Enabling fast, dynamic network processing with clickOS

Zhang

Security and Communication Networks

et al. 2017

Security functions are usually deployed on proprietary hardware, which makes the delivery of security service inflexible and of high cost. Emerging technologies such as software-defined networking and network function virtualization go in the direction of executing functions as software components in virtual machines or containers provisioned in standard hardware resources. They enable network to provide customized security service by deploying Security Service Chain (SSC), which refers to steering flow through multiple security functions in a particular order specified by individual user or application. However, SSC Deployment Problem (SSC-DP) needs to be solved. It is a challenging problem for various reasons, such as the heterogeneity of instances in terms of service capacity and resource demand. In this paper, we propose an SSC-based approach to deliver security service to users without worrying about physical locations of security functions. For SSC-DP, we present a three-phase method to solve it while optimizing network and security resource allocation. The presented method allows network to serve a large number of flows and minimizes the latency seen by flows. Comparative experiments on the fat-tree and Waxman topologies show that our method performs better than other heuristics under a wide range of network conditions.

Section: Acceptance Ratiomentioning

confidence: 93%

“…This way of separating and abstracting functionalities from locations facilitates flexible orchestration of network functions [5]. Moreover, in the state of the art, VNFs can achieve approximate performance of hardware devices [6][7][8]. Together, SDN and NFV make networks and network devices agile [9].…”

Section: Introductionmentioning

confidence: 99%

A New Approach for Delivering Customized Security Everywhere: Security Service Chain

Zhang

Security and Communication Networks

et al. 2017

“…In this section, we introduce three recently developed NFVI frameworks: ClickOS [8], [9], Elastic Edge (E2) [10], and NetVM/OpenNetVM [11], [12]. All these frameworks enable NFs to achieve near-line rates at 10 Gbps on commodity servers by optimizing I/O subsystems and using high-performance packet-processing libraries.…”

Section: Nfvi Frameworkmentioning

confidence: 99%

“…ClickOS [8], [9] is a VM platform that supports a variety of middlebox functions. Current custom-hardware based middleboxes have problems such as high costs and management issues, and are typically inflexible in their support for modifications.…”

Section: Motivationmentioning

confidence: 99%

Network Function Virtualization: A Survey

Veeraraghavan

Sato

Buchanan

et al. 2017

IEICE Trans. Commun.

SUMMARYThe objectives of this survey are to provide an in-depth coverage of a few selected research papers that have made significant contributions to the development of Network Function Virtualization (NFV), and to provide readers insights into the key advantages and disadvantages of NFV and Software Defined Networks (SDN) when compared to traditional networks. The research papers covered are classified into four categories: NFV Infrastructure (NFVI), Network Functions (NFs), Management And Network Orchestration (MANO), and service chaining. The NFVI papers describe "framework" software that implement common functions, such as dynamic scaling and load balancing, required by NF developers. Papers on NFs are classified as offering solutions for software switches or middleboxes. MANO papers covered in this survey are primarily on resource allocation (virtual network embedding), which is an orchestrator function. Finally, service chaining papers that offer examples and extensions are reviewed. Our conclusions are that with the current level of investment in NFV from cloud and Internet service providers, the promised cost savings are likely to be realized, though many challenges remain.

“…Eliminating the requirement to support multiple processes and/or multiple users simplifies the code base required to implement a unikernel and reduces the overhead required to complete a single unit of useful work. Several examples have been deployed alongside virtualization technologies in cloud applications [65]- [67]. Despite their proven usefulness for providing fast, highly focused applications, unikernels don't, in isolation, provide protection from most of the attack vectors discussed in this paper.…”

Section: Unikernelsmentioning

confidence: 99%

Containing a Confused Deputy on x86: A Survey of Privilege Escalation Mitigation Techniques

Brookes¹,

Taylor²

2016

ijacsa

Abstract-The weak separation between user-and kernelspace in modern operating systems facilitates several forms of privilege escalation. This paper provides a survey of protection techniques, both cutting-edge and time-tested, used to prevent common privilege escalation attacks. The techniques are compared against each other in terms of their effectiveness, their performance impact, the complexity of their implementation, and their impact on diversification techniques such as ASLR. Overall the literature provides a litany of disjoint techniques, each of which trades some performance cost for effectiveness against a particular isolated threat. No single technique was found to effectively mitigate all known and potential attack vectors with reasonable performance cost overhead.