Protecting OpenFlow Flow Tables with Intel SGX
Paladi, Nicolae LU
; Svenningsson, Jakob
; Medina, Jorge
and Arlos, Patrik
(2019)
ACM SIGCOMM 2019
p.146-147
- Abstract
- Flexible and powerful control over network flows is one of the core advantages of Software-Defined Networking (SDN). Flow rules stored in switch network flow tables contain information on packet processing and routing. Flow rules are stored in memory, in a set of data structure rules, and managed by a classifier in flow tables. Network flows are a valuable asset: they contain information about the traffic patterns between the endpoints, while network tenants may be competing for the (limited) entries in flow tables.Commodity software switches do not currently implement confidentiality or integrity protection of flow tables. An attacker can exploit software vulnerabilities to access the switch host memory and observe or modify installed... (More)
- Flexible and powerful control over network flows is one of the core advantages of Software-Defined Networking (SDN). Flow rules stored in switch network flow tables contain information on packet processing and routing. Flow rules are stored in memory, in a set of data structure rules, and managed by a classifier in flow tables. Network flows are a valuable asset: they contain information about the traffic patterns between the endpoints, while network tenants may be competing for the (limited) entries in flow tables.Commodity software switches do not currently implement confidentiality or integrity protection of flow tables. An attacker can exploit software vulnerabilities to access the switch host memory and observe or modify installed flows. Observing installed flows allows an attacker to learn security-sensitive information: topology, flow patterns between endpoints, and flow priority. Modifying installed flows allows an attacker to exploit routing loopholes and avoid certain packet steps - e.g. route around a firewall or prevent mirroring packets to an intrusion detection system.
In this demo we presentOFTinSGX, an approach to protect the confidentiality and integrity of network flows installed on soft-ware switches. Our approach is based on decomposing the network switch to reduce the attack surface by isolating the OpenFlow flow tables and the flow rules from the rest of the code base. OFTinSGX allows to prevent attacks on the confidentiality and integrity of flow rules in software switches. (Less)
Please use this url to cite or link to this publication:
https://lup.lub.lu.se/record/05f8bc0f-12fd-4d1a-b62c-887df3fe0db4
- author
- Paladi, Nicolae
LU
; Svenningsson, Jakob
; Medina, Jorge
and Arlos, Patrik
- organization
- publishing date
- 2019-08-23
- type
- Chapter in Book/Report/Conference proceeding
- publication status
- published
- subject
- host publication
- ACM SIGCOMM 2019 Conference on Posters and Demos
- pages
- 146 - 147
- publisher
- Association for Computing Machinery (ACM)
- conference name
- ACM SIGCOMM 2019
- conference location
- Beijing, China
- conference dates
- 2019-08-19 - 2019-08-24
- external identifiers
-
- scopus:85071911713
- ISBN
- 9781450368865
- DOI
- 10.1145/3342280.3342339
- project
- Säkra mjukvaruuppdateringar för den smarta staden
- language
- English
- LU publication?
- yes
- id
- 05f8bc0f-12fd-4d1a-b62c-887df3fe0db4
- date added to LUP
- 2019-07-01 10:13:30
- date last changed
- 2024-04-30 16:55:08
@inproceedings{05f8bc0f-12fd-4d1a-b62c-887df3fe0db4,
abstract = {{Flexible and powerful control over network flows is one of the core advantages of Software-Defined Networking (SDN). Flow rules stored in switch network flow tables contain information on packet processing and routing. Flow rules are stored in memory, in a set of data structure rules, and managed by a classifier in flow tables. Network flows are a valuable asset: they contain information about the traffic patterns between the endpoints, while network tenants may be competing for the (limited) entries in flow tables.Commodity software switches do not currently implement confidentiality or integrity protection of flow tables. An attacker can exploit software vulnerabilities to access the switch host memory and observe or modify installed flows. Observing installed flows allows an attacker to learn security-sensitive information: topology, flow patterns between endpoints, and flow priority. Modifying installed flows allows an attacker to exploit routing loopholes and avoid certain packet steps - e.g. route around a firewall or prevent mirroring packets to an intrusion detection system. <br/>In this demo we presentOFTinSGX, an approach to protect the confidentiality and integrity of network flows installed on soft-ware switches. Our approach is based on decomposing the network switch to reduce the attack surface by isolating the OpenFlow flow tables and the flow rules from the rest of the code base. OFTinSGX allows to prevent attacks on the confidentiality and integrity of flow rules in software switches.}},
author = {{Paladi, Nicolae and Svenningsson, Jakob and Medina, Jorge and Arlos, Patrik}},
booktitle = {{ACM SIGCOMM 2019 Conference on Posters and Demos}},
isbn = {{9781450368865}},
language = {{eng}},
month = {{08}},
pages = {{146--147}},
publisher = {{Association for Computing Machinery (ACM)}},
title = {{Protecting OpenFlow Flow Tables with Intel SGX}},
url = {{http://dx.doi.org/10.1145/3342280.3342339}},
doi = {{10.1145/3342280.3342339}},
year = {{2019}},
}