Taking Control of SDN-based Cloud Systems via the Data Plane

Thimmaraju, Kashyap; Shastry, Bhargava; Fiebig, Tobias; Hetzelt, Felicitas; Seifert, Jean-Pierre; Feldmann, Anja; Schmid, Stefan

doi:10.1145/3185467.3185468

Cited by 46 publications

(34 citation statements)

References 50 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…eBPF thus protects the users against unexpected memory error or stack buffer overflow bugs. The bug reported in [29] can be avoided using this mechanism. Despite of these restrictions, eBPF has been proven to be sufficiently expressive to write packet processing code, together with extensions described below.…”

Section: Packet Processing Protectionmentioning

confidence: 99%

“…In 2018, Thimmaraju et al [29] report that existing software switches used as an NFV backend have vulnerability where attackers can hijack the entire network within minutes. They demonstrate this by injecting a malicious packet that causes a buffer overflow in the MPLS parser of the Open vSwitch data path [23].…”

Section: Introductionmentioning

confidence: 99%

“…The primary challenge here is how to do so without sacrificing performance and scalability. Thimmaraju et al [29] measure Open vSwitch performance with compilerlevel protection enabled to quantify overheads of software switch protection. Unfortunately, their results indicate nonnegligible overheads even for relatively low packet rates which are several hundreds of kilo packets per second.…”

Section: Introductionmentioning

confidence: 99%

“…Second, recent study demonstrated that even Open vSwitch, a widely-used production-quality software switch, contained a major bug in its data plane. It causes buffer overflow and allows the entire SDN system to be hijacked by worm propagated [29].…”

mentioning

confidence: 99%

See 3 more Smart Citations

Resilient Edge: A Scalable, Robust Network Function Backend

Hayakawa

Yasukata

Nakazawa³

et al. 2019

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

Increasing hardware resources, such as multi-core and multi-socket CPUs, memory capacity and high-speed NICs, impose significant challenges on Network Function Virtualization (NFV) backends. They increase the potential numbers of per-server NFs or tenants, which requires a packet switching architecture that is not only scalable to large number of virtual ports, but also robust to attacks on the data plane. This is a real problem; a recent study has reported that Open vSwitch, a widely used software switch, had a buffer-overflow bug in its data plane that results the entire SDN domain to be hijacked by worms propagated in the network. In order to address this problem, we propose REdge. It scales to thousands of virtual ports or NFs (as opposed to hundreds in the current state-of-the art), and protect modular, flexible packet switching logic against various bugs, such as buffer overflow and other unexpected operations using static program checking. When 2048 NFs are active and packets are distributed to them based on the MAC or IP addresses, REdge achieves 3.16 Mpps or higher packet forwarding rates for 60 byte packets and achieves the wire rate for 1500 byte packets in the 25 Gbps link.

show abstract

Section: Packet Processing Protectionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

Resilient Edge: A Scalable, Robust Network Function Backend

Hayakawa

Yasukata

Nakazawa³

et al. 2019

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

show abstract

“…Direct attacks on the cloud network infrastructure are less known; there has been work on fuzzing the data plane with considerable success [51,73] and compromising SDN controllers [7]. Denial of service using algorithmic complexity attacks [2,14,16,54] on the network data plane usually works by exploiting a vulnerable algorithm/data structure that is already in the targeted binary; e.g., [77] shows cache-collision attacks against the Linux IP stack and [20] targets stateful firewalls.…”

Section: Related Workmentioning

confidence: 99%

Tuple space explosion

Csikor

Divakaran²,

Kang

et al. 2019

Proceedings of the 15th International Conference on Emerging Networking Experiments and Technologies

Self Cite

View full text Add to dashboard Cite

Packet classification is one of the fundamental building blocks of various security primitives and thus it needs to be highly efficient and available. In this paper, we evaluate whether the de facto packet classification algorithm (i.e., Tuple Space Search scheme, TSS) used in many popular software networking stacks, e.g., Open vSwitch, VPP, HyperSwitch, is robust against low-rate denial-ofservice (DoS) attacks. We present the Tuple Space Explosion (TSE) attack that exploits the fundamental space/time complexity of the TSS algorithm. We demonstrate that the TSE attack can degrade the switch performance to as low as 12% of its full capacity with a very low packet rate (i.e., 0.7 Mbps) when the target packet classification only has simple policies, e.g., "allow a few flows but drop all others". Then, we show that if the adversary has partial knowledge of the installed classification policies, she can virtually bring down the packet classifier with the same low attack rate. The TSE attack, in general, does not generate any specific attack traffic patterns but some attack packets with randomly chosen IP headers and arbitrary message contents. This makes it particularly hard to build a signature of our attack traffic for detection. Since the TSE attack exploits the fundamental complexity characteristics of the TSS algorithm, unfortunately, there seems to be no complete mitigation of the problem. We thus suggest, as a long-term solution, to use other packet classification algorithms (e.g., hierarchical tries, HaRP, Hypercuts) that are not vulnerable to the TSE attack. As a short-term solution, we propose MFCGuard, a monitoring system that carefully manages the entries in the tuple space to keep packet classification fast for the packets that are eventually accepted by the system.

show abstract

Bilevel access control and constraint‐aware response provisioning in edge‐enabled software defined network‐internet of things network using the safeguard authentication dynamic access control model

D S,

S H

2024

Int J Communication

View full text Add to dashboard Cite

SummaryBy controlling the network, the Internet of Things (IoT)‐connected software‐defined network (SDN) limits the scalability of IoT devices. Since SDN depends on a centralized controller that attackers can easily affect, it is incredibly susceptible to attacks. Secure access control to the SDN controller was the focus of the prior methods for controller scalability and restricted trust management. A framework called Safeguard Authentication Dynamic Access Control (SANDMAC) is suggested to safeguard and offer useful services to enterprises. Authentication confirms legitimacy after all users and applications have been registered. To improve network security, policies let users grant access to account attributes, legal activities, and temporal components. The administrator lessens conflicts between the methods by validating and saving the policies in the database. The services are provided to dependable customers using the forensic‐based investigation algorithm, depending on the quality of service and software level agreements requirements, decreasing reaction times and maximizing resource usage. Performance comparisons between the new and previous efforts are validated using a variety of parameters, and the proposed work is validated using the iFogSim application. According to the findings, SANDMAC significantly raises key performance indicators. SANDMAC specifically keeps false positives at 3.5% and accomplishes a low response time of 60 ms for roughly 800 authorized accesses. SANDMAC is a better option because of these enhancements, which result in longer network lifetimes and more dependable data transmission.

show abstract

Taking Control of SDN-based Cloud Systems via the Data Plane

Cited by 46 publications

References 50 publications

Resilient Edge: A Scalable, Robust Network Function Backend

Resilient Edge: A Scalable, Robust Network Function Backend

Tuple space explosion

Bilevel access control and constraint‐aware response provisioning in edge‐enabled software defined network‐internet of things network using the safeguard authentication dynamic access control model

Contact Info

Product

Resources

About