NetWarden: Mitigating Network Covert Channels while Preserving Performance
NetWarden: Mitigating Network Covert Channels while Preserving Performance
复制标题
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Jiarong Xing;Qiao Kang;Ang Chen
中科院分区：
文献类型：
--
作者：
Jiarong Xing;Qiao Kang;Ang Chen
网络隐蔽通道是分布式系统安全的高级威胁。现有的防御都是以牺牲性能为代价的，因此它们对高速网络中的实际部署构成了重大障碍。我们提出NetWarden，一种新的防御，其主要设计目标是保持TCP性能，同时减轻隐蔽通道。可编程数据平面的使用使Net-Warden能够适应以前仅作为概念验证的防御，并以线速应用它们。此外，NetWarden使用一组性能提升技术来暂时提高受隐蔽通道缓解影响的连接的性能，最终目标是中和整体性能影响。NetWarden还使用快速路径/慢速路径架构，将软件的通用性和硬件的有效性结合起来，以实现有效的防御。我们的评估表明，NetWarden工作顺利，复杂的应用程序和工作负载，它可以减轻隐蔽的时间和存储通道，性能干扰很小。
Network covert channels are an advanced threat to the security of distributed systems. Existing defenses all come at the cost of performance, so they present significant barriers to a practical deployment in high-speed networks. We propose NetWarden , a novel defense whose key design goal is to preserve TCP performance while mitigating covert channels. The use of programmable data planes makes it possible for Net-Warden to adapt defenses that were only demonstrated before as proof of concept, and apply them at linespeed. Moreover, NetWarden uses a set of performance boosting techniques to temporarily increase the performance of connections that have been affected by covert channel mitigation, with the ultimate goal of neutralizing the overall performance impact. NetWarden also uses a fastpath/slowpath architecture to combine the generality of software and the efficiency of hardware for effective defense. Our evaluation shows that NetWarden works smoothly with complex applications and workloads, and that it can mitigate covert timing and storage channels with little performance disturbance.