Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking SSP 2018, Hildesheim Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev 08.11.2018 http://se.informatik.uni-wuerzburg.de/
Motivation No definite defense possible, only mitigation Long time security threat More dangerous than ever: • Increasing number of IoT devices • Generally lower security level Marginal performance increase of defense systems hardware Need for more effective mitigation approaches Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 2 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SYN Flood EXPLANATION Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 3 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
TCP TCP is a reliable transport protocol: • Retransmission of lost packets • Sorting of out-of-order packets Sequence number on every packet is necessary Initial sequence numbers are established in a three-way handshake Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 4 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
TCP Handshake Server Client Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 5 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SYN Flood Server Client Backlog: TCB sIP1 TCB TCB sIP1 sIP2 TCB TCB TCB sIP1 sIP2 sIP3 TCB TCB TCB TCB sIP1 sIP2 sIP3 sIP4 Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 6 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SYN Flood Explanation Attacker can spoof any source IP address Server has to create TCB and keep it for a while SYN packets are small: • 14 byte (Ethernet header) + 20 byte (IP header) + 20 byte (TCP header) = 54 byte • 1 Mbit/s can transport 2314 pps • 1 Mpps requires 432 Mbit/s Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 7 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SYN Flood EXISTING DEFENSE MECHANISMS Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 8 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SYN Cookies Server Client source dest. IP/Port IP/Port time mod 32 MSS crypt. option HASH 5 3 24 calculate expected cookie, compare with ackn-1 Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 9 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SYN Cookies Amount of half-open connections not limited by backlog CPU is burdened with hash calculations TCP options are restricted Only active when backlog is full Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 10 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SYN PROXY – Connection Establishment SYN Client PROXY Server Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 11 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SYN PROXY – Data Transfer SYN Client PROXY Server Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 12 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SYN PROXY Implemented as an IPtables module Does not have to run on target machine Only complete handshakes reach target Proxy cannot predetermine server’s ISN seqn/ackn translation always necessary Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 13 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
Limitations SYN Cookies SYN PROXY Has to run on service host Stateful No independent scaling Network bottle neck Independent scaling complex Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 14 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
In a Nutshell Problem: • Existing solutions can not easily be scaled indepentently from the service host Idea: • Complete handshake in proxy • Route subsequent packets directly Benefit: • Server handles only established connections • Proxy can specialize on handshake handling Action: • Develop proxy network function, utilize SDN, modify server kernel Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 15 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SYN Flood SDN/NFV APPROACH Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 16 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SDN and NFV Software Defined Networking Network Function Virtualization SDN switches’ behavior is determined by Network functions modify packets not a set of flows addressed to them • Firewall SDN controller modify and monitor flow sets of connected switches • Switch • IDS A flow consists of: Virtualized NF is running on COTS • Match hardware (instead of being an ASIC) • Action • Stats Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 17 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SDN/NFV Approach Attacker Server Gateway Client Traditional network Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 18 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SDN/NFV Approach Controller VNF Attacker Server Gateway OF-switch Client SDN enabled network Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 19 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SDN/NFV Approach Controller VNF Attacker Server Gateway OF-switch Prio Match Action Client 0 GW VNF 0 SERV VNF 0 VNF GW 1 VNF, daddr=s_ip SERV Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 20 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SDN/NFV Approach Attacker sends SYN packets with spoofed addresses Controller VNF SYN ACK Attacker SYN Server Gateway OF-switch Prio Match Action Client 0 GW VNF 0 SERV VNF 0 VNF GW 1 VNF, daddr=s_ip SERV Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 21 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
SDN/NFV Approach Client opens connection REST Controller VNF ACK OF SYN SYN+ ACK Attacker SYN Server Gateway OF-switch data ACK SYN data Prio Match Action Client ACK 0 GW VNF 0 SERV VNF 0 VNF GW 1 VNF, daddr=s_ip SERV 10 GW, from client SERV 10 SERV, to client GW Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 22 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
IMPLEMENTATION Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 23 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
Implementation: Kernel Modification Simple concept Only 8 lines of code Kernel recompilation necessary Complete handshake required Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 24 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
Implementation: VNF VNF is split in DPDK application and Python application DPDK: Handshaking Python: REST requests (HTTP flood defense) Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 25 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
INITIAL EVALUATION Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 26 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
Virtual Testbed Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 27 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
Testing Methodology Attacker floods SYN packets with delay between each packet Client sends 50 SYN packets in 0.5s intervals Score is the amount of answered client SYN packets Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking 28 Lukas Iffländer , Stefan Geissler, Jürgen Walter, Lukas Beierlieb, Samuel Kounev
Recommend
More recommend
