Policy Routing using Process-Level Identifiers IEEE International - PowerPoint PPT Presentation

Policy Routing using Process-Level Identifiers IEEE International Symposium on Software Defined Systems April 4th, 2016, Berlin, Germany Oliver Michel, Eric Keller Networking and Security Research Group

Network Policies 2

Network Policies Load Balancing 2

Network Policies Address Translation 2

Network Policies Intrusion Detection 2

Network Policies Firewalling 2

Limited Identifiers Ethernet IP TCP/UDP 3

Limited Identifiers Ethernet Source Destination EtherType IP TCP/UDP 3

Limited Identifiers Ethernet Source Destination EtherType IP Source Destination Protocol DSCP ECN TCP/UDP 3

Limited Identifiers Ethernet Source Destination EtherType IP Source Destination Protocol DSCP ECN TCP/UDP Source Destination 3

Why fine-grained identifiers? • Uniquely identifying user sessions BLOCK LDAP User Peter cn=Peter Pan, ou=CS, o=UColorado 4

Why fine-grained identifiers? • Uniquely identifying user sessions BLOCK LDAP User Peter cn=Peter Pan, ou=CS, o=UColorado MAC IP 4

Why fine-grained identifiers? • Uniquely identifying user sessions BLOCK LDAP User Peter cn=Peter Pan, ou=CS, o=UColorado UID MAC IP 4

Why fine-grained identifiers? • Uniquely identifying user sessions BLOCK LDAP User Peter cn=Peter Pan, ou=CS, o=UColorado Controller UID MAC IP LDAP 4

Why fine-grained identifiers? • Isolating vulnerable software 5

Why fine-grained identifiers? • Isolating vulnerable software 6

Why fine-grained identifiers? • Isolating vulnerable software $ openssl sha1 /usr/sbin/httpd SHA1(/usr/sbin/httpd)=5fdbdb587fce265656fd3e2960a6293262efedb7 6

Why fine-grained identifiers? • Isolating vulnerable software $ openssl sha1 /usr/sbin/httpd SHA1(/usr/sbin/httpd)=5fdbdb587fce265656fd3e2960a6293262efedb7 Executable Fingerprint 6

Why fine-grained identifiers? • Isolating vulnerable software $ openssl sha1 /usr/sbin/httpd SHA1(/usr/sbin/httpd)=5fdbdb587fce265656fd3e2960a6293262efedb7 Executable Fingerprint Controller 6

Fine-Grained Information user space Process Process operating system Network Interface IP/MAC 7

Fine-Grained Information user space Process Process Port operating system Network Interface IP/MAC 7

Fine-Grained Information user space Process Process PID Port operating system Network Interface IP/MAC 7

Fine-Grained Information user space Process Process PID GID Port operating system Network Interface IP/MAC 7

Fine-Grained Information user space Process Process PID GID UID Port operating system Network Interface IP/MAC 7

Fine-Grained Information user space Process Process PID GID UID Port operating cgroups system Network Interface IP/MAC 7

Fine-Grained Information user space Process Process PID GID UID Port operating cgroups system open files Network Interface IP/MAC 7

Fine-Grained Information user space Process Process PID GID UID Port operating cgroups system open files exe fingerprint Network Interface IP/MAC 7

Fine-Grained Information user space Process Process operating PID GID UID cgroups open files exe fingerprint system Network Interface IP/MAC MAC Destination MAC Source EtherType IP Source IP Destination Protocol network TCP/UDP Source TCP/UDP Destination 8

Fine-Grained Information user space Process Process operating system Network Interface IP/MAC MAC Destination MAC Source EtherType IP Source IP Destination Protocol network TCP/UDP Source TCP/UDP Destination PID GID UID cgroups open files exe fingerprint 8

Benefiting Scenarios • Uniquely identifying user sessions • Isolating vulnerable software 9

Benefiting Scenarios • Uniquely identifying user sessions • Isolating vulnerable software • Identifying services 9

Benefiting Scenarios • Uniquely identifying user sessions • Isolating vulnerable software • Identifying services • Quality of Service 9

Benefiting Scenarios • Uniquely identifying user sessions • Isolating vulnerable software • Identifying services • Quality of Service • Forensic Analysis 9

PRPL \ ˈ p ə r-p ə l\ Policy Routing using Process-Level Identifiers

PRPL Overview 11

PRPL Overview controller 11

PRPL Overview Distributing and configuring Policy controller 11

PRPL Overview Distributing and configuring Policy controller 11

PRPL Overview Tagging Packets Distributing and configuring Policy controller 11

PRPL Overview Tagging Packets Forwarding Distributing and configuring Policy controller 11

Tagging • Insert a custom header containing a token associated with some policy Ethernet IP TCP/UDP 12

Tagging • Insert a custom header containing a token associated with some policy Ethernet IP TCP/UDP 12

Tagging • Insert a custom header containing a token associated with some policy Ethernet PRPL IP TCP/UDP 12

Tagging • Insert a custom header containing a token associated with some policy 3 2 b i t s Ethernet 0x12d4f7e3 PRPL IP TCP/UDP 12

Tagging user domain Process Host admin domain Policy Controller 13

Tagging user domain Process Host admin domain PRPL Agent Policy Controller 13

Tagging user domain Process Host admin domain PRPL Agent request communication stream Policy Controller 13

Tagging user domain Process Host admin domain PRPL Agent request communication obtain token stream Policy Controller 13

Tagging user domain Process Host classify/mark tag/forward configure admin domain PRPL Agent request communication obtain token stream Policy Controller 13

Forwarding • Programmable Hardware 
 [Kangaroo INFOCOM ’10, SDN Chip SIGCOMM ’13, Intel FM6000 switch silicon] • Dataplane Forwarding Model in P4 [SIGCOMM CCR 2014] 14

Forwarding PRPL token action drop 0x a4..23 reroute 0x d3..42 • Programmable Hardware 
 [Kangaroo INFOCOM ’10, SDN Chip SIGCOMM ’13, Intel FM6000 switch silicon] • Dataplane Forwarding Model in P4 [SIGCOMM CCR 2014] 14

Forwarding PRPL token action drop 0x a4..23 reroute 0x d3..42 • Programmable Hardware 
 [Kangaroo INFOCOM ’10, SDN Chip SIGCOMM ’13, Intel FM6000 switch silicon] • Dataplane Forwarding Model in P4 [SIGCOMM CCR 2014] 14

Implementation 15

Implementation • Linux on-board tools: iptables, custom routing, tunnel devices 15

Implementation • Linux on-board tools: iptables, custom routing, tunnel devices • P4: Matching on token 15

Implementation • Linux on-board tools: iptables, custom routing, tunnel devices • P4: Matching on token • Prototype • P4 behavioral model • tag based on uid • forward or drop 15

Implementation 200 TCP throughput [ Mbit / s ] 150 100 direct transmission 50 using PRPL 0 200 400 600 800 1000 1200 1400 packet size [ Bytes ] • No performance penalty for packets < 200 Bytes 16

Future Work and Conclusion 17

Future Work and Conclusion • Network Management can greatly benefit from fine- grained process-level information 17

Future Work and Conclusion • Network Management can greatly benefit from fine- grained process-level information • System Architecture and Prototype enabling packet processing based on such information 
 17

Future Work and Conclusion • Network Management can greatly benefit from fine- grained process-level information • System Architecture and Prototype enabling packet processing based on such information 
 • Future work: expansion beyond current examples, more complex policies 17

Source Code https://github.com/nsr-colorado/prpl 18

Backup Slides

Future Work • Study feasibility of more complex policy scenarios • Granularity of Tokens • Controller - Agent Interface • Proactive vs. reactive configuration • Trust in tagging process 20

Tagging 25 minimum token size [ bits ] 20 15 500 servers 2000 servers 10 10000 servers 5 1 5 10 50 100 number of policy rules per host ( log. ) • Token sizes between 16 bits and 32 bits sufficient even for large networks 21

Programmable Hardware • new custom ASICs can achieve such flexibility at terabit speeds [Kangaroo INFOCOM ’10, SDN Chip SIGCOMM ’13, Intel FM6000 switch silicon] • some switches are more programmable than others: • FPGA (Xilinx, Altera, Corsa) • NPU (Ezchip, Netronome) • CPU (OVS, …) 22

P4 Language • P4 program configures forwarding behavior (abstract forwarding model) • express serial dependencies (e.g. ARP/L3 Routing) • P4 compiler translates into a target-specific representation • OF can still be used to install and query rules once forwarding model is defined 23

P4 Forwarding Model / Runtime Switch Parser Match/Action Tables Egress Queues Packet Metadata 24

P4 Forwarding Model / Runtime L2L3.p4 Switch Parser Match/Action Tables Egress Queues Packet Metadata 24