Data Provenance at Internet Scale: Architecture, Experiences, and the Road Ahead Ang Chen, Yang Wu, Andreas Haeberlen, Boon Thau Loo, Wenchao Zhou
Motivation D E A foo.com Alice C B • An example scenario: network routing – System administrator observes strange behavior – Example: the route to foo.com has suddenly changed – Anomalies in distributed systems • Need a way to explain system behavior. 2
Motivation D E A foo.com Alice C B Route r 1 • An example scenario: network routing – System administrator observes strange behavior – Example: the route to foo.com has suddenly changed – Anomalies in distributed systems • Need a way to explain system behavior. 2
Motivation Route r 2 D E A foo.com Alice C B • An example scenario: network routing – System administrator observes strange behavior – Example: the route to foo.com has suddenly changed – Anomalies in distributed systems • Need a way to explain system behavior. 2
Motivation Route r 2 Why did my route to D E foo.com change?! A foo.com Alice C B • An example scenario: network routing – System administrator observes strange behavior – Example: the route to foo.com has suddenly changed – Anomalies in distributed systems • Need a way to explain system behavior. 2
Motivation Route r 2 Why did my route to D E foo.com change?! A foo.com Innocent Reason? Alice C B • An example scenario: network routing – System administrator observes strange behavior – Example: the route to foo.com has suddenly changed – Anomalies in distributed systems • Need a way to explain system behavior. 2
Motivation Route r 2 Why did my route to D E foo.com change?! A foo.com Innocent Reason? Software Bugs? Alice C B • An example scenario: network routing – System administrator observes strange behavior – Example: the route to foo.com has suddenly changed – Anomalies in distributed systems • Need a way to explain system behavior. 2
Motivation Route r 2 Why did my route to D E foo.com change?! A foo.com Innocent Reason? Software Bugs? Alice C B Malicious Attack? • An example scenario: network routing – System administrator observes strange behavior – Example: the route to foo.com has suddenly changed – Anomalies in distributed systems • Need a way to explain system behavior. 2
Data-centric Perspective on Network Debugging D E foo.com A Alice B C • We assume a general distributed system – Network consists of nodes (routers, middleboxes, ...) – The state of a node is a set of tuples (routes, config, ...) 3
Data-centric Perspective on Network Debugging D E foo.com route(A, foo.com) route(A, B) A Alice route(A, D) …… B C • We assume a general distributed system – Network consists of nodes (routers, middleboxes, ...) – The state of a node is a set of tuples (routes, config, ...) 3
Data-centric Perspective on Network Debugging D E foo.com route(A, foo.com) route(A, B) A Alice route(A, D) link(A, B) …… link(A, D) B C • We assume a general distributed system – Network consists of nodes (routers, middleboxes, ...) – The state of a node is a set of tuples (routes, config, ...) 3
Data-centric Perspective on Network Debugging D E foo.com route(A, foo.com) A Alice B C • We assume a general distributed system – Network consists of nodes (routers, middleboxes, ...) – The state of a node is a set of tuples (routes, config, ...) – Idea : Explanation as reasoning about distributed state dependencies 3
Data-centric Perspective on Network Debugging D E foo.com route(A, foo.com) A link(A, B) route(B, foo.com) Alice B C • We assume a general distributed system – Network consists of nodes (routers, middleboxes, ...) – The state of a node is a set of tuples (routes, config, ...) – Idea : Explanation as reasoning about distributed state dependencies 3
Data-centric Perspective on Network Debugging D E foo.com route(A, foo.com) A link(A, B) route(B, foo.com) Alice route(C, foo.com) B C link(C, foo.com) link(B, C) • We assume a general distributed system – Network consists of nodes (routers, middleboxes, ...) – The state of a node is a set of tuples (routes, config, ...) – Idea : Explanation as reasoning about distributed state dependencies 3
Network Provenance [SIGMOD 2010] route(D, foo.com) route(E, foo.com) D E link(D, E) link(E, B) foo.com route(A, foo.com) A link(A, B) route(B, foo.com) Alice route(C, foo.com) B C link(C, foo.com) link(B, C) 4
Network Provenance [SIGMOD 2010] route(D, foo.com) route(E, foo.com) link(D, E) link(E, B) route(A, foo.com) link(A, B) route(B, foo.com) route(C, foo.com) link(C, foo.com) link(B, C) • Provenance for encoding distributed state dependencies – Explains the derivation of tuples – Captures the dependencies between tuples as a graph 4
Network Provenance [SIGMOD 2010] route(A, foo.com) link(A, B) route(B, foo.com) route(C, foo.com) link(C, foo.com) link(B, C) • Provenance for encoding distributed state dependencies – Explains the derivation of tuples – Captures the dependencies between tuples as a graph – Explanation of a tuple is an acyclic graph rooted at the tuple 4
NetTrails: First Generation Network Provenance Tool http://netdb.cis.upenn.edu/nettrails/ [SIGMOD 2011 demo] • 5
Network Provenance Research (2010 – 2017) Network provenance [SIGMOD’10] • Secure network provenance [SOSP’11] • Explanations Provenance in dynamic environments [VLDB’13] • Negative provenance [SIGCOMM’14] • Distributed provenance compression [SIGMOD’17] • Deeper Differential provenance [SIGCOMM’16] • diagnostics and Meta- provenance [NSDI’17] • repair Ph.D. dissertation work of Ang Chen (2017), Chen Chen (2017), Yang Wu (2017), and Wenchao Zhou (2012). 6
Assumption #1: All nodes in the network can be trusted Route r 2 Why did my route to D E foo.com change?! A foo.com Alice C B 7
Assumption #1: All nodes in the network can be trusted Route r 2 Q: Explain why the route to foo.com D E changed to r2. A foo.com Alice C B The Network 7
Assumption #1: All nodes in the network can be trusted Route r 2 Q: Explain why the route to foo.com D E changed to r2. A foo.com Alice C B The Network A: Because someone accessed Router D and changed the configuration from X to Y. 7
Assumption #1: All nodes in the network can be trusted Route r 2 Q: Explain why the route to foo.com D E changed to r2. A foo.com Alice C B The Network A: Because someone accessed Router D and changed the configuration from X to Y. Not realistic: adversary can tell lies 7
Challenge: Adversaries Can Lie I should cover up the intrusion. Route r 2 Q: Explain why the route to foo.com D E changed to r2. A foo.com Alice C B The Network Problem: a dversary can … ... fabricate plausible (yet incorrect) response … point accusation towards innocent nodes 8
Challenge: Adversaries Can Lie Everything is fine. Router E advertised a new route. Route r 2 Q: Explain why the route to foo.com D E changed to r2. A foo.com Alice C B The Network Problem: a dversary can … ... fabricate plausible (yet incorrect) response … point accusation towards innocent nodes 8
Secure Network Provenance (SNP) SOSP 2011 route(D, foo.com) route(E, foo.com) link(D, E) link(E, B) route(A, foo.com) link(A, B) route(B, foo.com) route(C, foo.com) link(C, foo.com) link(B, C) • Step 1: Each node keeps vertices about local actions – Split cross-node communications 9
Secure Network Provenance (SNP) SOSP 2011 • Step 1: Each node keeps vertices about local actions – Split cross-node communications 9
Secure Network Provenance (SNP) SOSP 2011 • Step 1: Each node keeps vertices about local actions – Split cross-node communications 9
Secure Network Provenance (SNP) SOSP 2011 • Step 1: Each node keeps vertices about local actions – Split cross-node communications 9
Secure Network Provenance (SNP) SOSP 2011 RECV SEND • Step 1: Each node keeps vertices about local actions – Split cross-node communications 9
Secure Network Provenance (SNP) SOSP 2011 RECV SEND • Step 1: Each node keeps vertices about local actions – Split cross-node communications • Step 2: Make the graph tamper-evident 9
SNP Guarantees Route r 2 Q: Why did my route to D E foo.com change to r2? A foo.com Alice C B The Network A: Because someone accessed Router D and changed its router configuration from X to Y. • No faults: Explanation is complete and accurate • Byzantine fault: Explanation identifies at least one faulty node 10
SNP Guarantees Route r 2 Q: Why did my route to D E foo.com change to r2? A foo.com Alice C B The Network A: Because someone accessed Router D and changed its router configuration from X to Y. • No faults: Explanation is complete and accurate • Byzantine fault: Explanation identifies at least one faulty node 10
SNP Guarantees Route r 2 Q: Why did my route to D E foo.com change to r2? A foo.com Alice C B The Network A: Because someone accessed Router D and changed its router configuration from X to Y. • No faults: Explanation is complete and accurate • Byzantine fault: Explanation identifies at least one faulty node 10
Recommend
More recommend
