June 2007NSF Find Forensics and Attribution in Ethane Martin Casado Stanford University With: Michael Freedman, Justin Pettit, Jianying Luo, Natasha Gude, David Goubad, Aditya Akella, Dan Boneh, Scott Shenker, Nick McKeown
June 2007NSF Find Ethane Overview Centralized, Flow-based architecture Connectivity dictated by global policy file For the Enterprise Single administration domain (someone everyone has to trust) Known principle roles (users, hosts) Bounded in size
June 2007NSF Find Ethane Operation Nancy Payroll Host:b IP:y MAC:n Host: a IP: x MAC: m controller Credentials Payroll XXXX Nancy YYYY Authenticate Bindings Payroll x m sw4 Nancy y n sw4 Bindings Payroll x m sw4 Nancy y n sw4 Assumptions Physical ingress port of all packets is known Controller knows network topology
June 2007NSF Find Ethane: First Packet = Path Setup Payroll POLICY FILE POLICY FILE Controller Nancy
June 2007NSF Find Forwarding in Ethane Check flow-table If entry exists, apply corresponding action Forward (or drop) Rate limit Outbound initiated only (NAT-like) Swap MAC header (Source obfuscation) Place in specific queue (isolation) If no entry, send to Controller
June 2007NSF Find Ethane Switch = Flow Tables Flow ID = Hash over relevant header fields Ethernet = H( inport,ethsrc|ethdst|ethprot) IP = H(eth,ipsrc|ipdst|ipproto) TCP/UDP = H(ip|srcport|dstport) Flow-Table & Lookup Flow ID Action 0xcf32 0xdf32 Header Values 0xef32 Fwd port1 Fwd port1, Swap MAC 01|ffee|… 01|ddee|… 02|ddef|…Fwd port2, Rate limit
June 2007NSF Find Preventing Address Forging Principles bound to addresses/physical port at authentication time Packet addresses checked against bindings at Controller (e.g. MAC/port pair matches known bindings) Flow definition includes ingress port Forged packets will never match a flow and will be dropped at first hop switch
June 2007NSF Find Forensic Support User host Host IP IP MAC MAC switch port Switch port switch port User Login Host Join Switch Join Link Change Replay Log All bindings logged Current bindings + packet + timestamp + log = bindings at time packet was sent Controller Bindings
June 2007NSF Find Forensics Given a packet can determine Which user/host sent and received it Physical port it was sent/received from What the topology looked like when it was sent Access control bind state and log (only admin access)
June 2007NSF Find Anonymity IP addresses allocated dynamically Source MAC can be swapped by switches (use IP during forensics) End-hosts perform encryption
June 2007NSF Find Source Address? Doesnt matter Addresses are virtual and multiplexed among physical ports Address allocations are enforced by network Address + bind log = source
June 2007NSF Find Mechanism Issues Requires bind state and log Function assumes global trust Minor compared to flow state Encryption off datapath = good Simple switches at Gig speeds
June 2007NSF Find Questions?