SFC Security Mimicry Defense

4.1. Mimicry Defense

The mimic defense technology is an active defense strategy proposed against the serious asymmetry of the defense cost and attack cost of cyberspace. The redundancy and heterogeneity of the executive body are introduced to change the unity and similarity of the system, and the dynamic and randomness are adopted to change the stativity and certainty of the system, and the non-similar redundancy space is used to block or disrupt the network attack to meet the requirements of controllable system security risks.¶

Specifically, the mimic security defense is composed of executive bodies with equivalent functions but different composition structures to form the core function. Based on the DHRM, randomness and dynamicity are realized, and the heterogeneous executive bodies in the heterogeneous executive pool are continuously changing, which greatly improves the dynamics and uncertainty of functional representation. It makes it difficult for a hacker to detect the behavior and characteristics of the target system, increasing the complexity of the system, and also makes it difficult for hackers to exploit system vulnerabilities to make effective attacks.¶

The DHRM is the basic model of mimic defense. Heterogeneity is the foundation of the dynamic heterogeneous redundancy architecture. It is necessary to ensure that each heterogeneous executive has the greatest difference in various characteristics and attributes. The more heterogeneous attributes a heterogeneous executor has, the more loopholes it can defend, and the higher the cost and price an attacker will have to pay for an attack. Dynamicity means that different sets of heterogeneous actuators can be generated in different periods to replace the currently compromised set of heterogeneous actuators. Dynamicity makes the system present different characteristics to the outside world in different periods. This brings uncertainty to the attacker's attack, which will further increase the difficulty of the attacker's attack. Redundancy means that multiple heterogeneous executors which have the same function process the same business request. The collaborative work between the heterogeneity and redundancy realizes the change of the single environment on which the attack depends, increasing the attacker's attack cost and difficulty, and improving the security and reliability of the system. This concept was first proposed in 2013 and has been effectively applied in the field of cyberspace security, such as mimic routers, mimic web servers, mimic DNS, mimic workflow execution system, mimic blockchain, etc. In addition, some mimic network devices have been produced and tested successfully.¶

4.2. SFC Mimicry Defense Architecture

   +---------------------------------------------------------------------+
   |                                 Control   Plane                     |
   +---------------------------------------------------------------------+
            |          |         |               |           |
            |          | +=====================+ |+======================+
            |          | |   Mimetic Control   | ||    Mimetic Control   |
            |          | |       Plugin        | ||        Plugin        |
            |          | |+--------+ +--------+| || +--------+ +--------+|
            |          | ||Schedule| |Decision|| || |Schedule| |Decision||
            |          | || Module | | Module || || | Module | | Module ||
            |          | |+--------+ +--------+| || +--------+ +--------+|
            |          | +=====================+ |+======================+
            |          |   |     |               |  |        |
            |          |   |     |               |  |        |
            |          |   | +-------------+     |  |  +--------------+
            |          |   | |Heterogeneous|     |  |  |Heterogeneous |
            |          |   | | SF Executive|     |  |  | SF Executive |
            |          |   | |    Pool     |     |  |  |    Pool      |
            |          |   | +-------------+     |  |  +--------------+
            |          |   |     |               |  |    |
            |          |   |     |               |  |    |
+-----+ +----------+  +-----------+       +----------------+  +------+
|Users|-|Classifier|--|    SFF1   | ......|      SFFn      |--|Target|
+-----+ +----------+  +-----------+       +----------------+  +------+
              Figure 1: SFC Mimicry Defense Architecture

The detailed system architecture is shown in Figure 1. For a better understanding, it is assumed that the system has a single SFC (including the host, SFF, SF, and independent servers with other modules, each SF connected to an SFF) and a single control plane. The system architecture contains 05 components as follows:¶

Control plane defines the SFC in the network. The control plane installs the flow rules in the SFF, and delivers the classification strategy to the classifier based on the information uploaded by the classifier. According to the judgment result, the abnormal SF executor is cleaned and be offline, and the next SFF in the SFC is notified that data is coming when the data passes through the SFF.¶

Mimic control plug-in: composed of 02 modules.¶

1. Scheduling module: accept the running instruction of the control plane, select N SF executives from the SF executive pool to activate by using the scheduling algorithm.¶
2. Judgment module: Judge the execution result of the SF executive body, and randomly select one from the correct results and send it to the SFF. If an abnormal SF executor is judged, the abnormal information will be transmitted to the control plane.¶

SF executive body pool: it consists of M heterogeneous SF executive bodies, and N of them are activated by the scheduling module every time when data passes.¶

SFF: forward the data according to the NSH information, copy the packet into N copies and send the information to activate the scheduling module.¶

Classifier: send the packet information to the control plane, and add the corresponding NSH to the packet according to the classification strategy issued by the control plane.¶

4.3. Data Flow

+-----+  +----------+  +----+     +----+       +----+        +------+
|Users|--|Classifier|--|SFF1|-----|SFF2| ......|SFFn|--------|Target|
+-----+  +----------+  +----+     +----+       +----+        +------+
                          |          |           |
                          |          |           |
                       +-----+    +-----+     +-----+
                       | SF1 |    | SF2 |     | SFn |
                       +-----+    +-----+     +-----+
                         Figure 2: SFC Use Case

Take the SFC in Figure 2 as an example, we assume that the packet path is the source host-classifier-SFF1-SF1-SFF1-SFF2-SF2 ...- target host. The data first reaches the classifier before entering the SFC domain, and the classifier sends the data information to the control plane. The controller sends a classification strategy to the classifier based on the uploaded information, then the classifier adds NSH to the data packet according to the strategy and forwards the data packet to SFF1 based on the header information. When the data arrives at SFF1, we need to judge whether the data packet needs to go through SF1 according to the NSH of the data packet.¶

When the packet reaches SFF1 for the first time, it should be forwarded to SF. Therefore, SFF1 first sends a running instruction to the scheduling module. After the scheduling module receives the instruction, it uses a scheduling algorithm to select N activations from the SF executive pool. Then, the information for activating the SF actuator is forwarded to SFF1. SFF1 copies the packet into N copies and sends the data to N SF actuators according to the information provided by the scheduling module. Each SF performs its designated network function and sends the execution result to the decision module. After the judgment module accepts the execution result, it judges whether there is an abnormal SF executive body by using a judgment algorithm. If there is an abnormal execution body, the abnormal information is sent to the control plane, and the abnormal SF will be cleaned and offline by the control plane, then the decision module selects one from the correct results and sends it to SFF1. If there is no abnormal execution body, it will directly select one from the correct results and send it to SFF1. SFF1 judges whether to forward to SF1 according to the NSH of the returned packet.¶

In this case, the packet should be forwarded to SFF2. After the packet reaches SFF2, the same judgment and operation are performed until it leaves the SFC domain.¶

4.4. Analysis of Attack and Defense

The SF executive pool is the foundation of the security of this framework. By configuring M heterogeneous SF execution bodies to form an SF execution body pool and using a scheduling algorithm to select N activation methods from the M SF execution bodies to improve the heterogeneity and dynamicity of the architecture, which increases the difficulty of the hacker's attacks. Assuming that the packet path is the source host-classifier-SFF1-SF1-SFF1-SFF2-SF2 ...- target host. For a traditional SFC, if a hacker hijacks SF1, it can manipulate SF1 to tamper with NSH so that traffic cannot reach SFF2. Furthermore, if the attacker intercepts the mapping table of SFF2, the hacker can tamper with the NSH header to make the traffic go through a completely different SFC link. Any device in the SFC domain, including the controller, will not find any abnormalities. A hacker can also directly tamper with the service functions of SF, for instance, the original SF performs load-balancing function. The hacker can tamper with all the data to the same link, which may paralyze the entire link.¶

If the security framework of this document is adopted, first, during the SF attack detection phase, the hacker will find that there are M SFs with the same function but different operating environments and hardware devices mounted under the same SFF, which has caused certain difficulty for the attack. If the hacker successfully controls one SF executive in the M SF executive pool under SFF2. Before the data is forwarded from the control module to the SF executive body, the scheduling module uses a scheduling algorithm to activate N of the M SF executive bodies. When M and N differ greatly, the probability of selecting an abnormal SF execution body by random scheduling is extremely low. It is further assumed that even if an abnormal executor is selected, no matter whether the attacker tampers with the packet or data function in the controlled SF executor, the decision module can judge the exception when it judges the N execution results, it can select the correct result and send abnormal information to the control module for offline processing. Unless the hacker successfully attacks more than half of the SF execution bodies, the attack can be completely successful. While development vendors and hardware equipment are different in different SFs operating environment, which will cause great difficulty to the hacker.¶

In another case, after the packet arrives at SFF1, it is not forwarded to SF to complete the specified function but directly forwarded to SFF2. When the packet arrives at SFF2, SFF2 will infer from the NSH's SPI and SI information that the packet do not pass the specified function in the previous SFF, and then report an error to the control plane.¶

6.1. Normative References

[1]

Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997, <http://xml.resource.org/public/rfc/html/rfc2119.html>.

[2]

Quinn, P., Ed., Elzur, U., Ed., and C. Pignataro, Ed., "Network Service Header (NSH)", RFC 8300, DOI 10.17487/RFC8300, January 2018, <https://www.rfc-editor.org/info/rfc8300>.

6.2. Informative References

[3]

Halpern, J., Ed. and C. Pignataro, Ed., "Service Function Chaining (SFC) Architecture", RFC 7665, DOI 10.17487/RFC7665, October 2015, <https://www.rfc-editor.org/info/rfc7665>.