Design and Implementation of a Flow.pptVIP

Towards a Flow-level Network Security System Tim Hinrichs University of Chicago Local Area Networks Network Policy Examples “Every wireless guest user must send HTTP requests through an HTTP proxy.” “No phone can communicate with any private computer.” “Superusers have no communication restrictions.” “Laptops cannot receive incoming connections.” Traditional Network Management Today networks are managed by low-level configuration of independent components, e.g. firewalls, proxies, routers. Dependent on underlying network. Examples Block user access by adding an ACL entry. Requires knowing user’s IP address. Force guests port 80 traffic through a proxy. Requires knowing the network topology and the location of each guest. Example Management by Component Configuration Benefits Efficiency of operation. Administrative fiefdoms enjoy autonomy. Drawbacks Inefficiencies of maintenance. Inconsistencies are likely. Network Operating Systems Provide a programmatic interface to observe and control the entire network. Applications perform the actual management by making system calls. Two paradigm shifts Logical Centralization: Applications are written as if network were present on single machine. Abstraction: Applications are written in terms of abstract entities, e.g. users and hosts. Example Management by Network Operating System Potential Benefits Efficiency of maintenance. Inconsistencies are less likely. Potential Drawbacks Inefficiencies of operation. Loss of autonomy. Network Security An authorization policy is implemented as an application in a network operating system. The same is true for an authentication policy. Focus for today: a language for expressing authorization policies over networks. NOX: A Network Operating System Natasha Gude Teemu Koponen Justin Pettit Ben Pfaff Martìn Casado Nick McKeown Scott Shenker NOX Architecture Switch Abstraction OpenFlow switch abstraction is a flow table. Each flow table entry takes the form header : c