A Security Orchestration System for CDN Edge Servers

Transcription

1 A Security Orchestration System for CDN Edge Servers ELAHEH JALALPOUR STERE PREDA MILAD GHAZNAVI MAKAN POURZANDI DANIEL MIGAULT RAOUF BOUTABA 1

2 Outline Introduction Edge Server Security Orchestration Implementation Evaluation Conclusion 2

3 Ø Introduction Edge Server Security Orchestration Implementation Evaluation Conclusion Introduction CONTENT DELIVERY NETWORK (CDN) CONTENT DELIVERY PROCEDURE ATTACKS AGAINST CDN EDGE-SERVERS CURRENT DEFENSE MECHANISMS 3

4 Content Delivery Network Content Delivery Network (CDNs) play a critical role in delivering digital content Open-Connect carries Netflix's content (35.2 of all the traffic across North America) Akamai CDN daily delivers more than 30 Tbps of traffic 4

5 Content Delivery Procedure IP of an Edge Server Request Routing End Users (Clients) 3 Edge Servers 34 Origin Servers Content Provider 5

6 Attacks against CDN Edge Servers DENIAL OF SERVICE ATTACKS APPLICATION LAYER ATTACKS HTTP GET, 8.90% UDP fragment, 13.88% ICMP, 8.05% DNS, 7.42% SSDP, 7.31% NTP, 4.56% CHARGEN, 3.92% ACK, 3.81% Other, 3.81% TCP RESET, 0.64% HTTP PUSH, 0.64% HTTP POST, 0.53% FIN flood, 0.42% SYN PUSH, 0.42% UDP flood, 15.25% SYN flood, 23.09% SSL GET, 0.42% FIN PUSH, 0.21% SNMP, 0.21% SSL POST, 0.21% RP, 0.11% SQL Injection % Command Injection - 0.3% Cross Site Scripting - 7.6% PHP Injection - 0.4% [1] Gillman, D., Lin, Y., Maggs, B. and Sitaraman, R.K., Protecting Websites from Attack with Secure Delivery Networks. Computer, 48(4), pp Remote File Include % 6

7 Current Defense Mechanisms Hardware Security Functions Vertically integrated Not Elastic/flexible Scrubbing Centers Redirection latency Proprietary mechanisms Existing Software Defined Solutions Not-automated deployment Exclusive to DDoS 7

8 Introduction Ø Edge Server Security Orchestration Implementation Evaluation Conclusion Edge Server Security Orchestration OUR APPROACH ARCHITECTURE 8

9 Our Approach Virtual Security Functions Virtual functions running on commodity hardware Elastic/flexible In-house Mitigation No redirection latency Custom mechanisms Our Software Defined Solutions Automated deployment Wide range of attacks Hardware Security Functions Vertically integrated Not elastic/flexible Scrubbing Centers Redirection latency Proprietary mechanisms Existing Software Defined Solutions Not-automated deployment Exclusive to DDoS 9

10 Our Approach Deploying security services on edge servers Dynamic and automatic deployment of security services Security services realized through service function chaining 10

11 Architecture Orchestrator Enforcing high-level policies Reacting to environment states and attacks Virtual Infrastructure Managers Creating, updating, querying, and deleting security chains Orchestrator Virtual Infrastructure Manager Security Chains Function Security Monitoring Analytics System Monitoring and analyzing the collected data Feeding the orchestrator with alerts Security Policies Security Monitoring Analytics System Function 11

12 Introduction Edge Server Security Orchestration Ø Implementation Evaluation Conclusion Implementation ORCHESTRATOR SECURITY MONITORING ANALYTICS SYSTEM VIRTUAL INFRASTRUCTURE MANAGERS 12

13 Orchestrator Adopting L "#$%&' language Event Condition Action paradigm Event Security alerts generated by SMAS Internal events Condition Orchestrator Virtual Infrastructure Manager Security Chains Function Time related Service related Traffic related Action Creating, deleting, modifying a chain Security Policies Security Monitoring Analytics System Function 13

14 Orchestrator Continue SECURITY POLICIES ENFORCED SECURITY CHAIN Deploy rate limiting chain in reaction to event h"#h_%&'( happened and there are no rate limiting Trigger event )"* if chain the rate limiting chain is deployed Run rate_limit.sh in response to event )"* high_rate initiates create_chain(r: < not src net /24, 1, 2>, {f:rate-limit}) if not chain(r) lim after create_chain(r) if true lim initiates run(f, rate_limit.sh ) if true _ causes eth0 1 Bridge Virtual Edge Server Web Server 2 eth0 SMAS eth0 1 Rate-Lim. eth0 eth1 3 4 Bridge Virtual Edge Server 2 eth0 Web Server SMAS 14

15 Virtual Infrastructure Manager Docker Containers as service functions Network Service Header (NSH) IETF standard for service function chaining Realizing service function paths Supporting carrying metadata Orchestrator Virtual Infrastructure Manager Security Chains Function Open Virtual Switch Software based switching Security Policies Security Monitoring Analytics System Function 15

16 Virtual Infrastructure Manager Cont. VIM APIs Chain Specification Deployed Chain def create_chain(chain_sp) def delete_chain(chain_name) def insert(chain_name, func_sp) def delete(chain_name, func_name) def run(func_name,cmd) def chains() def chain(chain_name) def chain_functions(chain_name) def functions() def function(func_name) def steered(bpf,chain_name) { } "chain_name": "ch", "ingress": "1", "egress": "2", "classification_rules": "ip", "functions": [ { "function_image": "Firewall", "function_name": "firewall", "nsh_aware": false }, { "function_image": "IDS", "function_name": "ids", "nsh_aware": false } ] 1 Firewall IDS eth0 eth1 eth0 eth Bridge 2 16

17 Security Monitoring Analytics System Periodic resource monitoring Network-bandwidth CPU Memory Storage Event generation Based on predefined thresholds Standard Linux commands /proc/stat free iostat Orchestrator Security Policies Virtual Infrastructure Manager Security Monitoring Analytics System Security Chains Function Function 17

18 Introduction Edge Server Security Orchestration Implementation Ø Evaluation Conclusion Evaluation ENVIRONMENT SETUP PERFORMANCE EVALUATION RESPONSIVENESS DYNAMIC SECURITY SERVICE 18

19 Environment Setup A cluster of servers 16 GB RAM 8-cores 3.30 GHz Xeon CPU 10 Gbps NIC Device under test Hosting security chains Hosting an active daemon of our system Traffic sink iperf server Apache Web Server Traffic generator iperf client HTTPERF 19

20 Performance evaluation Chain Deployment Time Traffic Round Trip Time Throughput vs. Chain Length Time (s) Adding VNICs Delay InstantiatingFunction(s) Chain Length Round Trip Time (µs) Chain Length Throughput (Mbps) Chain Length 20

21 Responsiveness Traffic TCP flooding attacks Defense Network layer rate-limiting Traffic Gen. 4 Traffic Gen. 3 Traffic Gen. 2 Virtual Edge Server eth0 1 Rate-Lim. eth0 Bridge eth Virtual Edge Server eth0 Traffic Sink Leg. Throughput (Mbps) Gbps 3Gbps Time (s) Traffic Gen. 1 SMAS 21

22 Dynamic Security Service Traffic 300 legitimate requests 100 suspicious requests Defense Application layer mitigation End-user 3 End-user 2 Virtual Edge Server eth0 1 TLS-Term eth0 3 eth1 Bridge eth0 WAF eth Virtual Edge Server Web Server eth0 Completed Pages Dynamic Static Baseline Completion Time (ms) End-user 1 SMAS 22

23 Introduction Edge Server Security Orchestration Implementation Evaluation Ø Conclusion Conclusion SUMMARY FUTURE WORK 23

24 Summary Software defined security orchestration for CDN edge-servers Governed by high-level policies Dynamic and automatic security function chaining 24

25 Future Work NSH compatible s Passing the metadata between functions Ensuring security policy consistency through formal verifications Free of conflicting rules Reduce the signaling overhead in the Orchestration process Delegation of part of the chain management 25

26 Q&A 26