SVLAN: Secure & Scalable Network Virtualization Jonghoon Kwon, Taeho Lee, Claude Hähni, Adrian Perrig ETH Zürich, Network Security Group Jonghoon Kwon, Ph.D | | 25.02.2020 1
Current Inter-domain Network Virtualization: VLAN PM PM PM PM Internet ETH | VLAN | IP | Data VID 101 VID 102 Virtual LAN (IEEE 802.1q) Layer-2 bridging Supporting apx. 4 K virtual networks with a 12-bit VID value Jonghoon Kwon, Ph.D | | 25.02.2020 2
Current Inter-domain Network Virtualization: VXLAN Core Network Hypervisor Edge Network VM VM Hypervisor VM VM ETH | IP | Data VTEP ETH | IP | Data VTEP Internet VXLAN tunnel Outer ETH | Outer IP | Outer UDP | VXLAN | ETH | IP | Data VNI 1001 VNI 1002 Virtual eXtensible LAN Supporting 16 M virtual networks with a 24-bit VNI value Interconnecting layer-2 networks over an underlying layer-3 network Jonghoon Kwon, Ph.D | | 25.02.2020 3
Adversarial Model and Desired Properties Security Compromise Network Isolation Scalability Disrupt Virtual Network Flexibility Jonghoon Kwon, Ph.D | | 25.02.2020 4
VXLAN: Insufficient Security Trusted Core Network Hypervisor Trusted Edge Network VM VM Hypervisor VM VM VTEP Outer ETH | Outer IP | Outer UDP | VXLAN | ETH | IP | Data Untrusted VTEP Internet Attackers may manipulate VNIs and forward malicious traffic Jonghoon Kwon, Ph.D | | 25.02.2020 5
VXLAN: Scalability Constraints Core Network Hypervisor Edge Network VM VM VM VM VM VM Hypervisor VM VM VM VM VM VTEP VTEP Internet Jonghoon Kwon, Ph.D | | 25.02.2020 6
VXLAN: Insufficient Flexibility Core Network Hypervisor Edge Network VM VM Hypervisor VM VM VTEP VTEP Internet Jonghoon Kwon, Ph.D | | 25.02.2020 7
VXLAN: Insufficient Flexibility Core Network Hypervisor Edge Network VM VM Hypervisor VM VM VTEP VTEP Internet Jonghoon Kwon, Ph.D | | 25.02.2020 8
Challenges and Countermeasures Intra-domain network slicing Intra-domain Properties (Destination-driven connectivity) • Host-level granularity • Application-level granularity • Limited number of VNI • Unlimited virtual group • Frequent VNI update • Centralized management Verifiable Inter-domain routing Inter-domain Properties (Packet-carrying forwarding state) • Insecure overlay tunneling • Crypto-based protection • ARP broadcast • Separation of control & data plane • State routing • Stateless routing Jonghoon Kwon, Ph.D | | 25.02.2020 9
Our Vision on Secure and Scalable Network Virtualization Edge network Core network Mobile Slice Untrusted Network Untrusted Network IoT Slice Mission critical Slice Jonghoon Kwon, Ph.D | | 25.02.2020 10
SVLAN (Secure & Scalable Virtual LAN) Overview Receiver Sender Hypervisor Authorization Delegate Hypervisor VM VM VM VM SVTEP SVTEP SVLAN tunnel Verifier Jonghoon Kwon, Ph.D | | 25.02.2020 11
Express Receiver’s Consent Receiving Policy Receiver Sender Hypervisor Hypervisor VM VM VM VM SVTEP SVTEP Jonghoon Kwon, Ph.D | | 25.02.2020 12
Acquiring Receiver’s Consent Receiver Sender Hypervisor Hypervisor VM VM VM VM SVTEP SVTEP Authorization request Jonghoon Kwon, Ph.D | | 25.02.2020 13
Acquiring Receiver’s Consent Authorization Proof Receiver Sender Hypervisor Hypervisor VM VM VM VM SVTEP SVTEP Path Segments + Authorization Proof Jonghoon Kwon, Ph.D | | 25.02.2020 14
SVLAN Packet Forwarding Receiver Sender Hypervisor Hypervisor VM VM Path Segment + VM VM Authorization Proof + SVTEP SVTEP Data Jonghoon Kwon, Ph.D | | 25.02.2020 15
Verifying the Validity of Packets Receiver Sender Hypervisor Hypervisor VM VM Path Segment + VM VM Authorization Proof + SVTEP SVTEP Data Jonghoon Kwon, Ph.D | | 25.02.2020 16
Proof-of-Concept Implementation in SCIONLab SCIONLab: Global Future Internet Testbed Secure and fine-grained inter-domain segment routing Testbed distributed across the world https://github.com/scionproto/scion https://www.scionlab.org Jonghoon Kwon, Ph.D | | 25.02.2020 17
Cracking the Authorization Proof is Impractical Brute-force attack would require 60000 years on 100 Gbps line to break 64-bit MAC Jonghoon Kwon, Ph.D | | 25.02.2020 18
No Significant Bandwidth Overhead § SR-MPLS § 36 bytes of additional header § 12 bytes of MPLS labels (three labels) § 24 bytes of proof § SCION § 60 bytes of additional header § 24 bytes of forwarding paths (three labels) § 32 bytes of extra header Jonghoon Kwon, Ph.D | | 25.02.2020 19
Small Forwarding Performance Overhead iMIX profiles the proportion of packets of a certain size based on statistical sampling from actual Internet traces Jonghoon Kwon, Ph.D | | 25.02.2020 20
Latency Inflation Measurements in Cloud Authorization Delegate Sender Receiver 14 Amazon EC2 instances Select 3 instances as the sender, receiver, and authorization delegate Measure the latency for TTFP (Time to First Packet) Jonghoon Kwon, Ph.D | | 25.02.2020 21
Latency Inflation with AD on Amazon Cloud < 75% of latency inflation Jonghoon Kwon, Ph.D | | 25.02.2020 22
Large-scale Simulation Jonghoon Kwon, Ph.D | | 25.02.2020 23
SVLAN, Expected Benefits § Flexible network management § Highly scalable network virtualization § Receiving policy at different granularity § Unlimited number of VNI § Easy update for virtual network § Stateless VTEP § Reducing network overhead § Secure isolation from unwanted traffic § No ARP flooding § Only authorized packets get forwarded § Negligible latency influence § Adversaries cannot impersonate authorized senders Jonghoon Kwon, Ph.D | | 25.02.2020 24
Thank you! SVLAN: Secure & Scalable Network Virtualization Jonghoon Kwon, Taeho Lee, Claude Hähni, Adrian Perrig (jong.kwon@inf.ethz.ch) ETH Zurich Network Security Group Universitätstrasse 6 8092 Zürich https://netsec.ethz.ch
Backup Slides First name Surname (edit via “Insert” > “Header & Footer”) | | 1.12.2014 26
Implementation Example SVLAN header format on SCION Jonghoon Kwon, Ph.D | | 25.02.2020 27
Practical Consideration Location of Authorization Delegates Receiver Sender Hypervisor Hypervisor VM VM VM VM SVTEP SVTEP Receiver’s AS Third party entity (Cloud) Jonghoon Kwon, Ph.D | | 25.02.2020 28
Practical Consideration Location of Verifiers Receiver Sender Hypervisor Hypervisor VM VM VM VM SVTEP SVTEP Receiver Receiver’s AS Sender’s AS Third party entity (Cloud) Jonghoon Kwon, Ph.D | | 25.02.2020 29
Recommend
More recommend
