Protecting OpenFlow using Intel SGX

Medina, Jorge; Paladiy, Nicolae; Arlosz, Patrik

doi:10.1109/nfv-sdn47374.2019.9039980

Cited by 7 publications

(12 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We studied four Open vSwitch flow table operations: add flow rule, delete flow rule, modify flow rule, and evict flow rule. The performance of each operation has been compared across five different versions: baseline is the original version, SGX vanilla is the OFTinSGX from [21], Switchless uses hotcalls instead of ECALLs as described in [32] while Bundler uses all optimization described in this paper. Finally SGX refactored is the authors heavily modified version tailored specifically for SGX and will be used to compare the trade-offs between performance and development effort.…”

Section: Preliminary Resultsmentioning

confidence: 99%

“…Furthermore, an attacker could inject malicious data into flow tables to propagate deeper into the network and compromise systems otherwise not reachable [8]. Proposed solutions to address flow table security issues include auditing flow table to detect discrepancies between the configured and current behavior [19], validating both executables and flow tables with a TPM [10], or moving critical components (the OpenFlow flow tables and forwarding logic) into Intel SGX enclaves [21]. The latter, while promising from a security point of view, is a very labor-intensive task and introduces additional overhead.…”

Section: Open Vswitchmentioning

confidence: 99%

“…Software-Defined Networking (SDN) and in particular the SDN control plane has been extensively scrutinized by the security research community [28], [2]. Some researchers considered the use [21]. While this provided confidentiality and integrity guarantees to flow tables, it introduced a significant performance degradation to OvS.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Faster enclave transitions for IO-intensive network applications

Svenningsson

Paladi

Vahidi

2021

Proceedings of the ACM SIGCOMM 2021 Workshop on Secure Programmable Network INfrastructure

View full text Add to dashboard Cite

Process-based confidential computing enclaves such as Intel SGX have been proposed for protecting the confidentiality and integrity of network applications, without the overhead of virtualization. However, these solutions introduce other types of overhead, particularly the cost transitioning in and out of an enclave context. This makes the use of enclaves impractical for running IO-intensive applications, such as network packet processing. We build on earlier approaches to improve the IO performance of workloads in Intel SGX enclaves and propose the HotCall-Bundler library that helps reduce the cost of individual single enclave transitions and the total number of enclave transitions in trusted applications running in Intel SGX enclaves. We describe the implementation of the HotCall-Bundler library, evaluate its performance and demonstrate its practicality using the case study of Open vSwitch, a widely used software switch implementation. CCS CONCEPTS• Security and privacy → Network security; Systems security; Security in hardware; Systems security; • Networks → Bridges and switches.

show abstract

Section: Preliminary Resultsmentioning

confidence: 99%

Section: Open Vswitchmentioning

confidence: 99%

See 1 more Smart Citation

Faster enclave transitions for IO-intensive network applications

Svenningsson

Paladi

Vahidi

2021

Proceedings of the ACM SIGCOMM 2021 Workshop on Secure Programmable Network INfrastructure

View full text Add to dashboard Cite

show abstract

“…3 shows the TLSonSGX system design. In recent works OFTinSGX has been proposed by [9], which has four components: SGX OpenFlow table, SGX rule structure, SGX Eviction component, and SGX tables dpif, which helps OvS to delegate its OpenFlow tables and forward logic to enclave memory.…”

Section: Related Workmentioning

confidence: 99%

“…This has lead to the development of a secure running environment by industrial hardware companies for a safety-critical application that maintains little reliance or less dependency upon the operating system and hypervisor. Up to today, we found two main technology which are ARM Trust Zone Technology, Intel Software Guard Extensions (SGX) [9] [10].…”

Section: Introductionmentioning

confidence: 99%

Secure Software Defined Networks Controller Storage using Intel Software Guard Extensions

Qasmaoui¹,

Maleh²,

Haqiq³

2020

IJACSA

View full text Add to dashboard Cite

The SDN controller is the core of the softwaredefined network (SDN), which provides important network operations that needs to be protected from all type of threats. Many researches have been focusing on different layers of security regarding the SDN controller such as Anti-DDOS system or enforcement of TLS connection between the controller and the Open-vswitches. One of the major security threats targeting any program is the environment execution itself (e.g. Operating system and the hardware itself). Intel's Software Guard Extension (SGX) offers a sloid layer of security applied to applications by creating a Trusted execution environment. SDN controller relay on a storage module to keep sensitive data such as Flow Rules, users' credentials and configuration files. Protecting this side of the SDN controller is a must in term of security. To date, no work has been conducted considering SDN controller storage security using Intel SGX. This paper introduces an SGX enabled SDN controller. The new controller ensures the integrity and the confidentiality in a trusted execution environment by leveraging a recent hardware technology called intel SGX. This technology provides a trusted and secure enclave. Enclaves are sealed and unsealed by intel SGX attestation mechanisms to protect the executed code and data inside live memory and disk from being altered by any unauthorized access. High privileged codes such as the OS itself is kept from altering data inside enclaves. We implemented the Intel SGX using the Floodlight SDN controller running a real enabled Intel SGX hardware. Our evaluation shows that the SGX enabled SDN controller introduces a slightly observable performance overhead to the floodlight controller compared to advantages in term of security.

show abstract

Chuchotage: In-line Software Network Protocol Translation for (D)TLS

Bideh

Paladi

2022

Information and Communications Security

View full text Add to dashboard Cite

The growing diversity of connected devices leads to complex network deployments, often made up of endpoints that implement incompatible network application protocols. Communication between heterogeneous network protocols was traditionally enabled by hardware translators or gateways. However, such solutions are increasingly unfit to address the security, scalability, and latency requirements of modern software-driven deployments. To address these shortcomings we propose Chuchotage, a protocol translation architecture for secure and scalable machine-to-machine communication. Chuchotage enables in-line TLS interception and confidential protocol translation for software-defined networks. Translation is done in ephemeral, flow-specific Trusted Execution Environments and scales with the number of network flows. Our evaluation of Chuchotage implementing an HTTP to CoAP translation indicates a minimal transmission and translation overhead, allowing its integration with legacy or outdated deployments.

show abstract

Protecting OpenFlow using Intel SGX

Cited by 7 publications

References 14 publications

Faster enclave transitions for IO-intensive network applications

Faster enclave transitions for IO-intensive network applications

Secure Software Defined Networks Controller Storage using Intel Software Guard Extensions

Chuchotage: In-line Software Network Protocol Translation for (D)TLS

Contact Info

Product

Resources

About