jobber
play

Jobber Automating Inter-Tenant Trust in The Cloud Andy Sayler - PowerPoint PPT Presentation

Jun 25, 2023 •393 likes •1k views

Jobber Automating Inter-Tenant Trust in The Cloud Andy Sayler Eric Keller Dirk Grunwald How can we make the Data Center... more efficient? more secure? more manageable? Over 50% Enterprise Companies Use Cloud Infrastructure* * Cohen,

  1. Jobber Automating Inter-Tenant Trust in The Cloud Andy Sayler Eric Keller Dirk Grunwald

  2. How can we make the Data Center... more efficient? more secure? more manageable?

  3. Over 50% Enterprise Companies Use Cloud Infrastructure* * Cohen, Reuven. The Cloud Hits the Mainstream: More than Half of U.S. Businesses Now Use Cloud Computing . Forbes. April 16th, 2013.

  4. 10% to 40% of all Data Center Traffic is Inter-Tenant Traffic* * BALLANI, H., JANG, K., AND KARAGIANNIS, T. Chatty Tenants and the Cloud Network Sharing Problem. Proc. of NSDI (2013).

  5. Ad Network ↔ Web Host CDN ↔ ISP NSA ↔ Google, Yahoo, Etc

  6. emphasis is on isolation hindering inter-tenant traffic Tenant Tenant Tenant A B C

  7. all traffic is untrusted Tenant Tenant Tenant A B C

  8. manual static configuration Tenant Tenant Tenant A B C

  9. misconfiguration is a major security problem Tenant Tenant Tenant A B C

  10. extra overhead prone to error untapped potential Tenant Tenant Tenant A B C

  11. optimize trusted traffic Tenant Tenant Tenant A B C

  12. optimize trusted traffic while filtering untrusted traffic Tenant Tenant Tenant A B C

  13. automatically Tenant Tenant Tenant A B C

  14. Jobber a dynamic network security architecture designed to handle the volatile nature of the cloud and the desire for optimized inter-tenant communication

  15. Jobber Components

  16. How can we securely designate trusted and untrusted traffic?

  17. trust networks

  18. Introduction Based Routing * Social Relationships Behavioral Reputation ... * FRAZIER, G., DUONG, Q., WELLMAN, M., AND PETERSEN, E. Incentivizing responsible networking via introduction-based routing. Trust and Trustworthy Computing 6740 (2011).

  19. Introduction Based Routing Host M Host Q Host G

  20. Introduction Based Routing Host M Host Q Host G

  21. Introduction Based Routing Host M Host Q Host G

  22. Introduction Based Routing Host M X Host Q Host G

  23. How can we automatically ascertain and track reputation?

  24. sensor frameworks

  25. Open Source Frameworks (nagios, ...) Platform-Specific Frameworks (Amazon CloudWatch, ...) Custom Solutions (Big Data analytic tools, ..)

  26. Jobber Sensor Framework Data Collection Interface Intrusion Host Firewall Router Detection System ... Alerts Status Etc System Logs

  27. Jobber Sensor Framework Behavior Classification Layer Sampling and Throttling Layer Data Collection Interface Intrusion Host Firewall Router Detection System ... Alerts Status Etc System Logs

  28. Jobber Sensor Tenant Reputation Database Framework Tenant Aggregation Layer Behavior Classification Layer Sampling and Throttling Layer Data Collection Interface Intrusion Host Firewall Router Detection System ... Alerts Status Etc System Logs

  29. Jobber Server Jobber Tenant Reputation Query Interface Sensor Tenant Reputation Database Framework Tenant Aggregation Layer Behavior Classification Layer Sampling and Throttling Layer Data Collection Interface Intrusion Host Firewall Router Detection System ... Alerts Status Etc System Logs

  30. How can we control network and resource access?

  31. programmable routing

  32. Standardized Interfaces (OpenFlow, MPLS, GRE, ...) Cloud Platforms (EC2, OpenStack, ...) Vendor Systems (Cisco, HP, ...)

  34. Jobber Architectures

  35. Data Center Legacy vs Future Host Modified vs Unmodified Jobber Routing Active vs Passive IBR Distributed vs Centralized

  36. Legacy Data Center Host Aware

  37. Jobber Jobber Server Server Security Security Middlebox Middlebox Jobber Client Jobber Client Jobber Client Local Local Local Local Local Local Apps Firewall Apps Firewall Apps Firewall Virtual Machine Virtual Machine Virtual Machine Tenant A Tenant B

  38. Jobber Jobber Server Server Security Security Middlebox Middlebox 1 Jobber Client Jobber Client Jobber Client Local Local Local Local Local Local Apps Firewall Apps Firewall Apps Firewall Virtual Machine Virtual Machine Virtual Machine Tenant A Tenant B

  39. 2 Jobber Jobber Server Server Security Security Middlebox Middlebox 1 Jobber Client Jobber Client Jobber Client Local Local Local Local Local Local Apps Firewall Apps Firewall Apps Firewall Virtual Machine Virtual Machine Virtual Machine Tenant A Tenant B

  40. 2 Jobber Jobber Server Server Security Security Middlebox Middlebox 1 Jobber Client Jobber Client Jobber Client 3 Local Local Local Local Local Local Apps Firewall Apps Firewall Apps Firewall Virtual Machine Virtual Machine Virtual Machine Tenant A Tenant B

  41. Legacy Legacy SDN Aware Agnostic Agnostic Deployable Yes Today Unmodified No Host Passive No Routing Central IBR No Coordination

  42. Legacy Data Center Host Unaware

  43. Jobber Jobber Server Server VPC Sensor VPC Sensor Router Router Framework Framework Security Security Middlebox Middlebox Local Local Local Local Local Local Apps Firewall Apps Firewall Apps Firewall Virtual Machine Virtual Machine Virtual Machine Tenant A Tenant B

  44. Jobber Jobber Server Server VPC Sensor VPC Sensor Router Router Framework Framework 1 Security Security Middlebox Middlebox Local Local Local Local Local Local Apps Firewall Apps Firewall Apps Firewall Virtual Machine Virtual Machine Virtual Machine Tenant A Tenant B

  45. 2 Jobber Jobber Server Server VPC Sensor VPC Sensor Router Router Framework Framework 1 Security Security Middlebox Middlebox Local Local Local Local Local Local Apps Firewall Apps Firewall Apps Firewall Virtual Machine Virtual Machine Virtual Machine Tenant A Tenant B

  46. 2 Jobber Jobber Server Server VPC Sensor VPC Sensor Router Router Framework Framework 1 Security Security 3 Middlebox Middlebox Local Local Local Local Local Local Apps Firewall Apps Firewall Apps Firewall Virtual Machine Virtual Machine Virtual Machine Tenant A Tenant B

  47. Legacy Legacy SDN Aware Agnostic Agnostic Deployable Yes Yes Today Unmodified No Yes Host Passive No No Routing Central IBR No No Coordination

  48. SDN Data Center Host Unaware

  49. Data Center Network Provider SDN Controller Provider SDN Provider Jobber Client Switch Jobber Jobber Server Server Sensor Sensor Framework Framework Security Security Middlebox Middlebox Local Local Local Local Local Local Apps Firewall Apps Firewall Apps Firewall Virtual Machine Virtual Machine Virtual Machine Tenant A Tenant B

  50. Data Center Network Provider SDN Controller Provider SDN Provider Jobber Client Switch 1 Jobber Jobber Server Server Sensor Sensor Framework Framework Security Security Middlebox Middlebox Local Local Local Local Local Local Apps Firewall Apps Firewall Apps Firewall Virtual Machine Virtual Machine Virtual Machine Tenant A Tenant B

  51. Data Center Network Provider SDN Controller Provider SDN Provider Jobber Client Switch 2 1 Jobber Jobber Server Server Sensor Sensor Framework Framework Security Security Middlebox Middlebox Local Local Local Local Local Local Apps Firewall Apps Firewall Apps Firewall Virtual Machine Virtual Machine Virtual Machine Tenant A Tenant B

  52. Data Center Network Provider SDN Controller Provider SDN Provider Jobber Client Switch 2 1 Jobber Jobber Server Server 3 Sensor Sensor Framework Framework Security Security Middlebox Middlebox Local Local Local Local Local Local Apps Firewall Apps Firewall Apps Firewall Virtual Machine Virtual Machine Virtual Machine Tenant A Tenant B

  53. Legacy Legacy SDN Aware Agnostic Agnostic Deployable Yes Yes No Today Unmodified No Yes Yes Host Passive No No Yes Routing Central IBR No No Yes Coordination

  54. Current Status

  55. Complete Multi-Architecture Design Proof-of-concept Prototype In Progress Full-system Prototype for SDN Arch. Partial Prototypes for Legacy Archs. To Do Performance Analysis & Evaluation Usability Analysis & Evaluation

  56. How can we make the datacenter... more efficient? more secure? more manageable?

  57. Jobber Provides... efficiency via direct inter-tenant communication security via introduction-based-routing manageability via automatic network control

  58. Questions

  59. Graduated or Binary Trust Designations? Acceptable Overhead? Performance Requirements? Best Architecture? Jobber as a Service? Economics of IBR?

More recommend