Don't Yank My Chain: Auditable NF Service Chaining
Don't Yank My Chain: Auditable NF Service Chaining
复制标题
DOI：
--
复制
发表时间：
2021
影响因子：
3.7
通讯作者：
Guyue Liu;Hugo Sadok;Anne Kohlbrenner;Bryan Parno;Vyas Sekar;Justine Sherry
中科院分区：
文献类型：
--
作者：
Guyue Liu;Hugo Sadok;Anne Kohlbrenner;Bryan Parno;Vyas Sekar;Justine Sherry
审计是具有敏感信息的组织中的关键组成部分，例如银行和医院。 NFV对安全敏感的环境的好处，审核框的设计和实现不仅使NFV与兼容审计，但在传统审计中也提供了更强的保证，管理员在时间表上测试了系统的正确性，例如每月一次。遵守政策目标。系统行为通过将受信任的执行环境与轻量级验证的路由协议（VRP）结合起来，尽管审核盒的路由策略相对于传统的路由，但审核盒的路由策略的复杂性，每个数据包（在一个5跳服务链中），比为Internet设计的VRP上的先前工作可提供61-67％的好评。
Auditing is a crucial component of network security practices in organizations with sensitive information, such as banks and hospitals. Unfortunately, network function virtualization (NFV) is viewed as incompatible with auditing practices which verify that security functions operate correctly. In this paper, we bring the benefits of NFV to security-sensitive environments with the design and implementation of AuditBox. AuditBox not only makes NFV compatible with auditing, but also provides stronger guarantees than traditional auditing procedures. In traditional auditing, administrators test the system for correctness on a schedule, e.g., once per month. In contrast, AuditBox continuously self-monitors for correct behavior, proving runtime guarantees that the system remains in compliance with policy goals. Furthermore, AuditBox remains compatible with traditional auditing practices by providing sampled logs which still allow auditors to inspect system behavior manually. AuditBox achieves its goals by combining trusted execution environments with a lightweight verified routing protocol (VRP). Despite the complexity of routing policies for service-function chains relative to traditional routing, AuditBox’s protocol introduces 72-80% fewer bytes of overhead per packet (in a 5-hop service chain) and provides 61-67% higher goodput than prior work on VRPs designed for the Internet.