Enabling Practical SDN Security Applications with OFX (The OpenFlow extension Framework)

Transcription

1 Enabling Practical SDN Security Applications with OFX (The OpenFlow extension Framework) John Sonchack, Adam J. Aviv, Eric Keller, and Jonathan M. Smith

2 Outline Introduction Overview of OFX Using OFX Benchmarks 2

3 Basic Networking: Forwarding and Routing Packet Forwarding Route Computation? 3

4 SDNs: Networking in Two Planes Route computation Control Plane Packet forwarding Data Plane 4

5 OpenFlow: A Protocol to Manage Switches Route computation Control Plane Flow rules to implement routes Packet forwarding Data Plane 5

6 OpenFlow: A Protocol to Manage Switches Route computation Control Plane Flow rules to implement routes Assumption: Interactions between the control plane and data plane are infrequent. Packet forwarding Data Plane 6

7 SDNs for Network Security Access Control Policy Control Plane Access Control Flow rules to implement access control policy Casado, Martin, et al. "Ethane: taking control of the enterprise." ACM SIGCOMM Computer Communication Review. Vol. 37. No. 4. ACM, Data Plane

8 SDNs for Dynamic Network Security Traffic Declassification Control Plane Advanced Processing Access Control Route for flow DDoS Defense Bot Detection Packet from new flow 8 Data Plane

9 SDNs for Dynamic Network Security: Flow Monitoring Control Plane Gu, Guofei, et al. "BotMiner: Clustering Analysis of Network Traffic for Protocol-and Structure- Independent Botnet Detection." USENIX Security Symposium. Vol. 5. No Collect flow records without routing through a middlebox. Install byte counting rule Bot Detection Packet from new TCP flow 9 Data Plane

10 SDNs for Dynamic Network Security: Traffic Declassification Traffic Declassification Control Plane Check flow tags and user permissions declassification decision (Allow Block) Enforce access control on tagged data leaving the network. Mundada, Yogesh, Anirudh Ramachandran, and Nick Feamster. "SilverLine: preventing data leaks from compromised web applications." Proceedings of the 29th Annual Computer Security Applications Conference. ACM, Can this flow leave the network? 10 Data Plane

11 SDNs for Dynamic Network Security Traffic Declassification Control Plane Advanced Processing Access Control Route for flow DDoS Defense Bot Detection Packet from new flow 11 Data Plane

12 SDNs for Dynamic Network Security Traffic Declassification Control Plane Advanced Processing Access Control Route for flow DDoS Defense Assumption: Interactions between the control plane and data plane are infrequent. Bot Detection Packet from new flow 12 Data Plane

13 Obstacle: Low Throughput Control Path 130 million packets/second!!!!* *can only forward 500 pps to controller. Appelman, Michiel, and Maikel de Boer. "Performance analysis of OpenFlow hardware." University of Amsterdam, Tech. Rep (2012). Curtis, Andrew R., et al. "DevoFlow: scaling flow management for high-performance networks." ACM SIGCOMM Computer Communication Review. Vol. 41. No. 4. ACM,

14 Obstacle: Centralized Control Plane New Flow New Flow New Flow New Flow New Flow New Flow New Flow New Flow 14

15 Our question: How Can We Make SDNs More Practical? Traffic Declassification Control Plane Access Control DDoS Defense Bot Detection Data Plane 15

16 The General Approach: Switch Level Security Traffic Declassification Control Plane Access Control DDoS Defense Bot Detection Data Plane 16

17 Previous Work: Security Functionality in the Forwarding Engine Build new switch chips that support security applications Shin, Seungwon, et al. "Avant-guard: Scalable and vigilant switch flow management in software-defined networks." Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security. ACM,

18 Our insight: Leverage Switch CPUs Run security logic on the switch CPUs 18

19 OFX: A Framework for Application- Specific Switch Extensions Each application can load custom functionality into switches. At runtime! Declassification Declassification 19

20 Outline Introduction Overview of OFX Using OFX Benchmarks 20

21 OFX at a High Level stack 21

22 OFX at a High Level OFX Controller Library OFX Switch Agents stack OFX stack 22

23 OFX at a High Level Controller interface OFX Extension Module OFX Switch-level Agents logic stack OFX stack 23

24 OFX at a High Level Permissions Database Declassifier Module Per-Flow OFX Switch Declassification Agents Logic stack OFX stack 24

25 OFX at the Switch Level OFX modules use filters to select packets that they need to process OFX modules process packets with custom handler OFX installs corresponding rules onto OFX tables OpenFlow Switch OFX Agent Software Hardware OFX Module Packet Handler Ingress Packets OFX Filtering Tables Controller-managed forwarding tables Egress Packets 25

26 Outline Introduction Overview of OFX Using OFX Benchmarks 26

27 Refactoring OpenFlow Applications to use OFX OFX Declassifier Module

28 Refactoring OpenFlow Applications to use OFX OFX Declassifier Module

29 Outline Introduction Overview of OFX Using OFX Benchmarks 29

30 Benchmarking OFX How much raw overhead is there for processing packets with OFX? How do OFX based security applications perform, compared with Middlebox and OpenFlow implementations? 30

31 OFX Benchmark: Packets Per Second Log 10 Scale 100,000 Packet handler in controller Packet handler in OFX module Packets per Second 10,000 1, Packet Size MTU 45,000 MTU

32 Benchmarking OFX How much raw overhead is there for processing packets with OFX? How do OFX based security applications perform, compared with Middlebox and OpenFlow implementations? 32

33 Benchmark: Declassifier Packet Drop Rate Implementation Middlebox Proxy OpenFlow OFX Frequent arriving flows OpenFlow implementation limited by flow arrival rate Median High bandwidth flows 0.1% 0.1% 20.4% 97.5% 88.2% 0.1% 5.1% 3.2% 0.1% Proxy implementation limited by bit rate OFX implementation performed well in all workloads Workload Name Frequently arriving flows Median flows High bandwidth flows Flow Inter-arrival Period Seconds Seconds 0.15 Seconds Average Transmission Bandwidth Mbps Mbps Mbps. S. Kandula, S. Sengupta, A. Greenberg, P. Patel, and R. Chaiken, The nature of data center traffic: measurements & analysis, in Proceedings of the 9th ACM SIGCOMM conference on Internet measurement conference. ACM, 2009, pp L. Qian and B. E. Carpenter, A flow-based performance analysis of tcp and tcp applications, in Networks (ICON), th IEEE International Conference on. IEEE, 2012, pp

34 In the Paper OFX API and Implementation Details OpenFlow Controller Control Platform Application Specific Modules Enhanced Switch API Modules DDoS Defense TCP Handshake Validation OFX Library New TCP Flow Linux Kernel OpenFlow Switch OpenFlow Agent OFX Agent Push Based Alerts Bot Detection Linux Kernel Forwarding Engine Firmware OpenFlow Packet Path Condition Reached Linux Network Stack OFX Packet Path 34 More benchmarks Running on unmodified OpenFlow hardware!

35 Thank You OFX: The OpenFlow Extension Framework OFX Extension Module OFX lets OpenFlow security applications push parts of their control plane logic down to switch CPUs, which can greatly improve performance and scalability on existing hardware and software. 35