290 likes | 436 Views
Melanie Palmer, Rob Sullivan, John Bilberry. Network Service Security through software defined networking. LA-UR-13-25961. Overview. Introduction Test Method and Materials Results Conclusion Future Work Questions. LA-UR-13-25961. Software Defined Networking.
E N D
Melanie Palmer, Rob Sullivan, John Bilberry Network Service Security through software defined networking LA-UR-13-25961
Overview • Introduction • Test Method and Materials • Results • Conclusion • Future Work • Questions LA-UR-13-25961
Software Defined Networking • Separate the data plane and the control plane • Software layer between hardware and admin • Virtual networks within a physical network LA-UR-13-25961
OpenFlow • Open source SDN • Hardware management on a single platform • Exploits a common set of functions found on most switches • OpenFlow Protocol • Flow table • Actions LA-UR-13-25961
Controller • Management software for network • Communicates via a secure channel • Push and remove flows • Determine actions for undefined flows LA-UR-13-25961
Networks for Security Network 1 User Network 2 Switch Controller Security Node Rule 1 Allow access to Network 1 Rule 2 Redirect to Security Node if access to Network 2 is attempted • User job in Node 1 • If User accesses Node 2 • Redirect to Security Node LA-UR-13-25961
Networks for Security Network 1 User Network 2 Switch Controller Security Node Rule 1 Allow access to Network 1 Rule 2 Redirect to Security Node if access to Network 2 is attempted LA-UR-13-25961
Melanie Palmer Materials and Test Methods LA-UR-13-25961
Objective • Performance • Reliability • Scalability LA-UR-13-25961
Materials • Floodlight 0.9 • Open source • Widely used in industry • Java based • Our Cluster • Seven node • CentOS 6.4 • Arista 7050S • OpenFlow 1.0 • EOS 4.10.4 LA-UR-13-25961
Test Suite • Load Test • Performance • Reliability Load Test LA-UR-13-25961 Tests Sections Load Test Tests Sections
Test Suite Traffic Limit • Load Test Timing Limit Tests Sections Load Test LA-UR-13-25961 Tests Sections Load Test Tests Sections
Load Test Controller Node A Rule 1: Connect A and B Rule 2: Drop Anything to C Switch Node B NodeC LA-UR-13-25961
Load Test Controller Node A Rule 1: Connect A and C Rule 2: Drop Anything to B Switch Node B NodeC LA-UR-13-25961
Test Suite • Load Test • Speed Test • Scalability • Performance Load Test LA-UR-13-25961 Tests Sections Load Test Tests Sections
Test Suite • Load Test • Speed Test Load Test LA-UR-13-25961 Tests Sections Load Test Tests Sections
Speed Test Controller Node A Rule 1: Connect A and C Switch NodeC LA-UR-13-25961
Speed Test Controller Node A Rule 1: Drop Node C Switch NodeC LA-UR-13-25961
Test Suite Failure! • Load Test • Speed Test • Analysis Program Expected Behavior LA-UR-13-25961
Test Suite Failure! • Load Test • Speed Test • Analysis Program • Stage 1 - Extracts • Error rate • Flow change speed • Stage 2 - Analyzes • Averages data • Standard deviations LA-UR-13-25961
Rob Sullivan Results LA-UR-13-25961
Load Test Results LA-UR-13-25961
Speed Test Results LA-UR-13-25961
Problems • OpenFlow 1.0 • Volume and nature of data • Human error • Imprecision of some test methods • Meaningful packet redirection Some We Overcame Some We Didn’t LA-UR-13-25961
Conclusion LA-UR-13-25961
Will OpenFlow Work? Pro’s • Allows software reconfiguration of networks • Easy administration • Flows can be reliably pushed up to a measurable rate • Flow push failure is low even at high push rates Con’s • OpenFlowv. 1.0 inadequacies • Hardware specific limits • Potential security issues • Controller can get overwhelmed LA-UR-13-25961
Future Work • OpenFlow 1.1 • Security • Controllers and hardware • Scale LA-UR-13-25961
LA-UR-13-25961 Acknowledgements Instructors – Dane Gardner and Matthew Broomfield (T.A.) Mentors – Kyle Lamb (HPC-3) and Ben McClelland (HPC-5) Special Thanks: Los Alamos National Laboratory – Gary Grider, Josephine Olivas, Carolyn Connor, Scott Robbins and Carol Hogsett New Mexico Consortium – Ann Kuiper PRObE – Andree Jacobson Our Schools: University of Texas at El Paso New Mexico Institute of Mining and Technology Michigan Technological University
Your turn! Questions? LA-UR-13-25961