SIMPLE-fying Middlebox Policy Enforcement Using SDN Zafar Ayyub Qazi, Cheng-Chun Tu, Luis Chiang, Rui Miao, Vyas Sekar, Minlan Yu Presenter: Chen Qian

Middleboxes are important Security Network Function Firewall IDS Acceleration Network Function Network function, also known as middlleboxes, are playing important role in the network. Network Functions nowadays are ubiquitous in the network. Network functions are the networking devices that perform tasks other than packet forwarding. Network functions are built for different purposes. One category of network functions is used to enhance the security of enterprise networks, campus networks, or any others. The examples are firewall and intrusion detection system. Another category of network functions is used to accelerate the speed of the network. For instance, wide area network optimizer could be used to compress the traffic and web proxy is used for caching web pages. WAN Optimizer Proxy

Hardware and software middleboxes IDS Hardware Software WAN Optimizer Traditionally, these network functions are built in propriety dedicated hardware. These hardware boxes incur high expenses for physical equipment as well as operational costs. Hardware updates and replacements are not easy, which also involve in a great amount of human labor and financial cost. To address these challenges, there is a trend in the networking community to build software version of these network functions. Based on software network functions, Network function virtualization is proposed to use virtualization technology to virtualize network functions nodes into blocks. Proxy

How middleboxes process network traffic 1. The specified network traffic should go through a sequence of middlebox before reaching the destination Firewall - IDS - Proxy 2. Middlebox policies (types and orders of MBs) should be strictly reinforced

Middleboxes management is hard! Survey across 57 network operators (J. Sherry et al. SIGCOMM 2012) e.g., a network with ~2000 middleboxes required 500+ operators Critical for security, performance, compliance But expensive, complex and difficult to manage

How SDN helps middleboxes SDN can effectively configure flow paths so that a flow can go through a number of middleboxes in a given order SDN can assign different flows to different middleboxes so that the load on middleboxes can be balanced

Can SDN simplify middlebox management? Centralized Controller Firewall IDS Proxy Web OpenFlow “Flow” FwdAction … “Flow” FwdAction … Proxy IDS Scope: Enforce middlebox-specific steering policies Necessity + Opportunity: Incorporate functions markets views as important

What makes this problem challenging? Centralized Controller Firewall IDS Proxy Web OpenFlow “Flow” FwdAction … “Flow” FwdAction … Proxy IDS Middleboxes introduce new dimensions beyond L2/L3 tasks. Achieve this with unmodified middleboxes and existing SDN APIs

SIMPLE Policy enforcement layer for Firewall IDS Proxy Web Policy enforcement layer for middlebox-specific “traffic steering” Legacy Middleboxes OpenFlow capable Flow Action … Flow Action …

Outline Motivation Challenges SIMPLE Design Evaluation Conclusions 10

Challenge: Policy Composition Firewall IDS Proxy * Policy Chain: Oops! Forward Pkt to IDS or Dst? Firewall Proxy IDS S1 S2 Dst “Loops” Traditional flow rules may not suffice!

Challenge: Resource Constraints Firewall Proxy Space for traffic split? S2 S4 S1 IDS1 = 50% IDS2 = 50% S3 Can we set up “feasible” forwarding rules?

Challenge: Dynamic Modifications User1: Proxy  Firewall User2: Proxy Proxy may modify flows User 1 Proxy S1 S2 User 2 Firewall Are forwarding rules at S2 correct?

New dimensions beyond Layer 2-3 tasks 1) Policy Composition  Potential loops 2) Resource Constraints  Switch + Middlebox 3) Dynamic Modifications  Correctness? Can we address these with unmodified middleboxes and existing SDN APIs?

Outline Motivation + Context for the Work Challenges SIMPLE Design Evaluation Conclusion

SIMPLE System Overview Firewall IDS Proxy Web Rule Generator Resource Manager Modifications Handler Legacy Middleboxes OpenFlow capable Flow Action … Flow Action …

High-level input The network administrators specify the processing policies to the resource manager, without worrying about where the process occur. The network topology and traffic information are input to the resource manager Resource constraints are input to the resource manager 1. packet processing resources (CPU, memory, accelerators) for different middleboxes 2. TCAM available for installing forwarding rules

Composition  Tag Processing State Firewall IDS Proxy * Policy Chain: Firewall Proxy IDS Fwd to Dst S1 S2 Dst Post-Proxy Post-Firewall ORIGINAL Post-IDS Insight: Distinguish different instances of the same packet

Inter-switch tunnels

SIMPLE System Overview Firewall IDS Proxy Web Rule Generator Resource Manager Modifications Handler Legacy Middleboxes OpenFlow capable Flow Action … Flow Action …

Resource Constraints Joint Optimization Topology & Traffic Switch TCAM Middlebox Capacity + Footprints Policy Spec Resource Manager Optimal & Feasible load balancing Theoretically hard! Not obvious if some configuration is feasible!

Offline + Online Decomposition Policy Spec Network Topology Switch TCAM Mbox Capacity + Footprints Traffic Matrix Resource Manager Offline Stage Online Step Deals with Switch constraints Deals with only load balancing

Offline Stage: ILP based pruning

Offline Stage: ILP based pruning Feasible Sufficient freedom Set of all possible middlebox load distributions Pruned Set Balance the middlebox load (online, LP)

SIMPLE System Overview FW IDS Proxy Web Rule Generator Resource Manager Modifications Handler Legacy Middleboxes OpenFlow capable Flow Action … Flow Action …

Modifications  Infer flow correlations Correlate flows Install rules Payload Similarity User 1 Proxy S1 S2 User 2 Firewall User1: Proxy  Firewall User2: Proxy

When a middlebox changes everything Payloads still have a significant amount of partial overlap. For the proxy case, the web content still matches. Use Rabin fingerprints to calculate the similarity.

SIMPLE Implementation FW IDS Proxy Web Rule Generator (Policy Composition) Resource Manager (Resource Constraint) Modifications Handler (Dynamic modifications) CPLEX POX extensions OpenFlow 1.0 Flow Tag/Tunnel Action … Flow Tag/Tunnel Action …

Outline Motivation + Context for the Work Challenges SIMPLE Design Evaluation Conclusion

Evaluation and Methodology What benefits SIMPLE offers? load balancing? How scalable is the SIMPLE optimizer? How close is the SIMPLE optimizer to the optimal? How accurate is the dynamic inference? Methodology Small-scale real test bed experiments (Emulab) Evaluation over Mininet (with up to 60 nodes) Large-scale trace driven simulations (for convergence times)

Compare to Ingress-based method The middleboxes closest to the ingress are selected.

Benefits: Load balancing Optimal 4-7X better load balancing and near optimal

Overhead: Reconfiguration Time 33 node topology including 11 switches Around 125 ms to reconfigure, most time spent in pushing rules

Fraction of sequences with loops

Time of execution

Other Key Results LP solving takes 1s for a 252 node topology 4-5 orders of magnitude faster than strawman 95 % accuracy in inferring flow correlations Scalability of pruning: 1800s  110s

Conclusions Middleboxes: Necessity and opportunity for SDN Goal: Simplify middlebox-specific policy enforcement Challenges: Composition, resource constraints, modifications SIMPLE: policy enforcement layer Does not modify middleboxes No changes to SDN APIs No visibility required into the internal of middleboxes Scalable and offers 4-7X improvement in load balancing