resonanceppt - GT Noiseresonanceppt - GT噪声.pptVIP

Resonance: Dynamic Access Control in Enterprise Networks Ankur Nayak, Alex Reimers, Nick Feamster, Russ Clark School of Computer Science Georgia Institute of Technology Summary Enterprise and campus networks are dynamic Hosts continually coming and leaving Hosts may become infected Today, access control is static, and poorly integrated with the network layer itself Resonance: Dynamic access control Track state of each host on the network Update forwarding state of switches per host as these states change State of the Art Today’s networks have many components “bolted on” after the fact Firewalls, VLANs, Web authentication portal, vunerability scanner Separate (and perhaps competing) devices for performing the following functions Registration (based on MAC addresses) Scanning Filtering and rate limiting traffic Problems with Current Architecture Access Control is too coarse-grained Cannot dynamically remap hosts to different portions of the network Needs a DHCP request which for a windows user would mean a reboot Monitoring is not continuous Problems with Current Approaches Existing enterprise security techniques are reactive and ad-hoc A mix of security middleboxes, intrusion detection systems etc. result in collection of complex network configurations Possible negative side effects Misconfiguration Security problems Resonance: Summary Step 1: Associate each host with generic states and security classes. Step 2: Specify a state machine for moving machines from one state to the other. Step 3: Control forwarding state in switches based on the current state of each machine. Actions from other network elements, and distributed inference, can affect network state. Applying Resonance to START Resonance: Step-by-Step Preliminary Implementation: OpenFlow OpenFlow: Flow-based control over the forwarding behavior of switches and routers A switch, a centralized controller and end-hosts Switches communicate with the controller through an open protocol over a secur