Abstract
In today’s Internet, modern routers rely on high-performance reliable general-purpose multi-core packet processing systems in order to support the flexibility and the plethora of protocol operations and applications. These processing systems are programmable and have replaced the traditional-fixed logic ASICs in the data path of such routers. Hence, lots of vulnerabilities and faults are introduced as the result of such programmability making the systems susceptible to attacks and failures. Particularly, it is a difficult task to detect whether a processing core behaves correctly, or it has a failure resulting from errors or attacks. In this paper, we address this problem by proposing a novel approach to verify the correct operation of the network processor. We propose a secure, faulttolerant, and reliable monitoring subsystem which functions in parallel with the processing core of the router and aids in the detection of attacks changing the processing behavior of the processor. We prove experimentally that our system has the ability to detect the malicious activity and securely restore the router’s operation to a different, but functionally equivalent, state. We also show experimentally that our approach has a better efficiency when compared with other existing work.
1 Introduction
The size, diversity, and complexity of modern networks continue to increase resulting in the development of new protocol and communication paradigms, such as content-addressable networks, that need to be deployed in order to improve the network operation. This entails the use of programmable network processors to meet such demands. Fortunately, the advances in the performance of general-purpose multi-core processors fulfilled this necessity by enabling the development of routers which are based on highly parallel, embedded multiprocessor systems-on-chip (MPSoCs) as an integral component. Network vendors and operators can now achieve a new level of flexibility due to the use of programmable components in the data path [1].
6 Conclusion
The use of routers equipped with general-purpose processing engines and executing software-based packet processing is becoming more prevalent in the Internet. Using software-based processing in the data plane of the network presents a target for novel intrusion and denial-of-service attacks. This can have a significant impact on the overall security of the network. In our work, we present the design of an adaptive security mechanism for modern packet processors. We present a prototype implementation of a secure monitoring system which can be used in order to detect the attacks targeting the data plane of the network. This monitoring system is fault tolerant and reliable taking advantage of software design diversity comparing the operation of the processing cores to its corresponding expected behavior obtained by the offline analysis of the packet processing binary. The monitoring system will include different behaviors corresponding to different executions of the binary to be processed. The system continuously checks the execution of the processor and triggers a recovery mechanism if a deviation from the behavioral execution path is detected. The monitoring system we present is fast because it implements a new type of memory, the TCAM memory, performing fast searching and matching within two clock cycles. It is also a secure monitoring system implementing a SHA-256 hash which ensures the integrity of the binary code loaded. The prototype implementation of our monitoring system shows that our system is an effective approach in protecting the networking infrastructure in the future Internet with a negligible additional resource utilization and a very good speed.
