects
  • Container host pinning
  • Additional mechanisms to secure Container image creation
  • Secret Management through secured storage in Master

– Access within Pods through ENV or mounts

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 12/32

slide-40
SLIDE 40

Security in OpenShift

  • Policies for Container deployment
  • Multi-tenancy through Users and Projects
  • Container host pinning
  • Additional mechanisms to secure Container image creation
  • Secret Management through secured storage in Master

– Access within Pods through ENV or mounts

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 12/32

slide-41
SLIDE 41

Security in OpenShift

  • Policies for Container deployment
  • Multi-tenancy through Users and Projects
  • Container host pinning
  • Additional mechanisms to secure Container image creation
  • Secret Management through secured storage in Master

– Access within Pods through ENV or mounts

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 12/32

slide-42
SLIDE 42

Introduction Red Hat OpenShift Networking, Security Security requirements and threat model Encrypting traffic between Pods Fundamentals, ideas and possible approaches Using Minishift for experimental implementations Implementation concepts Proof of concept implementation Throughput measurements Conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 13/32

slide-43
SLIDE 43

Security requirements

  • Authentication: Pods must be able to ensure sender authenticity
  • Integrity: Transmitted data must not be corrupted or manipulated
  • Confidentiality: Pod-to-Pod traffic must not be readable by third parties
  • Availability: Key concept in underlying Kubernetes engine,

which Tencrypt must not interfere with

  • Authorisation: Pods should reject unencrypted traffic from internal Pods
  • Based on STRIDE/AINCAA given in [Sho14].
  • Introduced in PoC: Confidentiality

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 14/32

slide-44
SLIDE 44

Security requirements

  • Authentication: Pods must be able to ensure sender authenticity
  • Integrity: Transmitted data must not be corrupted or manipulated
  • Confidentiality: Pod-to-Pod traffic must not be readable by third parties
  • Availability: Key concept in underlying Kubernetes engine,

which Tencrypt must not interfere with

  • Authorisation: Pods should reject unencrypted traffic from internal Pods
  • Based on STRIDE/AINCAA given in [Sho14].
  • Introduced in PoC: Confidentiality

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 14/32

slide-45
SLIDE 45

Security requirements

  • Authentication: Pods must be able to ensure sender authenticity
  • Integrity: Transmitted data must not be corrupted or manipulated
  • Confidentiality: Pod-to-Pod traffic must not be readable by third parties
  • Availability: Key concept in underlying Kubernetes engine,

which Tencrypt must not interfere with

  • Authorisation: Pods should reject unencrypted traffic from internal Pods
  • Based on STRIDE/AINCAA given in [Sho14].
  • Introduced in PoC: Confidentiality

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 14/32

slide-46
SLIDE 46

Security requirements

  • Authentication: Pods must be able to ensure sender authenticity
  • Integrity: Transmitted data must not be corrupted or manipulated
  • Confidentiality: Pod-to-Pod traffic must not be readable by third parties
  • Availability: Key concept in underlying Kubernetes engine,

which Tencrypt must not interfere with

  • Authorisation: Pods should reject unencrypted traffic from internal Pods
  • Based on STRIDE/AINCAA given in [Sho14].
  • Introduced in PoC: Confidentiality

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 14/32

slide-47
SLIDE 47

Security requirements

  • Authentication: Pods must be able to ensure sender authenticity
  • Integrity: Transmitted data must not be corrupted or manipulated
  • Confidentiality: Pod-to-Pod traffic must not be readable by third parties
  • Availability: Key concept in underlying Kubernetes engine,

which Tencrypt must not interfere with

  • Authorisation: Pods should reject unencrypted traffic from internal Pods
  • Based on STRIDE/AINCAA given in [Sho14].
  • Introduced in PoC: Confidentiality

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 14/32

slide-48
SLIDE 48

Security requirements

  • Authentication: Pods must be able to ensure sender authenticity
  • Integrity: Transmitted data must not be corrupted or manipulated
  • Confidentiality: Pod-to-Pod traffic must not be readable by third parties
  • Availability: Key concept in underlying Kubernetes engine,

which Tencrypt must not interfere with

  • Authorisation: Pods should reject unencrypted traffic from internal Pods
  • Based on STRIDE/AINCAA given in [Sho14].
  • Introduced in PoC: Confidentiality

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 14/32

slide-49
SLIDE 49

Security requirements

  • Authentication: Pods must be able to ensure sender authenticity
  • Integrity: Transmitted data must not be corrupted or manipulated
  • Confidentiality: Pod-to-Pod traffic must not be readable by third parties
  • Availability: Key concept in underlying Kubernetes engine,

which Tencrypt must not interfere with

  • Authorisation: Pods should reject unencrypted traffic from internal Pods
  • Based on STRIDE/AINCAA given in [Sho14].
  • Introduced in PoC: Confidentiality

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 14/32

slide-50
SLIDE 50

Threats

ID Description Mitigation T1 An attacker uses a Pod to intercept traffic originating from other namespaces (Pods) on the br0 bridge. Encryption of traffic, hardening of isol- ation mechanisms (Linux kernel). T2 An attacker not only intercepts, but is able to modify traffic on the br0 bridge or the vxlan0 adapter. Encryption and integrity checks. T3 Interception and modification of Master-to-Node traffic. IPsec. T4 Interception of Node-to-Node traffic, both Project- internal and cross-Project. A combination of Node-to-Node IPsec and Tencrypt for Project-internal traffic T5 Incoming external Service traffic is intercepted (and maybe modified) before it reaches the handling Service namespace. OKD Secured routes. T6 The Pod image used by OpenShift to deploy new Pods, is maliciously modified. Securing the image registry. The registry depends on the used container techno- logy and might be an external compon- ent. T7 Resources requested by a Pod limit the availability of

  • ther Pods on the same Node.

Continuous resource monitoring, mi- gration or halting of resource intensive Pods if needed.

Note about containerisation

slide-51
SLIDE 51

Introduction Red Hat OpenShift Networking, Security Security requirements and threat model Encrypting traffic between Pods Fundamentals, ideas and possible approaches Using Minishift for experimental implementations Implementation concepts Proof of concept implementation Throughput measurements Conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 16/32

slide-52
SLIDE 52

Fundamentals

  • „Encrypted traffic“ only includes Tenant-internal (Project-internal) traffic,

not egress or cross-Project traffic

  • Primary focus: eth0 interface shared between Containers in a Pod
  • At first, only application data (OSI layers 5-7) was to be encrypted.

PoC encapsulates whole encrypted packet.

  • Deployed container images of developers should not have to be customised

at all

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 17/32

slide-53
SLIDE 53

Fundamentals

  • „Encrypted traffic“ only includes Tenant-internal (Project-internal) traffic,

not egress or cross-Project traffic

  • Primary focus: eth0 interface shared between Containers in a Pod
  • At first, only application data (OSI layers 5-7) was to be encrypted.

PoC encapsulates whole encrypted packet.

  • Deployed container images of developers should not have to be customised

at all

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 17/32

slide-54
SLIDE 54

Fundamentals

  • „Encrypted traffic“ only includes Tenant-internal (Project-internal) traffic,

not egress or cross-Project traffic

  • Primary focus: eth0 interface shared between Containers in a Pod
  • At first, only application data (OSI layers 5-7) was to be encrypted.

PoC encapsulates whole encrypted packet.

  • Deployed container images of developers should not have to be customised

at all

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 17/32

slide-55
SLIDE 55

Fundamentals

  • „Encrypted traffic“ only includes Tenant-internal (Project-internal) traffic,

not egress or cross-Project traffic

  • Primary focus: eth0 interface shared between Containers in a Pod
  • At first, only application data (OSI layers 5-7) was to be encrypted.

PoC encapsulates whole encrypted packet.

  • Deployed container images of developers should not have to be customised

at all

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 17/32

slide-56
SLIDE 56

Ideas and possible approaches

  • Using symmetric AES with a shared key.

Payload size and MTU? Rotation of keys? Fulfills security requirements?

  • Asymmetric encryption with public keys in shared storage.

Who generates key pair? Which system to use (e.g. X.509)? Realisable without a new OpenShift component?

  • Using existing technology like Wireguard.

Does it scale? Can compiled tools be integrated at all? Which component creates the interfaces? Can peer keys be shared through Secret Storage?

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 18/32

slide-57
SLIDE 57

Ideas and possible approaches

  • Using symmetric AES with a shared key.

Payload size and MTU? Rotation of keys? Fulfills security requirements?

  • Asymmetric encryption with public keys in shared storage.

Who generates key pair? Which system to use (e.g. X.509)? Realisable without a new OpenShift component?

  • Using existing technology like Wireguard.

Does it scale? Can compiled tools be integrated at all? Which component creates the interfaces? Can peer keys be shared through Secret Storage?

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 18/32

slide-58
SLIDE 58

Ideas and possible approaches

  • Using symmetric AES with a shared key.

Payload size and MTU? Rotation of keys? Fulfills security requirements?

  • Asymmetric encryption with public keys in shared storage.

Who generates key pair? Which system to use (e.g. X.509)? Realisable without a new OpenShift component?

  • Using existing technology like Wireguard.

Does it scale? Can compiled tools be integrated at all? Which component creates the interfaces? Can peer keys be shared through Secret Storage?

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 18/32

slide-59
SLIDE 59

Using Minishift

  • Fork of the Kubernetes Minikube project
  • Development environment bundled with OKD, advertised as „local OpenShift“
  • Configures a virtual machine (VirtualBox, KVM,. . . ) as host for components

deployed as Docker containers

  • Either uses a Boot2Docker or CentOS VM ISO image
  • Simulates networking and Virtual IPs (VIPs) with IPtables NAT rules
  • Tencrypt: CentOS on VirtualBox, using default „developer“ account

with two Projects

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 19/32

slide-60
SLIDE 60

Using Minishift

  • Fork of the Kubernetes Minikube project
  • Development environment bundled with OKD, advertised as „local OpenShift“
  • Configures a virtual machine (VirtualBox, KVM,. . . ) as host for components

deployed as Docker containers

  • Either uses a Boot2Docker or CentOS VM ISO image
  • Simulates networking and Virtual IPs (VIPs) with IPtables NAT rules
  • Tencrypt: CentOS on VirtualBox, using default „developer“ account

with two Projects

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 19/32

slide-61
SLIDE 61

Using Minishift

  • Fork of the Kubernetes Minikube project
  • Development environment bundled with OKD, advertised as „local OpenShift“
  • Configures a virtual machine (VirtualBox, KVM,. . . ) as host for components

deployed as Docker containers

  • Either uses a Boot2Docker or CentOS VM ISO image
  • Simulates networking and Virtual IPs (VIPs) with IPtables NAT rules
  • Tencrypt: CentOS on VirtualBox, using default „developer“ account

with two Projects

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 19/32

slide-62
SLIDE 62

Using Minishift

  • Fork of the Kubernetes Minikube project
  • Development environment bundled with OKD, advertised as „local OpenShift“
  • Configures a virtual machine (VirtualBox, KVM,. . . ) as host for components

deployed as Docker containers

  • Either uses a Boot2Docker or CentOS VM ISO image
  • Simulates networking and Virtual IPs (VIPs) with IPtables NAT rules
  • Tencrypt: CentOS on VirtualBox, using default „developer“ account

with two Projects

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 19/32

slide-63
SLIDE 63

Using Minishift

  • Fork of the Kubernetes Minikube project
  • Development environment bundled with OKD, advertised as „local OpenShift“
  • Configures a virtual machine (VirtualBox, KVM,. . . ) as host for components

deployed as Docker containers

  • Either uses a Boot2Docker or CentOS VM ISO image
  • Simulates networking and Virtual IPs (VIPs) with IPtables NAT rules
  • Tencrypt: CentOS on VirtualBox, using default „developer“ account

with two Projects

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 19/32

slide-64
SLIDE 64

Using Minishift

  • Fork of the Kubernetes Minikube project
  • Development environment bundled with OKD, advertised as „local OpenShift“
  • Configures a virtual machine (VirtualBox, KVM,. . . ) as host for components

deployed as Docker containers

  • Either uses a Boot2Docker or CentOS VM ISO image
  • Simulates networking and Virtual IPs (VIPs) with IPtables NAT rules
  • Tencrypt: CentOS on VirtualBox, using default „developer“ account

with two Projects

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 19/32

slide-65
SLIDE 65

Docker image patching and Secrets

  • Approach: patching the Pod image to deploy encryption proxy and custom

networking

  • Access to Docker daemon and images possible
  • 1. Re-tag original Pod image
  • 2. Use original image as base for patched version
  • 3. Build patched image with Tencrypt scripts and proxy app, tagged as „original“
  • As mentioned, Secrets are either in ENV or mounts.

Blocker: „Pod“ container has no access.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 20/32

slide-66
SLIDE 66

Docker image patching and Secrets

  • Approach: patching the Pod image to deploy encryption proxy and custom

networking

  • Access to Docker daemon and images possible
  • 1. Re-tag original Pod image
  • 2. Use original image as base for patched version
  • 3. Build patched image with Tencrypt scripts and proxy app, tagged as „original“
  • As mentioned, Secrets are either in ENV or mounts.

Blocker: „Pod“ container has no access.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 20/32

slide-67
SLIDE 67

Docker image patching and Secrets

  • Approach: patching the Pod image to deploy encryption proxy and custom

networking

  • Access to Docker daemon and images possible
  • 1. Re-tag original Pod image
  • 2. Use original image as base for patched version
  • 3. Build patched image with Tencrypt scripts and proxy app, tagged as „original“
  • As mentioned, Secrets are either in ENV or mounts.

Blocker: „Pod“ container has no access.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 20/32

slide-68
SLIDE 68

Docker image patching and Secrets

  • Approach: patching the Pod image to deploy encryption proxy and custom

networking

  • Access to Docker daemon and images possible
  • 1. Re-tag original Pod image
  • 2. Use original image as base for patched version
  • 3. Build patched image with Tencrypt scripts and proxy app, tagged as „original“
  • As mentioned, Secrets are either in ENV or mounts.

Blocker: „Pod“ container has no access.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 20/32

slide-69
SLIDE 69

Docker image patching and Secrets

  • Approach: patching the Pod image to deploy encryption proxy and custom

networking

  • Access to Docker daemon and images possible
  • 1. Re-tag original Pod image
  • 2. Use original image as base for patched version
  • 3. Build patched image with Tencrypt scripts and proxy app, tagged as „original“
  • As mentioned, Secrets are either in ENV or mounts.

Blocker: „Pod“ container has no access.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 20/32

slide-70
SLIDE 70

Docker image patching and Secrets

  • Approach: patching the Pod image to deploy encryption proxy and custom

networking

  • Access to Docker daemon and images possible
  • 1. Re-tag original Pod image
  • 2. Use original image as base for patched version
  • 3. Build patched image with Tencrypt scripts and proxy app, tagged as „original“
  • As mentioned, Secrets are either in ENV or mounts.

Blocker: „Pod“ container has no access.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 20/32

slide-71
SLIDE 71

Part 1: Setting up the Pods network

  • Traffic should either flow untouched or encrypted
  • eth0 adapter only egress interface in Pod
  • Approach: introduce tenc0 interface which has listening proxy application
  • Configure network to route Service traffic through tenc0 TUN
  • Proxy application reads from interface, encrypts and forwards
  • Blockers:

– Pod has no NET_ADMIN capability, cannot self-configure network – Using setcap, manipulating Docker or Security Context Constraint (SCC) does not work

  • Tencrypt: runs proxy from Host inside network namespace

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 21/32

slide-72
SLIDE 72

Part 1: Setting up the Pods network

  • Traffic should either flow untouched or encrypted
  • eth0 adapter only egress interface in Pod
  • Approach: introduce tenc0 interface which has listening proxy application
  • Configure network to route Service traffic through tenc0 TUN
  • Proxy application reads from interface, encrypts and forwards
  • Blockers:

– Pod has no NET_ADMIN capability, cannot self-configure network – Using setcap, manipulating Docker or Security Context Constraint (SCC) does not work

  • Tencrypt: runs proxy from Host inside network namespace

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 21/32

slide-73
SLIDE 73

Part 1: Setting up the Pods network

  • Traffic should either flow untouched or encrypted
  • eth0 adapter only egress interface in Pod
  • Approach: introduce tenc0 interface which has listening proxy application
  • Configure network to route Service traffic through tenc0 TUN
  • Proxy application reads from interface, encrypts and forwards
  • Blockers:

– Pod has no NET_ADMIN capability, cannot self-configure network – Using setcap, manipulating Docker or Security Context Constraint (SCC) does not work

  • Tencrypt: runs proxy from Host inside network namespace

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 21/32

slide-74
SLIDE 74

Part 1: Setting up the Pods network

  • Traffic should either flow untouched or encrypted
  • eth0 adapter only egress interface in Pod
  • Approach: introduce tenc0 interface which has listening proxy application
  • Configure network to route Service traffic through tenc0 TUN
  • Proxy application reads from interface, encrypts and forwards
  • Blockers:

– Pod has no NET_ADMIN capability, cannot self-configure network – Using setcap, manipulating Docker or Security Context Constraint (SCC) does not work

  • Tencrypt: runs proxy from Host inside network namespace

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 21/32

slide-75
SLIDE 75

Part 1: Setting up the Pods network

  • Traffic should either flow untouched or encrypted
  • eth0 adapter only egress interface in Pod
  • Approach: introduce tenc0 interface which has listening proxy application
  • Configure network to route Service traffic through tenc0 TUN
  • Proxy application reads from interface, encrypts and forwards
  • Blockers:

– Pod has no NET_ADMIN capability, cannot self-configure network – Using setcap, manipulating Docker or Security Context Constraint (SCC) does not work

  • Tencrypt: runs proxy from Host inside network namespace

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 21/32

slide-76
SLIDE 76

Part 1: Setting up the Pods network

  • Traffic should either flow untouched or encrypted
  • eth0 adapter only egress interface in Pod
  • Approach: introduce tenc0 interface which has listening proxy application
  • Configure network to route Service traffic through tenc0 TUN
  • Proxy application reads from interface, encrypts and forwards
  • Blockers:

– Pod has no NET_ADMIN capability, cannot self-configure network – Using setcap, manipulating Docker or Security Context Constraint (SCC) does not work

  • Tencrypt: runs proxy from Host inside network namespace

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 21/32

slide-77
SLIDE 77

Part 1: Setting up the Pods network

  • Traffic should either flow untouched or encrypted
  • eth0 adapter only egress interface in Pod
  • Approach: introduce tenc0 interface which has listening proxy application
  • Configure network to route Service traffic through tenc0 TUN
  • Proxy application reads from interface, encrypts and forwards
  • Blockers:

– Pod has no NET_ADMIN capability, cannot self-configure network – Using setcap, manipulating Docker or Security Context Constraint (SCC) does not work

  • Tencrypt: runs proxy from Host inside network namespace

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 21/32

slide-78
SLIDE 78

Part 1: Setting up the Pods network

  • Traffic should either flow untouched or encrypted
  • eth0 adapter only egress interface in Pod
  • Approach: introduce tenc0 interface which has listening proxy application
  • Configure network to route Service traffic through tenc0 TUN
  • Proxy application reads from interface, encrypts and forwards
  • Blockers:

– Pod has no NET_ADMIN capability, cannot self-configure network – Using setcap, manipulating Docker or Security Context Constraint (SCC) does not work

  • Tencrypt: runs proxy from Host inside network namespace

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 21/32

slide-79
SLIDE 79

Part 1: Setting up the Pods network

  • Traffic should either flow untouched or encrypted
  • eth0 adapter only egress interface in Pod
  • Approach: introduce tenc0 interface which has listening proxy application
  • Configure network to route Service traffic through tenc0 TUN
  • Proxy application reads from interface, encrypts and forwards
  • Blockers:

– Pod has no NET_ADMIN capability, cannot self-configure network – Using setcap, manipulating Docker or Security Context Constraint (SCC) does not work

  • Tencrypt: runs proxy from Host inside network namespace

Networking pitfalls

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 21/32

slide-80
SLIDE 80

Part 2: Differentiation of Project-internal and

  • external traffic flows
  • Traffic can be either Project-internal, -external or egress (NAT)
  • Only Project-internal traffic should be encrypted
  • Pods do not have access to NAMESPACE environment variable
  • Services use DNS hierarchy with name of Project
  • Approach: use DNS to identify type of remote (virtual) IP by reverse lookup
  • Tencrypt: reads local /etc/resolv.conf for own name,

queries hostnames of remote IPs and compares

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 22/32

slide-81
SLIDE 81

Part 2: Differentiation of Project-internal and

  • external traffic flows
  • Traffic can be either Project-internal, -external or egress (NAT)
  • Only Project-internal traffic should be encrypted
  • Pods do not have access to NAMESPACE environment variable
  • Services use DNS hierarchy with name of Project
  • Approach: use DNS to identify type of remote (virtual) IP by reverse lookup
  • Tencrypt: reads local /etc/resolv.conf for own name,

queries hostnames of remote IPs and compares

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 22/32

slide-82
SLIDE 82

Part 2: Differentiation of Project-internal and

  • external traffic flows
  • Traffic can be either Project-internal, -external or egress (NAT)
  • Only Project-internal traffic should be encrypted
  • Pods do not have access to NAMESPACE environment variable
  • Services use DNS hierarchy with name of Project
  • Approach: use DNS to identify type of remote (virtual) IP by reverse lookup
  • Tencrypt: reads local /etc/resolv.conf for own name,

queries hostnames of remote IPs and compares

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 22/32

slide-83
SLIDE 83

Part 2: Differentiation of Project-internal and

  • external traffic flows
  • Traffic can be either Project-internal, -external or egress (NAT)
  • Only Project-internal traffic should be encrypted
  • Pods do not have access to NAMESPACE environment variable
  • Services use DNS hierarchy with name of Project
  • Approach: use DNS to identify type of remote (virtual) IP by reverse lookup
  • Tencrypt: reads local /etc/resolv.conf for own name,

queries hostnames of remote IPs and compares

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 22/32

slide-84
SLIDE 84

Part 2: Differentiation of Project-internal and

  • external traffic flows
  • Traffic can be either Project-internal, -external or egress (NAT)
  • Only Project-internal traffic should be encrypted
  • Pods do not have access to NAMESPACE environment variable
  • Services use DNS hierarchy with name of Project
  • Approach: use DNS to identify type of remote (virtual) IP by reverse lookup
  • Tencrypt: reads local /etc/resolv.conf for own name,

queries hostnames of remote IPs and compares

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 22/32

slide-85
SLIDE 85

Part 2: Differentiation of Project-internal and

  • external traffic flows
  • Traffic can be either Project-internal, -external or egress (NAT)
  • Only Project-internal traffic should be encrypted
  • Pods do not have access to NAMESPACE environment variable
  • Services use DNS hierarchy with name of Project
  • Approach: use DNS to identify type of remote (virtual) IP by reverse lookup
  • Tencrypt: reads local /etc/resolv.conf for own name,

queries hostnames of remote IPs and compares

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 22/32

slide-86
SLIDE 86

Part 3: Encryption of traffic

  • Client issues a request to a remote Service, asks DNS and connects to VIP
  • VIP is routed through tenc0 interface, proxy app reads packets
  • Proxy app encrypts and encapsulates packet, sends it as UDP payload to

remote Tencrypt endpoint

  • Remote Tencrypt UDP socket decrypts packet, changes destination address,

forwards to local Service

  • Reply same way but in reverse
  • Other ideas in paper: IP_TRANSPARENT, SOCKS5, enforcing encrypted traffic

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 23/32

slide-87
SLIDE 87

Part 3: Encryption of traffic

  • Client issues a request to a remote Service, asks DNS and connects to VIP
  • VIP is routed through tenc0 interface, proxy app reads packets
  • Proxy app encrypts and encapsulates packet, sends it as UDP payload to

remote Tencrypt endpoint

  • Remote Tencrypt UDP socket decrypts packet, changes destination address,

forwards to local Service

  • Reply same way but in reverse
  • Other ideas in paper: IP_TRANSPARENT, SOCKS5, enforcing encrypted traffic

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 23/32

slide-88
SLIDE 88

Part 3: Encryption of traffic

  • Client issues a request to a remote Service, asks DNS and connects to VIP
  • VIP is routed through tenc0 interface, proxy app reads packets
  • Proxy app encrypts and encapsulates packet, sends it as UDP payload to

remote Tencrypt endpoint

  • Remote Tencrypt UDP socket decrypts packet, changes destination address,

forwards to local Service

  • Reply same way but in reverse
  • Other ideas in paper: IP_TRANSPARENT, SOCKS5, enforcing encrypted traffic

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 23/32

slide-89
SLIDE 89

Part 3: Encryption of traffic

  • Client issues a request to a remote Service, asks DNS and connects to VIP
  • VIP is routed through tenc0 interface, proxy app reads packets
  • Proxy app encrypts and encapsulates packet, sends it as UDP payload to

remote Tencrypt endpoint

  • Remote Tencrypt UDP socket decrypts packet, changes destination address,

forwards to local Service

  • Reply same way but in reverse
  • Other ideas in paper: IP_TRANSPARENT, SOCKS5, enforcing encrypted traffic

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 23/32

slide-90
SLIDE 90

Part 3: Encryption of traffic

  • Client issues a request to a remote Service, asks DNS and connects to VIP
  • VIP is routed through tenc0 interface, proxy app reads packets
  • Proxy app encrypts and encapsulates packet, sends it as UDP payload to

remote Tencrypt endpoint

  • Remote Tencrypt UDP socket decrypts packet, changes destination address,

forwards to local Service

  • Reply same way but in reverse
  • Other ideas in paper: IP_TRANSPARENT, SOCKS5, enforcing encrypted traffic

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 23/32

slide-91
SLIDE 91

Part 3: Encryption of traffic

  • Client issues a request to a remote Service, asks DNS and connects to VIP
  • VIP is routed through tenc0 interface, proxy app reads packets
  • Proxy app encrypts and encapsulates packet, sends it as UDP payload to

remote Tencrypt endpoint

  • Remote Tencrypt UDP socket decrypts packet, changes destination address,

forwards to local Service

  • Reply same way but in reverse
  • Other ideas in paper: IP_TRANSPARENT, SOCKS5, enforcing encrypted traffic

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 23/32

slide-92
SLIDE 92

Node Pod

eth0 vethA br0 tun0

C

tenc0

default route for Services IPs binds to eth0

Proxy app

reads Figure 2: Overview of the proxy application implementation schema

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 24/32

slide-93
SLIDE 93

Proof of concept implementation

  • Four components:
  • 1. DNS upstream proxy, parsing replies
  • 2. TUN interface handler, reading packets and writing replies
  • 3. UDP encapsulation, encryption and decryption, UDP listener on a specified port
  • 4. Raw sockets to forward packets on local interface
  • DNS proxy uses static connection to upstream
  • White-listing of external hosts
  • DNAT on received packets

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 25/32

slide-94
SLIDE 94

Flow for DNS request/reply

Client App Client Pod Upstream DNS Binds to tenc0 Socket DNS request DNS request DNS reply Parsing of answers White-listing of host if external DNS reply

Figure 3: Traffic flow part one, DNS proxy

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 26/32

slide-95
SLIDE 95

Flow for client request to remote Service

Figure 4: Traffic flow part two, client issues a request to a Service

slide-96
SLIDE 96

Flow for Service replies

Figure 5: Traffic flow part three, Service replies to request

slide-97
SLIDE 97

Throughput measurements

Test description Transmitted Throughput server Throughput client no patch, 1 client 22640.38 MB 2262.3 MB/s 2263.83 MB/s no patch, 5 clients 27350.0 MB 2724.02 MB/s 2727.22 MB/s no patch, 10 clients 25817.38 MB 2410.15 MB/s 2538.02 MB/s patched, 1 client 2.46 MB 0.01 MB/s 0.16 MB/s patched, 5 clients 12.29 MB 0.06 MB/s 0.82 MB/s patched, 10 clients 24.58 MB 0.13 MB/s 1.64 MB/s patched, 20 clients 24.86 MB 0.12 MB/s 3.27 MB/s

Figure 6: Results of iperf measurements with different amounts of clients. Taken with iperf inside the Minishift VM (Virtualbox, 2 CPUs, 2GB RAM).

Observation: amount of clients in patched environment makes a difference, bandwidth is summed up. Probable cause: caching. Should not be taken too seriously, as implementation is unoptimised proof of concept.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 29/32

slide-98
SLIDE 98

Introduction Red Hat OpenShift Networking, Security Security requirements and threat model Encrypting traffic between Pods Fundamentals, ideas and possible approaches Using Minishift for experimental implementations Implementation concepts Proof of concept implementation Throughput measurements Conclusion

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 30/32

slide-99
SLIDE 99

Conclusion

  • Original aim: transparent encryption of Pod-to-Pod traffic per Tenant
  • Step 1: Analysis of the OpenShift network setup
  • Step 2: Defining security requirements and threats
  • Step 3: Design approach alternatives
  • Step 4: Exploration of different implementation parts
  • Step 5: Proof of concept implementation
  • Result: implementation works, concept proved to be usable
  • Future work: test integration of concept into existing OpenShift code base,

re-write proxy application

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 31/32

slide-100
SLIDE 100

Conclusion

  • Original aim: transparent encryption of Pod-to-Pod traffic per Tenant
  • Step 1: Analysis of the OpenShift network setup
  • Step 2: Defining security requirements and threats
  • Step 3: Design approach alternatives
  • Step 4: Exploration of different implementation parts
  • Step 5: Proof of concept implementation
  • Result: implementation works, concept proved to be usable
  • Future work: test integration of concept into existing OpenShift code base,

re-write proxy application

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 31/32

slide-101
SLIDE 101

Conclusion

  • Original aim: transparent encryption of Pod-to-Pod traffic per Tenant
  • Step 1: Analysis of the OpenShift network setup
  • Step 2: Defining security requirements and threats
  • Step 3: Design approach alternatives
  • Step 4: Exploration of different implementation parts
  • Step 5: Proof of concept implementation
  • Result: implementation works, concept proved to be usable
  • Future work: test integration of concept into existing OpenShift code base,

re-write proxy application

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 31/32

slide-102
SLIDE 102

Conclusion

  • Original aim: transparent encryption of Pod-to-Pod traffic per Tenant
  • Step 1: Analysis of the OpenShift network setup
  • Step 2: Defining security requirements and threats
  • Step 3: Design approach alternatives
  • Step 4: Exploration of different implementation parts
  • Step 5: Proof of concept implementation
  • Result: implementation works, concept proved to be usable
  • Future work: test integration of concept into existing OpenShift code base,

re-write proxy application

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 31/32

slide-103
SLIDE 103

Conclusion

  • Original aim: transparent encryption of Pod-to-Pod traffic per Tenant
  • Step 1: Analysis of the OpenShift network setup
  • Step 2: Defining security requirements and threats
  • Step 3: Design approach alternatives
  • Step 4: Exploration of different implementation parts
  • Step 5: Proof of concept implementation
  • Result: implementation works, concept proved to be usable
  • Future work: test integration of concept into existing OpenShift code base,

re-write proxy application

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 31/32

slide-104
SLIDE 104

Conclusion

  • Original aim: transparent encryption of Pod-to-Pod traffic per Tenant
  • Step 1: Analysis of the OpenShift network setup
  • Step 2: Defining security requirements and threats
  • Step 3: Design approach alternatives
  • Step 4: Exploration of different implementation parts
  • Step 5: Proof of concept implementation
  • Result: implementation works, concept proved to be usable
  • Future work: test integration of concept into existing OpenShift code base,

re-write proxy application

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 31/32

slide-105
SLIDE 105

Conclusion

  • Original aim: transparent encryption of Pod-to-Pod traffic per Tenant
  • Step 1: Analysis of the OpenShift network setup
  • Step 2: Defining security requirements and threats
  • Step 3: Design approach alternatives
  • Step 4: Exploration of different implementation parts
  • Step 5: Proof of concept implementation
  • Result: implementation works, concept proved to be usable
  • Future work: test integration of concept into existing OpenShift code base,

re-write proxy application

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 31/32

slide-106
SLIDE 106

Conclusion

  • Original aim: transparent encryption of Pod-to-Pod traffic per Tenant
  • Step 1: Analysis of the OpenShift network setup
  • Step 2: Defining security requirements and threats
  • Step 3: Design approach alternatives
  • Step 4: Exploration of different implementation parts
  • Step 5: Proof of concept implementation
  • Result: implementation works, concept proved to be usable
  • Future work: test integration of concept into existing OpenShift code base,

re-write proxy application

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 31/32

slide-107
SLIDE 107

Sources and further information

These slides and the associated report with further references will be published

  • n my website https://dpataky.eu and can be used under the CC BY-SA 4.0

license. [Sho14] Adam Shostack. Threat modeling designing for security. J. Wiley & Sons,

  • 2014. ISBN: 9781118809990.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 32/32

slide-108
SLIDE 108

Appendix

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 33/32

slide-109
SLIDE 109

Note about Containerisation

  • Threat analysis does not cover attacks on a host by a priviledged attacker
  • Administrative access to namespaces cannot be fend off by Tencrypt
  • Future mechanisms might solve this problem

(hardware-based memory isolation)

  • But: Tencrypt stays inside namespace and generally reduces attack vectors

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 34/32

slide-110
SLIDE 110

Note about Containerisation

  • Threat analysis does not cover attacks on a host by a priviledged attacker
  • Administrative access to namespaces cannot be fend off by Tencrypt
  • Future mechanisms might solve this problem

(hardware-based memory isolation)

  • But: Tencrypt stays inside namespace and generally reduces attack vectors

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 34/32

slide-111
SLIDE 111

Note about Containerisation

  • Threat analysis does not cover attacks on a host by a priviledged attacker
  • Administrative access to namespaces cannot be fend off by Tencrypt
  • Future mechanisms might solve this problem

(hardware-based memory isolation)

  • But: Tencrypt stays inside namespace and generally reduces attack vectors

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 34/32

slide-112
SLIDE 112

Note about Containerisation

  • Threat analysis does not cover attacks on a host by a priviledged attacker
  • Administrative access to namespaces cannot be fend off by Tencrypt
  • Future mechanisms might solve this problem

(hardware-based memory isolation)

  • But: Tencrypt stays inside namespace and generally reduces attack vectors

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 34/32

slide-113
SLIDE 113

Pitfalls in networking

  • Boot2Docker misses some features, nsenter only in CentOS
  • Approach to use local proxy application with DNAT fails, because addresses

are lost (combination of IPtables mangle and TPROXY)

  • Using TAP interface on layer 2 requires implementation of ARP
  • Routes might result in loop, proxy is routed through itself
  • Tencrypt: uses policy-based routing (ip rule), two tables and 1440 bytes MTU

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 35/32

slide-114
SLIDE 114

Pitfalls in networking

  • Boot2Docker misses some features, nsenter only in CentOS
  • Approach to use local proxy application with DNAT fails, because addresses

are lost (combination of IPtables mangle and TPROXY)

  • Using TAP interface on layer 2 requires implementation of ARP
  • Routes might result in loop, proxy is routed through itself
  • Tencrypt: uses policy-based routing (ip rule), two tables and 1440 bytes MTU

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 35/32

slide-115
SLIDE 115

Pitfalls in networking

  • Boot2Docker misses some features, nsenter only in CentOS
  • Approach to use local proxy application with DNAT fails, because addresses

are lost (combination of IPtables mangle and TPROXY)

  • Using TAP interface on layer 2 requires implementation of ARP
  • Routes might result in loop, proxy is routed through itself
  • Tencrypt: uses policy-based routing (ip rule), two tables and 1440 bytes MTU

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 35/32

slide-116
SLIDE 116

Pitfalls in networking

  • Boot2Docker misses some features, nsenter only in CentOS
  • Approach to use local proxy application with DNAT fails, because addresses

are lost (combination of IPtables mangle and TPROXY)

  • Using TAP interface on layer 2 requires implementation of ARP
  • Routes might result in loop, proxy is routed through itself
  • Tencrypt: uses policy-based routing (ip rule), two tables and 1440 bytes MTU

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 35/32

slide-117
SLIDE 117

Pitfalls in networking

  • Boot2Docker misses some features, nsenter only in CentOS
  • Approach to use local proxy application with DNAT fails, because addresses

are lost (combination of IPtables mangle and TPROXY)

  • Using TAP interface on layer 2 requires implementation of ARP
  • Routes might result in loop, proxy is routed through itself
  • Tencrypt: uses policy-based routing (ip rule), two tables and 1440 bytes MTU

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 35/32

slide-118
SLIDE 118

Related tools and products

  • OKD Secured Routes: encryption of traffic from ingress Router to Service
  • IPsec: encrypted Node-to-Node and Node-to-Master channels
  • Aporeto: security suite for Kubernetes in different Cloud environments.

Offers TLS-encrypted end-to-end encryption and policies.

  • Aqua Security: Container security by using Container-level firewalls, but no

encryption

  • Istio Auth: uses „Envoy“ Service proxies inside Pods to tunnel traffic with
  • mTLS. Uses the Secure Production Identity Framework for Everyone (SPIFFE)

framework.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 36/32

slide-119
SLIDE 119

Related tools and products

  • OKD Secured Routes: encryption of traffic from ingress Router to Service
  • IPsec: encrypted Node-to-Node and Node-to-Master channels
  • Aporeto: security suite for Kubernetes in different Cloud environments.

Offers TLS-encrypted end-to-end encryption and policies.

  • Aqua Security: Container security by using Container-level firewalls, but no

encryption

  • Istio Auth: uses „Envoy“ Service proxies inside Pods to tunnel traffic with
  • mTLS. Uses the Secure Production Identity Framework for Everyone (SPIFFE)

framework.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 36/32

slide-120
SLIDE 120

Related tools and products

  • OKD Secured Routes: encryption of traffic from ingress Router to Service
  • IPsec: encrypted Node-to-Node and Node-to-Master channels
  • Aporeto: security suite for Kubernetes in different Cloud environments.

Offers TLS-encrypted end-to-end encryption and policies.

  • Aqua Security: Container security by using Container-level firewalls, but no

encryption

  • Istio Auth: uses „Envoy“ Service proxies inside Pods to tunnel traffic with
  • mTLS. Uses the Secure Production Identity Framework for Everyone (SPIFFE)

framework.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 36/32

slide-121
SLIDE 121

Related tools and products

  • OKD Secured Routes: encryption of traffic from ingress Router to Service
  • IPsec: encrypted Node-to-Node and Node-to-Master channels
  • Aporeto: security suite for Kubernetes in different Cloud environments.

Offers TLS-encrypted end-to-end encryption and policies.

  • Aqua Security: Container security by using Container-level firewalls, but no

encryption

  • Istio Auth: uses „Envoy“ Service proxies inside Pods to tunnel traffic with
  • mTLS. Uses the Secure Production Identity Framework for Everyone (SPIFFE)

framework.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 36/32

slide-122
SLIDE 122

Related tools and products

  • OKD Secured Routes: encryption of traffic from ingress Router to Service
  • IPsec: encrypted Node-to-Node and Node-to-Master channels
  • Aporeto: security suite for Kubernetes in different Cloud environments.

Offers TLS-encrypted end-to-end encryption and policies.

  • Aqua Security: Container security by using Container-level firewalls, but no

encryption

  • Istio Auth: uses „Envoy“ Service proxies inside Pods to tunnel traffic with
  • mTLS. Uses the Secure Production Identity Framework for Everyone (SPIFFE)

framework.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 36/32

slide-123
SLIDE 123

Related technologies

  • MACsec: encryption and integrity on layer 2. Extends Ethernet frames with

MACsec tag. Standard as IEEE 802.1AE.

  • Single Root I/O Virtualization (SR-IOV): virtualisation of PCI Express

hardware resources done by the board itself. VMs see shared PCI-E components as exclusive.

  • Cisco Application Centric Infrastructure (ACI): SDN-oriented policy-based

framework developed by Cisco. Better management with VXLAN, ECMP routing and SDN controllers.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 37/32

slide-124
SLIDE 124

Related technologies

  • MACsec: encryption and integrity on layer 2. Extends Ethernet frames with

MACsec tag. Standard as IEEE 802.1AE.

  • Single Root I/O Virtualization (SR-IOV): virtualisation of PCI Express

hardware resources done by the board itself. VMs see shared PCI-E components as exclusive.

  • Cisco Application Centric Infrastructure (ACI): SDN-oriented policy-based

framework developed by Cisco. Better management with VXLAN, ECMP routing and SDN controllers.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 37/32

slide-125
SLIDE 125

Related technologies

  • MACsec: encryption and integrity on layer 2. Extends Ethernet frames with

MACsec tag. Standard as IEEE 802.1AE.

  • Single Root I/O Virtualization (SR-IOV): virtualisation of PCI Express

hardware resources done by the board itself. VMs see shared PCI-E components as exclusive.

  • Cisco Application Centric Infrastructure (ACI): SDN-oriented policy-based

framework developed by Cisco. Better management with VXLAN, ECMP routing and SDN controllers.

Tencrypt: Encrypting Tenant-Traffic in OpenShift Chair of Computer Networks // Dominik Pataky Dresden, 15th November, 2018 37/32