Defeating Data Plane Attacks With Program Obfuscation
Defeating Data Plane Attacks With Program Obfuscation
复制标题
DOI：
10.1109/tdsc.2023.3277939
复制
发表时间：
2024-05
影响因子：
7.3
通讯作者：
Conor Black;Sandra Scott-Hayward
中科院分区：
文献类型：
--
作者：
Conor Black;Sandra Scott-Hayward
软件定义网络中的数据平面交换机越来越被认为是潜在的攻击目标，最近的利用表明它们容易受到全面攻击。这种入侵的严重后果促使人们设计了危害检测机制，该机制在运行时监控交换机转发行为，以确保它没有被攻击更改。然而，这种防御无法在有状态、可编程的数据平面上实现完全覆盖，从而为攻击者提供了一个机会，通过仔细编辑交换机的转发程序来错误处理一小部分数据包来逃避检测。为了利用这一机会并避免被发现，攻击者必须在一个狭窄的时间窗口内分析和编辑程序的行为，由于可预测的编译过程，当数据平面由从P4编译的uBPF程序定义时，这是可能的。在这项工作中，我们旨在通过对P4-uBPF程序进行有针对性的混淆来使这种分析制导的攻击技术失效，这增加了分析的复杂性。我们发现，通过在变量之间插入额外的程序路径和语法依赖关系，可以迫使攻击者分析更高比例的程序指令，并进行耗时的SMT求解以找到有效的程序路径，从而使以前的攻击技术变得不可行。此外，通过应用我们识别的程序优化，通常可以在混淆后保持程序性能。在评估我们的工作时，我们确定了通过根据个别程序路径定制模糊处理来改进解决方案的潜力。
Data plane switches in software-defined networks are increasingly recognised as potential targets for attack, with recent exploits showing their vulnerability to full compromise. The serious consequences of such a breach have prompted the design of compromise detection mechanisms, which monitor switch forwarding behaviour at runtime to ensure that it has not been altered by an attack. However, such defences cannot achieve full coverage in stateful, programmable data planes, creating an opportunity for an attacker to evade detection by carefully editing a switch's forwarding program to mishandle a small subset of packets. To exploit this opportunity and avoid detection, an attacker must analyse and edit the program's behaviour within a narrow time window, which is possible when the data plane is defined by a uBPF program compiled from P4, due to the predictable compilation process. In this work, we aim to invalidate this analysis-guided attack technique with targeted obfuscation of P4-uBPF programs that increases the analysis complexity. We find that, by inserting additional program paths and syntactic dependencies between variables, we can force an attacker to analyse a higher proportion of program instructions and carry out time-consuming SMT solving to find valid program paths, rendering the previous attack technique infeasible. Furthermore, by applying our identified program optimisations, program performance can often be maintained after obfuscation. In evaluating our work, we identify the potential to improve our solution by tailoring obfuscations to individual program paths.