Multi-match Packet Classification Scheme Combining TCAM with an Algorithmic Approach

Lim, Hysook; Lee, Nara; Lee, Jung Won

doi:10.5573/ieiespc.2017.6.1.027

Cited by 2 publications

(1 citation statement)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this paper, we evaluate whether the de facto packet classification algorithm widely used in many popular software switches (OVS as our running example) is robust against denial-of-service (DoS) attacks ( §3). Our study has great importance since the targeted packet classification algorithm, namely, Tuple Space Search scheme (TSS) [64], is extensively used not only in traditional appliances but also in wide range of virtualized networked systems; just to name a few, software based intrusion detection systems [43], stateful NAT implementation [33,48], cloud management systems [25,71].…”

Section: Introductionmentioning

confidence: 99%

Tuple space explosion

Csikor

Divakaran²,

Kang

et al. 2019

Proceedings of the 15th International Conference on Emerging Networking Experiments and Technologies

View full text Add to dashboard Cite

Packet classification is one of the fundamental building blocks of various security primitives and thus it needs to be highly efficient and available. In this paper, we evaluate whether the de facto packet classification algorithm (i.e., Tuple Space Search scheme, TSS) used in many popular software networking stacks, e.g., Open vSwitch, VPP, HyperSwitch, is robust against low-rate denial-ofservice (DoS) attacks. We present the Tuple Space Explosion (TSE) attack that exploits the fundamental space/time complexity of the TSS algorithm. We demonstrate that the TSE attack can degrade the switch performance to as low as 12% of its full capacity with a very low packet rate (i.e., 0.7 Mbps) when the target packet classification only has simple policies, e.g., "allow a few flows but drop all others". Then, we show that if the adversary has partial knowledge of the installed classification policies, she can virtually bring down the packet classifier with the same low attack rate. The TSE attack, in general, does not generate any specific attack traffic patterns but some attack packets with randomly chosen IP headers and arbitrary message contents. This makes it particularly hard to build a signature of our attack traffic for detection. Since the TSE attack exploits the fundamental complexity characteristics of the TSS algorithm, unfortunately, there seems to be no complete mitigation of the problem. We thus suggest, as a long-term solution, to use other packet classification algorithms (e.g., hierarchical tries, HaRP, Hypercuts) that are not vulnerable to the TSE attack. As a short-term solution, we propose MFCGuard, a monitoring system that carefully manages the entries in the tuple space to keep packet classification fast for the packets that are eventually accepted by the system.

show abstract

Section: Introductionmentioning

confidence: 99%