Um Plano de Controle Seguro e Distribuído para Redes Definidas por Software
Resumo
Redes Definidas por Software (SDN) surgiram como um novo paradigma para gerenciamento de redes, definindo uma arquitetura que separa os planos de dados e de controle. Uma arquitetura SDN baseada em um controlador centralizado não escala e nem tolera falhas, pois apresenta um ponto único de falhas. Controladores distribuídos baseados em um modelo de consistência após um tempo para gerenciamento do estado da rede também apresentam sérios problemas: um modelo de programação complexo para as aplicações de rede; e pode gerar anomalias na rede. Consequentemente, soluções considerando um modelo de dados consistente para o armazenamento das informações da rede SDN foram propostos. Nestas abordagens, os controladores distribuídos usam um armazenamento de dados consistente e tolerante a falhas para armazenar o estado relevante das aplicações e da rede. Infelizmente, estas propostas existentes não consideram requisitos fundamentais de segurança para a arquitetura SDN. Este trabalho apresenta nossos esforços no projeto, implementação e avaliação de um modelo seguro e consistente para o plano de controle, baseado no DepSpace, que é um espaço de tuplas com propriedades de segurança. Resultados experimentais mostram a viabilidade prática da arquitetura proposta.
Palavras-chave:
SDN, Plano de Controle, Modelos de Consistencia, Sistemas Distribuídos
Referências
Alves, P. G. M. R. and Aranha, D. F. (2016). A framework for searching encrypted databases. In XVI Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais (SBSEG 2016), pages 142-155. SBC.
Analytics, N. (2017). A java library for paillier partially homomorphic encryption. GitHub. https://github.com/n1analytics/javallier.
Avizienis, A., Laprie, J.-C., Randell, B., and Landwehr, C. (2004). Basic concepts and taxonomy of dependable and secure computing. IEEE Transactions on Dependable and Secure Computing, 1(1):11-33.
Bakken, D. E. and Schlichting, R. D. (1995). Supporting Fault-Tolerant Parallel Progra-ming in Linda. IEEE Transactions on Parallel and Distributed Systems, 6(3):287-302.
Bessani, A., Alchieri, E., Correia, M., and da Silva Fraga, J. (2008). DepSpace: A byzan-tine fault-tolerant coordination service. European Conference on Computer Systems.
Bessani, A., Sousa, J., and Alchieri, E. (2014). State machine replication for the masses with BFT-SMaRt. In International Conference on Dependable Systems and Networks.
Bessani, A. N., Correia, M., Fraga, J. S., and Lung, L. C. (2006). Sharing memory between Byzantine processes using policy-enforced tuple spaces. In Proceedings of 26th IEEE International Conference on Distributed Computing Systems -ICDCS 2006.
Boldyreva, A., Chenette, N., Lee, Y., and O'Neill, A. (2012). Order-preserving symmetric encryption. Cryptology ePrint Archive, Report 2012/624.
Boneh, D., Lewi, K., Raykova, M., Sahai, A., Zhandry, M., and Zimmerman, J. (2014). Semantically secure order-revealing encryption: Multi-input functional encryption without obfuscation. Cryptology ePrint Archive, Report 2014/834.
Boneh, D. and Shoup, V. (2015). A graduate course in applied cryptography. https: //crypto.stanford.edu/˜dabo/cryptobook/draft_0_2.pdf.
Botelho, F., Ribeiro, T. A., Ferreira, P., Ramos, F. M. V., and Bessani, A. (2016). Design and implementation of a consistent data store for a distributed sdn control plane. In 2016 12th European Dependable Computing Conference (EDCC), pages 169-180.
Botelho, F. A., Ramos, F. M. V., Kreutz, D., and Bessani, A. N. (2013). On the feasi-bility of a consistent and fault-tolerant data store for sdns. In 2013 Second European Workshop on Software Defined Networks, pages 38-43.
Castro, M. and Liskov, B. (2002). Practical Byzantine fault-tolerance and proactive reco-very. ACM Transactions Computer Systems, 20(4):398-461.
Distler, T., Bahn, C., Bessani, A., Fischer, F., and Junqueira, F. (2015). Extensible distri-buted coordination. In Proc. of 10th European Conference on Computer Systems.
Eko Oktian, Y., Lee, S., Lee, H., and Lam, J. (2017). Distributed sdn controller system: A survey on design choice. Computer Networks, 121.
Floriano, E., Alchieri, E., Aranha, D., and Solis, P. (2017a). Privacidade em dados arma-zenados em memória compartilhada através de espaços de tupla. In Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos.
Floriano, E., Alchieri, E., Aranha, D., and Solis, P. (2017b). Providing privacy on the tuple space model. Journal of Internet Services and Applications, 8(19):1-16.
Gelernter, D. (1985). Generative Communication in Linda. ACM Transactions on Pro-graming Languages and Systems, 7(1):80-112.
Hu, T., Guo, Z., Baker, T., and Lan, J. (2018). Multi-controller based software-defined networking: A survey. IEEE Access, PP:1-1.
Kreutz, D., Ramos, F. M. V., Veríssimo, P., Rothenberg, C. E., Azodolmolky, S., and Uhlig, S. (2014). Software-defined networking: A comprehensive survey. Proceedings of the IEEE, 103:14-76.
Lewi, K. and Wu, D. J. (2016). Order-revealing encryption: New constructions, appli-cations, and lower bounds. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 1167-1178.
McKeown, N., Anderson, T., Balakrishnan, H., Parulkar, G., Peterson, L., J. Rexford, S. S., and Turner, J. (2008).
Openflow: Enabling innovation in campus networks. ACM SIGCOMM Computer Communication, 38.
Naehrig, M., Lauter, K., and Vaikuntanathan, V. (2011). Can homomorphic encryption be practical? In Proceedings of 3rd Workshop on Cloud Computing Security Workshop.
Paillier, P. (1999). Public-key cryptosystems based on composite degree residuosity clas-ses. In Proceedings of the 17th International Conference on Theory and Application of Cryptographic Techniques, EUROCRYPT'99, pages 223-238.
Schneider, F. B. (1990). Implementing fault-tolerant service using the state machine apro-ach: A tutorial. ACM Computing Surveys, 22(4):299-319.
Schoenmakers, B. (1999). A simple publicly verifiable secret sharing scheme and its ap-plication to electronic voting. In Proceedings of the 19th Annual International Cryp-tology Conference on Advances in Cryptology -CRYPTO'99, pages 148-164.
Segall, E. J. (1995). Resilient distributed objects: Basic results and applications to shared spaces. In Proceedings of the 7th Symposium on Parallel and Distributed Processing.
Tourky, D., ElKawkagy, M., and Keshk, A. (2016). Homomorphic encryption the "holy grail" of cryptography. In 2nd IEEE Conference on Computer and Communications.
White, B., Lepreau, J., Stoller, L., Ricci, R., Guruprasad, S., Newbold, M., Hibler, M., Barb, C., and Joglekar, A. (2002). An Integrated Experimental Environment for Dis-tributed Systems and Networks. In Proc. of 5th Symp. on Operating Systems Design and Implementations. ACM.
Analytics, N. (2017). A java library for paillier partially homomorphic encryption. GitHub. https://github.com/n1analytics/javallier.
Avizienis, A., Laprie, J.-C., Randell, B., and Landwehr, C. (2004). Basic concepts and taxonomy of dependable and secure computing. IEEE Transactions on Dependable and Secure Computing, 1(1):11-33.
Bakken, D. E. and Schlichting, R. D. (1995). Supporting Fault-Tolerant Parallel Progra-ming in Linda. IEEE Transactions on Parallel and Distributed Systems, 6(3):287-302.
Bessani, A., Alchieri, E., Correia, M., and da Silva Fraga, J. (2008). DepSpace: A byzan-tine fault-tolerant coordination service. European Conference on Computer Systems.
Bessani, A., Sousa, J., and Alchieri, E. (2014). State machine replication for the masses with BFT-SMaRt. In International Conference on Dependable Systems and Networks.
Bessani, A. N., Correia, M., Fraga, J. S., and Lung, L. C. (2006). Sharing memory between Byzantine processes using policy-enforced tuple spaces. In Proceedings of 26th IEEE International Conference on Distributed Computing Systems -ICDCS 2006.
Boldyreva, A., Chenette, N., Lee, Y., and O'Neill, A. (2012). Order-preserving symmetric encryption. Cryptology ePrint Archive, Report 2012/624.
Boneh, D., Lewi, K., Raykova, M., Sahai, A., Zhandry, M., and Zimmerman, J. (2014). Semantically secure order-revealing encryption: Multi-input functional encryption without obfuscation. Cryptology ePrint Archive, Report 2014/834.
Boneh, D. and Shoup, V. (2015). A graduate course in applied cryptography. https: //crypto.stanford.edu/˜dabo/cryptobook/draft_0_2.pdf.
Botelho, F., Ribeiro, T. A., Ferreira, P., Ramos, F. M. V., and Bessani, A. (2016). Design and implementation of a consistent data store for a distributed sdn control plane. In 2016 12th European Dependable Computing Conference (EDCC), pages 169-180.
Botelho, F. A., Ramos, F. M. V., Kreutz, D., and Bessani, A. N. (2013). On the feasi-bility of a consistent and fault-tolerant data store for sdns. In 2013 Second European Workshop on Software Defined Networks, pages 38-43.
Castro, M. and Liskov, B. (2002). Practical Byzantine fault-tolerance and proactive reco-very. ACM Transactions Computer Systems, 20(4):398-461.
Distler, T., Bahn, C., Bessani, A., Fischer, F., and Junqueira, F. (2015). Extensible distri-buted coordination. In Proc. of 10th European Conference on Computer Systems.
Eko Oktian, Y., Lee, S., Lee, H., and Lam, J. (2017). Distributed sdn controller system: A survey on design choice. Computer Networks, 121.
Floriano, E., Alchieri, E., Aranha, D., and Solis, P. (2017a). Privacidade em dados arma-zenados em memória compartilhada através de espaços de tupla. In Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos.
Floriano, E., Alchieri, E., Aranha, D., and Solis, P. (2017b). Providing privacy on the tuple space model. Journal of Internet Services and Applications, 8(19):1-16.
Gelernter, D. (1985). Generative Communication in Linda. ACM Transactions on Pro-graming Languages and Systems, 7(1):80-112.
Hu, T., Guo, Z., Baker, T., and Lan, J. (2018). Multi-controller based software-defined networking: A survey. IEEE Access, PP:1-1.
Kreutz, D., Ramos, F. M. V., Veríssimo, P., Rothenberg, C. E., Azodolmolky, S., and Uhlig, S. (2014). Software-defined networking: A comprehensive survey. Proceedings of the IEEE, 103:14-76.
Lewi, K. and Wu, D. J. (2016). Order-revealing encryption: New constructions, appli-cations, and lower bounds. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 1167-1178.
McKeown, N., Anderson, T., Balakrishnan, H., Parulkar, G., Peterson, L., J. Rexford, S. S., and Turner, J. (2008).
Openflow: Enabling innovation in campus networks. ACM SIGCOMM Computer Communication, 38.
Naehrig, M., Lauter, K., and Vaikuntanathan, V. (2011). Can homomorphic encryption be practical? In Proceedings of 3rd Workshop on Cloud Computing Security Workshop.
Paillier, P. (1999). Public-key cryptosystems based on composite degree residuosity clas-ses. In Proceedings of the 17th International Conference on Theory and Application of Cryptographic Techniques, EUROCRYPT'99, pages 223-238.
Schneider, F. B. (1990). Implementing fault-tolerant service using the state machine apro-ach: A tutorial. ACM Computing Surveys, 22(4):299-319.
Schoenmakers, B. (1999). A simple publicly verifiable secret sharing scheme and its ap-plication to electronic voting. In Proceedings of the 19th Annual International Cryp-tology Conference on Advances in Cryptology -CRYPTO'99, pages 148-164.
Segall, E. J. (1995). Resilient distributed objects: Basic results and applications to shared spaces. In Proceedings of the 7th Symposium on Parallel and Distributed Processing.
Tourky, D., ElKawkagy, M., and Keshk, A. (2016). Homomorphic encryption the "holy grail" of cryptography. In 2nd IEEE Conference on Computer and Communications.
White, B., Lepreau, J., Stoller, L., Ricci, R., Guruprasad, S., Newbold, M., Hibler, M., Barb, C., and Joglekar, A. (2002). An Integrated Experimental Environment for Dis-tributed Systems and Networks. In Proc. of 5th Symp. on Operating Systems Design and Implementations. ACM.
Publicado
24/09/2019
Como Citar
SILVA, Jefferson ; ALCHIERI, Eduardo ; BORDIM, Jacir ; GONDIM, João .
Um Plano de Controle Seguro e Distribuído para Redes Definidas por Software. In: WORKSHOP DE TESTES E TOLERÂNCIA A FALHAS (WTF), 20. , 2019, Gramado.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2019
.
p. 20-33.
ISSN 2595-2684.
DOI: https://doi.org/10.5753/wtf.2019.7712.
