Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges最新文献

Offloading Security Services to the Cloud Infrastructure 将安全服务卸载到云基础设施

Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges Pub Date : 2018-08-07 DOI: 10.1145/3229616.3229624

P. Chaignon, Diane Adjavon, Kahina Lazri, J. François, O. Festor

{"title":"Offloading Security Services to the Cloud Infrastructure","authors":"P. Chaignon, Diane Adjavon, Kahina Lazri, J. François, O. Festor","doi":"10.1145/3229616.3229624","DOIUrl":"https://doi.org/10.1145/3229616.3229624","url":null,"abstract":"Cloud applications rely on a diverse set of security services from application-layer rate-limiting to TCP SYN cookies and application firewalls. Some of these services are implemented at the infrastructure layer, on the host or in the NIC, to filter attacks closer to their source and free CPU cycles for the tenants' applications. Most security services, however, remain difficult to implement at the infrastructure layer because they are closely tied to the applications they protect. In this paper, we propose to allow tenants to offload small filtering programs to the infrastructure. We design a mechanism to ensure fairness in resource consumption among tenants and show that, by carefully probing specific points of the infrastructure, all resource consumption can be accounted for. We prototype our solution over the new high-performance datapath of Linux. Our preliminary experiments show that an offload to the host's CPU can bring a 4-6x performance improvement. In addition, fairness among tenants introduces an overhead of only 14% in the worst case and approximately 3% for realistic applications.","PeriodicalId":230847,"journal":{"name":"Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-08-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129158068","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Virtual Network Isolation: Are We There Yet? 虚拟网络隔离:我们做到了吗?

Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges Pub Date : 2018-08-07 DOI: 10.1145/3229616.3229618

K. Thimmaraju, G. Rétvári, S. Schmid

引用次数: 4

Trust Modelling in 5G mobile networks 5G移动网络中的信任模型

Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges Pub Date : 2018-08-07 DOI: 10.1145/3229616.3229621

M. Surridge, Gianluca Correndo, K. Meacham, J. Papay, S. Phillips, Stefanie Wiegand, T. Wilkinson

引用次数: 11

High-coverage testing of softwarized networks 软件网络的高覆盖率测试

Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges Pub Date : 2018-08-07 DOI: 10.1145/3229616.3229617

S. Prabhu, G. Chaudhry, Brighten Godfrey, M. Caesar

引用次数: 2

Practical Authentication and Access Control for Software-Defined Networking over Optical Networks 基于光网络的软件定义网络的实用认证与访问控制

Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges Pub Date : 2018-08-07 DOI: 10.1145/3229616.3229619

J. Cho, T. Szyrkowiec

引用次数: 3

Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges 2018年软件网络安全研讨会论文集:展望与挑战

Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges Pub Date : 2018-08-07 DOI: 10.1145/3229616

引用次数: 1

Preventing Malicious SDN Applications From Hiding Adverse Network Manipulations 防止恶意SDN应用程序隐藏不利的网络操作

Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges Pub Date : 2018-08-07 DOI: 10.1145/3229616.3229620

Christian Röpke, Thorsten Holz

{"title":"Preventing Malicious SDN Applications From Hiding Adverse Network Manipulations","authors":"Christian Röpke, Thorsten Holz","doi":"10.1145/3229616.3229620","DOIUrl":"https://doi.org/10.1145/3229616.3229620","url":null,"abstract":"In Software-Defined Networks (SDN), so called SDN controllers are responsible for managing the network devices building such a network. Once such a core component of the network has been infected with malicious software (e.g., by a malicious SDN application), an attacker typically has a strong interest in remaining undetected while compromising other devices in the network. Thus, hiding a malicious network state and corresponding network manipulations are important objectives for an adversary. To achieve this, rootkit techniques can be applied in order to manipulate the SDN controller's view of a network. As a consequence, monitoring capabilities of SDN controllers as well as SDN applications with a security focus can be fooled by hiding adverse network manipulations. To tackle this problem, we propose a novel approach capable of detecting and preventing hidden network manipulations before they can attack a network. In particular, our method is able to drop adverse network manipulations before they are applied on a network. We achieve this by comparing the actual network state, which includes both malicious and benign configurations, with the network state which is provided by a potentially compromised SDN controller. In case of an attack, the result of this comparison reveals network manipulations which are adversely removed from an SDN controller's view of a network. To demonstrate the capabilities of this approach, we implement a prototype and evaluate effectiveness as well as efficiency. The evaluation results indicate scalability and high performance of our system, while being able to protect major SDN controller platforms.","PeriodicalId":230847,"journal":{"name":"Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges","volume":"192 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-08-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129769679","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

AEGIS “宙斯盾”

Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges Pub Date : 2018-08-07 DOI: 10.1145/3229616.3229623

Heedo Kang, Seungwon Shin, V. Yegneswaran, Shalini Ghosh, Phillip A. Porras

引用次数: 8

HEX Switch: Hardware-assisted security extensions of OpenFlow HEX Switch: OpenFlow的硬件辅助安全扩展

Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges Pub Date : 2018-08-07 DOI: 10.1145/3229616.3229622

Taejune Park, Zhaoyan Xu, Seungwon Shin

{"title":"HEX Switch: Hardware-assisted security extensions of OpenFlow","authors":"Taejune Park, Zhaoyan Xu, Seungwon Shin","doi":"10.1145/3229616.3229622","DOIUrl":"https://doi.org/10.1145/3229616.3229622","url":null,"abstract":"Software-defined networking (SDN) and Network Function Virtualization (NFV) have inspired security researchers to devise new security applications for these new network technology. However, since SDN and NFV are basically faithful to operating a network, they only focus on providing features related to network control. Therefore, it is challenging to implement complex security functions such as packet payload inspection. Several studies have addressed this challenge through an SDN data plane extension, but there were problems with performance and control interfaces. In this paper, we introduce a new data plane architecture, HEX which leverages existing data plane architectures for SDN to enable network security applications in an SDN environment efficiently and effectively. HEX provides security services as a set of OpenFlow actions ensuring high performance and a function of handling multiple SDN actions with a simple control command. We implemented a DoS detector and Deep Packet Inspection (DPI) as the prototype features of HEX using the NetFPGA-1G-CML, and our evaluation results demonstrate that HEX can provide security services as a line-rate performance.","PeriodicalId":230847,"journal":{"name":"Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-08-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124332732","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5