on Precise Realtime Software Access and Control of Wired Networks - PowerPoint PPT Presentation

Forensics in the SoNIC Project on Precise Realtime Software Access and Control of Wired Networks Ki Suh Lee, Han Wang, Hakim Weatherspoon Cornell University International Workshop on Trustworthiness, Accountability, and Forensics in the Cloud (TAFC) June 6, 2013

The Rise of Cloud Computing • The promise of the Cloud – A computer utility; a commodity – Catalyst for technology economy – Revolutionizing for health care, financial systems, scientific research, and society SEATTLE

The Rise of Cloud Computing • The promise of the Cloud – ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. NIST Cloud Definition SEATTLE

The Rise of Cloud Computing • The promise of the Cloud – ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. NIST Cloud Definition SEATTLE

The Rise of Cloud Computing • The promise of the Cloud – ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. NIST Cloud Definition • How can we exploit the network for forensics, evidence, and accountability? – Public clouds: Bandwidth, availability – Private and hybrid clouds: exfiltration of data (covert channels)

Goal Understand how to use the network to forensically account for and measure service level agreements in cloud How to detect and/or prevent exfiltration of data from (private) clouds 6/14/2013 SoNIC DARPA MRC 2013 6

Forensic Evidence via network interpacket delay • Interpacket delay Application IPG Transport Packet i Packet i+1 Network IPD Data Link • Important metric for network forensic evidence Physical – Can be improved with access to the PHY Increasing Detecting Packet Capture Packet Throughput timing channel Generation Estimating Characterization bandwidth 6/14/2013 SoNIC NSDI 2013 7

Forensic Evidence via network interpacket delay • Valuable information: Idle characters Application IPG Transport Packet i Packet i+1 Network IPD Data Link – Can provide precise timing base for control Physical • Each bit is ~97 ps wide 6/14/2013 SoNIC NSDI 2013 8

Forensic Evidence via network interpacket delay • Valuable information: Idle characters Application 12 /I/s = 100bits = 9.7ns IPG Transport Packet i Packet i+1 Network One Idle character Data Link – Can provide precise timing base for control (/I/) = 7~8 bits Physical • Each bit is ~97 ps wide Detecting Packet Capture Packet timing channel Generation Estimating Characterization bandwidth 6/14/2013 SoNIC NSDI 2013 9

Forensic Evidence via network interpacket delay • Valuable information in PHY: Idle characters Application IPG Transport Packet i Packet i+1 Network • Issue1: The PHY is simply a black box Data Link – No interface from NIC or OS Physical – Valuable information is invisible (discarded) Packet i Packet i Packet i+1 Packet i+1 Packet i+2 Packet i+2 Packet i Packet i Packet i+1 Packet i+1 Packet i+2 Packet i+2 • Issue2: Limited access to hardware . 6/14/2013 SoNIC DARPA MRC 2013 10

Forensic Evidence via network interpacket delay • Goal: Control every bit in software in realtime Application IPG Transport Packet i Packet i+1 Network IPD Data Link – Enable research on PHY covert challenge Physical • Challenge – Requires unprecedented software access to the PHY 6/14/2013 SoNIC DARPA MRC 2013 11

SoNIC: Software-defined Network Interface Card • Implements the PHY in software Application IPG Transport Packet i Packet i+1 Network IPD Data Link – Enabling control and access to every bit in realtime Physical – With commodity components – Thus, enabling novel network research SoNIC: Precise Realtime Software Access and Control of Wired Networks, Ki Suh Lee, Han Wang and Hakim Weatherspoon, Appears in NSDI, April 2013 6/14/2013 SoNIC DARPA MRC 2013 12

Outline • Introduction • Examples of Forensic Evidence – Available bandwidth estimation – PHY Covert Timing Channel • SoNIC: Software-defined Network Interface Card • Concluding Remarks 6/14/2013 SoNIC DARPA MRC 2013 13

SoNIC 6/14/2013 SoNIC DARPA MRC 2013 14

Forensic Evidence: Bandwidth Estimation • Estimate available bandwidth – Traffic sent, packet trains: Packet Interpacket gap – Traffic received after going through bottleneck: • Accurate available bandwidth estimation requires PHY • Inter-packet gaps are invisible to higher layers, but not SoNIC 6/14/2013 SoNIC 15

Outline • Introduction • Examples of Forensic Evidence – Available bandwidth estimation – PHY Covert Timing Channel • SoNIC: Software-defined Network Interface Card • Concluding Remarks 6/14/2013 SoNIC DARPA MRC 2013 16

Forensic Evidence: Covert Timing Channel • Embedding signals into interpacket gaps. – Large gap: ‘1’ Packet i Packet i+1 – Small gap: ‘0’ Packet i Packet i+1 • Covert timing channel by modulating IPGs at 100ns • Overt channel at 3 Gbps • Covert channel at 250 kbps • Over 4-hops with < 1% BER 6/14/2013 SoNIC DARPA MRC 2013 17

Forensic Evidence: Covert Timing Channel • Modulating IPGs at 100ns scale (=128 /I/s), over 4 hops 3562 /I/s 1� 1� 1� 1� SoNIC� SoNIC� Kernel� 3562 - 128 /I/s 0.8� 0.8� 0.8� 0.8� 3562 + 128 /I/s BER = 0.37% CDF 0.6� 0.6� 0.6� 0.6� 0.4� 0.4� 0.4� 0.4� 0.2� 0.2� 0.2� 0.2� ‘1’ ‘0’ 0� 0� 0� 0� 500� 500� 500� 500� 1500� 1500� 1500� 1500� 2500� 2500� 2500� 2500� 3500� 3500� 3500� 3500� 4500� 4500� 4500� 4500� Interpacket delays ( ns ) ‘1’: 3562 + 128 /I/ s ‘1’: 3562 + a /I/ s ‘0’: 3562 – 128 /I/s ‘0’: 3562 – a /I/s 6/14/2013 SoNIC DARPA MRC 2013 18

Forensic Evidence: Covert Timing Channel • Prevent Covert Timing Channels? 3562 /I/s 1� 0.8� CDF 0.6� 0.4� 0.2� 0� 500� 1500� 2500� 3500� 4500� Interpacket delays ( ns ) 6/14/2013 SoNIC DARPA MRC 2013 19

Forensic Evidence: Covert Timing Channel • Router/ Switch Signatures • Different Routers and switches have different response function. • Improve simulation model of switches and routers. • Detect switch and router model in real network. 1 1 1 0.1 0.1 0.1 0.01 0.01 0.01 Frequency (normalized) Frequency (normalized) Frequency (normalized) 0.001 0.001 0.001 0.0001 0.0001 0.0001 1e-05 1e-05 1e-05 1e-06 1e-06 1e-06 0 5000 10000 15000 20000 0 5000 10000 15000 20000 0 5000 10000 15000 20000 Interpacket gap (bits) Interpacket gap (bits) Interpacket gap (bits) Cisco 4948 Cisco 6509 IBM BNT G8264R 1500 byte packets @ 6Gbps 6/14/2013 SoNIC DARPA MRC 2013 20

Outline • Introduction • Demo: PHY Covert Timing Channel • SoNIC: Software-defined Network Interface Card • Concluding Remarks 6/14/2013 SoNIC DARPA MRC 2013 21

10GbE Network Stack Application Data Transport L3 Hdr Data Network L2 Hdr L3 Hdr Data Data Link Preamble Eth Hdr L2 Hdr L3 Hdr Data CRC Gap Physical Idle characters (/I/) 64 bit 2 bit syncheader 10.3125 Gigabits 64/66b PCS /S/ /S/ /D/ /D/ /D/ /D/ /D/ /D/ /D/ /D/ /T/ /T/ /E/ /E/ Encode Encode Decode 16 bit Scrambler Scrambler Descrambler Gearbox Gearbox Blocksync PMA PMA 011010010110100101101001011010010110100101101001011010010110100101101 PMD 6/14/2013 SoNIC DARPA MRC 2013 22

10GbE Network Stack Application Data Transport L3 Hdr Data Packet i Packet i+1 SW Network L2 Hdr L3 Hdr Data Data Link Preamble Eth Hdr L2 Hdr L3 Hdr Data CRC Gap Physical HW 64/66b PCS /S/ /D/ /D/ /D/ /D/ /T/ /E/ Encode Encode Decode Packet i Packet i+1 Scrambler Scrambler Descrambler Gearbox Gearbox Blocksync PMA PMA 011010010110100101101001011010010110100101101001011010010110100101101 PMD Commodity NIC 6/14/2013 SoNIC DARPA MRC 2013 23

10GbE Network Stack Application Application Data SW Transport Transport L3 Hdr Data Network Network L2 Hdr L3 Hdr Data HW Data Link Data Link Preamble Eth Hdr L2 Hdr L3 Hdr Data CRC Gap Physical Physical 64/66b PCS 64/66b PCS /S/ Packet i /D/ /D/ Packet i+1 /D/ /D/ /T/ /E/ Encode Encode Decode Encode Encode Decode SW Scrambler Scrambler Descrambler Scrambler Scrambler Descrambler Gearbox Gearbox Blocksync Gearbox Gearbox Blocksync HW PMA PMA PMA PMA 011010010110100101101001011010010110100101101001011010010110100101101 PMD PMD SoNIC NetFPGA 6/14/2013 SoNIC DARPA MRC 2013 24