Proceedings of the 2019 ACM Symposium on SDN Research最新文献_第2页

eZTrust: Network-Independent Zero-Trust Perimeterization for Microservices eZTrust:微服务的网络独立零信任周边化

Proceedings of the 2019 ACM Symposium on SDN Research Pub Date : 2019-04-03 DOI: 10.1145/3314148.3314349

Zirak Zaheer, Hyunseok Chang, S. Mukherjee, J. Merwe

{"title":"eZTrust: Network-Independent Zero-Trust Perimeterization for Microservices","authors":"Zirak Zaheer, Hyunseok Chang, S. Mukherjee, J. Merwe","doi":"10.1145/3314148.3314349","DOIUrl":"https://doi.org/10.1145/3314148.3314349","url":null,"abstract":"Emerging microservices-based workloads introduce new security risks in today's data centers as attacks can propagate laterally within the data center relatively easily by exploiting cross-service dependencies. As countermeasures for such attacks, traditional perimeterization approaches, such as network-endpoint-based access control, do not fare well in highly dynamic microservices environments (especially considering the management complexity, scalability and policy granularity of these earlier approaches). In this paper, we propose eZTrust, a network-independent perimeterization approach for microservices. eZTrust allows data center tenants to express access control policies based on fine-grained workload identities, and enables data center operators to enforce such policies reliably and efficiently in a purely network-independent fashion. To this end, we leverage eBPF, the extended Berkeley Packet Filter, to trace authentic workload identities and apply per-packet tagging and verification. We demonstrate the feasibility of our approach through extensive evaluation of our proof-of-concept prototype implementation. We find that, when comparable policies are enforced, eZTrust incurs 2--5 times lower packet latency and 1.5--2.5 times lower CPU overhead than traditional perimeterization schemes.","PeriodicalId":346870,"journal":{"name":"Proceedings of the 2019 ACM Symposium on SDN Research","volume":"238 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130621702","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 33

Say No to Rack Boundaries: Towards A Reconfigurable Pod-Centric DCN Architecture 对机架边界说不:走向可重构的以pod为中心的DCN架构

Proceedings of the 2019 ACM Symposium on SDN Research Pub Date : 2019-04-03 DOI: 10.1145/3314148.3314350

Ding-Xue Wu, Weitao Wang, Ang Chen, T. Ng

引用次数: 6

NUTS: Network Updates in Real Time Systems NUTS:实时系统中的网络更新

Proceedings of the 2019 ACM Symposium on SDN Research Pub Date : 2019-04-03 DOI: 10.1145/3314148.3318051

Saif U. N. Noor Prottoy, D. Saucez, W. Dabbous

引用次数: 0

ADD: Application and Data-Driven Controller Design ADD:应用程序和数据驱动控制器设计

Proceedings of the 2019 ACM Symposium on SDN Research Pub Date : 2019-04-03 DOI: 10.1145/3314148.3314351

Yikai Lin, Yuru Shao, Xiao Zhu, Junpeng Guo, K. Barton, Z. Morley Mao

{"title":"ADD: Application and Data-Driven Controller Design","authors":"Yikai Lin, Yuru Shao, Xiao Zhu, Junpeng Guo, K. Barton, Z. Morley Mao","doi":"10.1145/3314148.3314351","DOIUrl":"https://doi.org/10.1145/3314148.3314351","url":null,"abstract":"Existing SDN controllers commonly adopt an event-driven model that minimizes southbound communication and control-plane overhead. This model satisfies most existing SDN applications' goals to maximize data plane performance while still being able to programmatically control with a decent level of visibility. However, as network composition becomes more heterogeneous with NFV and IoT, such model can be insufficient for future applications that rely more on data analysis and intelligent decision making. In this paper, we present our findings in a case study on smart manufacturing systems, which have highly heterogeneous device compositions, and applications that are much less \"throughput\" hungry or \"latency\" sensitive than network applications but require a lot more data for (real-time) decision making. We share the insights we gain that help us design a new Application and Data-Driven (ADD) model for SDN controllers. We build a proof-of-concept ADD controller based on this model and develop two applications to showcase its new capabilities. Evaluation results show that ADD delivers satisfying scalability and performance. More importantly, applications enabled by ADD gain more insights of the data plane and can make better decisions faster.","PeriodicalId":346870,"journal":{"name":"Proceedings of the 2019 ACM Symposium on SDN Research","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124433837","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Enabling Policy Innovation in Interdomain Routing: A Software-Defined Approach 在域间路由中实现策略创新:一种软件定义的方法

Proceedings of the 2019 ACM Symposium on SDN Research Pub Date : 2019-04-03 DOI: 10.1145/3314148.3314359

Anduo Wang, Zhijia Chen, Tony Yang, Minlan Yu

引用次数: 4

Detecting Volumetric Attacks on loT Devices via SDN-Based Monitoring of MUD Activity 通过基于sdn的MUD活动监控检测对loT设备的容量攻击

Proceedings of the 2019 ACM Symposium on SDN Research Pub Date : 2019-04-03 DOI: 10.1145/3314148.3314352

Ayyoob Hamza, H. Gharakheili, Theophilus A. Benson, V. Sivaraman

{"title":"Detecting Volumetric Attacks on loT Devices via SDN-Based Monitoring of MUD Activity","authors":"Ayyoob Hamza, H. Gharakheili, Theophilus A. Benson, V. Sivaraman","doi":"10.1145/3314148.3314352","DOIUrl":"https://doi.org/10.1145/3314148.3314352","url":null,"abstract":"Smart environments equipped with IoT devices are increasingly under threat from an escalating number of sophisticated cyber-attacks. Current security approaches are inaccurate, expensive, or unscalable, as they require static signatures of known attacks, specialized hardware, or full packet inspection. The IETF Manufacturer Usage Description (MUD) framework aims to reduce the attack surface on an IoT device by formally defining its expected network behavior. In this paper, we use SDN to monitor compliance with the MUD behavioral profile, and develop machine learning methods to detect volumetric attacks such as DoS, reflective TCP/UDP/ICMP flooding, and ARP spoofing to IoT devices. Our first contribution develops a machine for detecting anomalous patterns of MUD-compliant network activity via coarse-grained (device-level) and fine-grained (flow-level) SDN telemetry for each IoT device, thereby giving visibility into flows that contribute to a volumetric attack. For our second contribution we measure network behavior of IoT devices by collecting benign and volumetric attacks traffic traces in our lab, label our dataset, and make it available to the public. Our last contribution prototypes a full working system (built with an OpenFlow switch, Faucet SDN controller, and a MUD policy engine), demonstrates its application in detecting volumetric attacks on several consumer IoT devices with high accuracy, and provides insights into cost and performance of our system. Our data and solution modules are released as open source to the community.","PeriodicalId":346870,"journal":{"name":"Proceedings of the 2019 ACM Symposium on SDN Research","volume":"46 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-04-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132456803","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 135

KeySFC

Proceedings of the 2019 ACM Symposium on SDN Research Pub Date : 2019-04-03 DOI: 10.1145/3314148.3318048

C. Dominicini, G. Vassoler, Rodolfo V. Valentim, R. Villaça, M. Ribeiro, M. Martinello, E. Zambon

引用次数: 2

Precise Time-synchronization in the Data-Plane using Programmable Switching ASICs 基于可编程交换asic的数据平面精确时间同步

Proceedings of the 2019 ACM Symposium on SDN Research Pub Date : 2019-04-03 DOI: 10.1145/3314148.3314353

Pravein G. Kannan, Raj Joshi, M. Chan

引用次数: 36

(Demo) Boléro: Enabling Policy Innovation in Interdomain Routing (演示)bolsamro:在域间路由中启用策略创新

Proceedings of the 2019 ACM Symposium on SDN Research Pub Date : 2019-04-03 DOI: 10.1145/3314148.3318049

Zhijia Chen, Anduo Wang

引用次数: 0

Prophet: Real-time Queue Length Inference in Programmable Switches 先知:可编程交换机的实时队列长度推断

Proceedings of the 2019 ACM Symposium on SDN Research Pub Date : 2019-04-03 DOI: 10.1145/3314148.3318050

Shuhe Wang, J. Bi, Chen Sun, Yu Zhou

引用次数: 2