On the Edge of Secure Connectivity via Software-Defined Networking

Securing communication in computer networks has been an essential feature ever since the Internet, as we know it today, was started. One of the best known and most common methods for secure communication is to use a Virtual Private Network (VPN) solution, mainly operating with an IP security (IPsec) protocol suite originally published in 1995 (RFC1825). It is clear that the Internet, and networks in general, have changed dramatically since then. In particular, the onset of the Cloud and the Internet-of-Things (IoT) have placed new demands on secure networking. Even though the IPsec suite has been updated over the years, it is starting to reach the limits of its capabilities in its present form. Recent advances in networking have thrown up Software-Defined Networking (SDN), which decouples the control and data planes, and thus centralizes the network control. SDN provides arbitrary network topologies and elastic packet forwarding that have enabled useful innovations at the network level. This thesis studies SDN-powered VPN networking and explains the benefits of this combination. Even though the main context is the Cloud, the approaches described here are also valid for non-Cloud operation and are thus suitable for a variety of other use cases for both SMEs and large corporations. In addition to IPsec, open source TLS-based VPN (e.g. OpenVPN) solutions are often used to establish secure tunnels. Research shows that a full-mesh VPN network between multiple sites can be provided using OpenVPN and it can be utilized by SDN to create a seamless, resilient layer-2 overlay for multiple purposes, including the Cloud. However, such a VPN tunnel suffers from resiliency problems and cannot meet the increasing availability requirements. The network setup proposed here is similar to Software-Defined WAN (SD-WAN) solutions and is extremely useful for applications with strict requirements for resiliency and security, even if best-effort ISP is used. IPsec is still preferred over OpenVPN for some use cases, especially by smaller enterprises. Therefore, this research also examines the possibilities for high availability, load balancing, and faster operational speeds for IPsec. We present a novel approach involving the separation of the Internet Key Exchange (IKE) and the Encapsulation Security Payload (ESP) in SDN fashion to operate from separate devices. This allows central management for the IKE while several separate ESP devices can concentrate on the heavy processing. Initially, our research relied on software solutions for ESP processing. Despite the ingenuity of the architectural concept, and although it provided high availability and good load balancing, there was no anti-replay protection. Since anti-replay protection is vital for secure communication, another approach was required. It thus became clear that the ideal solution for such large IPsec tunneling would be to have a pool of fast ESP devices, but to confine the IKE operation to a single centralized device. This would obviate the need for load balancing but still allow high availability via the device pool. The focus of this research thus turned to the study of pure hardware solutions on an FPGA, and their feasibility and production readiness for application in the Cloud context. Our research shows that FPGA works fluently in an SDN network as a standalone IPsec accelerator for ESP packets. The proposed architecture has 10 Gbps throughput, yet the latency is less than 10 µs, meaning that this architecture is especially efficient for data center use and offers increased performance and latency requirements. The high demands of the network packet processing can be met using several different approaches, so this approach is not just limited to the topics presented in this thesis. Global network traffic is growing all the time, so the development of more efficient methods and devices is inevitable. The increasing number of IoT devices will result in a lot of network traffic utilising the Cloud infrastructures in the near future. Based on the latest research, once SDN and hardware acceleration have become fully integrated into the Cloud, the future for secure networking looks promising. SDN technology will open up a wide range of new possibilities for data forwarding, while hardware acceleration will satisfy the increased performance requirements. Although it still remains to be seen whether SDN can answer all the requirements for performance, high availability and resiliency, this thesis shows that it is a very competent technology, even though we have explored only a minor fraction of its capabilities

Encriptación sobre Capa Física para Ethernet Óptico de Alta Velocidad

INTRODUCCIÓN-------------------------Hoy en día, los enlaces ópticos con tasas de transmisión de hasta 100 Gbps y superiores son ya una realidad. Gracias a los avances logrados en las comunicaciones ópticas durante las últimas décadas es posible afrontar anchos de banda cada vez mayores, lo que satisface las demandas de las aplicaciones más exigentes [CIS16], como por ejemplo las basadas en cloud computing o big data. Por otro lado, la seguridad en la información sigue siendo un asunto de gran importancia en las comunicaciones ya que el volumen de amenazas en la red se ha incrementado durante los últimos años [CIS18]. Los fallos en la seguridad podrían llevar al mal funcionamiento de un servicio o la pérdida de confidencialidad en datos críticos de los clientes. En un sistema de comunicaciones por capas, como por ejemplo en el modelo OSI (Open System Interconnection) o TCP/IP (Transmission Control Protocol/Internet Protocol), se pueden llevar a cabo tanto ataques pasivos como activos en los diferentes niveles de la comunicación. Dependiendo de las capas de comunicación utilizadas, distintos mecanismos pueden ser adoptados para lograr la seguridad de la información. Por ejemplo, protocolos estandarizados tales como MACsec [IEE06] o IPsec [KEN05] son empleados normalmente en la capa 2 (capa de enlace de datos) y capa 3 (capa de red), respectivamente. En ambos casos la encriptación es llevada a cabo en cada trama o paquete de datos de forma individual. Para el caso particular de las redes ópticas, el análisis de las amenazas en su capa 1 (capa física) también es considerado crítico para garantizar unas comunicaciones seguras [SKO16], [FUR14]. En este caso se pueden destacar tres tipos de ataques: ataques de inserción de señal, ataques por splitting y ataques a las infraestructuras físicas. Los ataques por splitting son normalmente empleados para espionaje pasivo o para producir degradación en la señal [SKO16], estos se pueden llevar a cabo fácilmente gracias a técnicas de derivación en la fibra. De hecho, hoy en día ya existen métodos de bajo coste para interceptar la señal óptica gracias a dispositivos de acoplamiento óptico y conversores electroópticos sin la necesidad de interferir perceptiblemente en las comunicaciones [ZAF11]. Con el fin de tratar estas amenazas y proteger la confidencialidad de los datos en la capa física, varios mecanismos relacionados con tecnologías fotónicas han sido propuestos [FOK11], por ejemplo OCDM (Optical Code Division Multiplexing) [JI17], SCOC (Secure Communications using Optical Chaos) [HIZ10] o QKD (Quantum Key Distribution) [ELK13]. Otras técnicas, también relacionadas con protocolos de capa física, cifran la información a nivel de bit independientemente de la tecnología fotónica empleada, como la encriptación de los datos del payload en las tramas OTN (Optical Transport Network) [GUA16]. Algunas de las ventajas reivindicadas por estas técnicas de encriptación consisten en cifrar la información “al vuelo” introduciendo un overhead nulo en los datos y una latencia muy baja (en el rango de nanosegundos) en la información transmitida [GUA16]. De hecho, hoy en día ya están disponibles en el mercado equipos de comunicaciones OTN que realizan el cifrado a la velocidad de línea sin mermar el throughput, es decir consiguiendo un rendimiento de la transmisión del 100% [MIC16]. Esto contrasta con lo que hacen ciertos protocolos en otras capas de comunicación [KOL13], [XEN06]. Por ejemplo, IPsec generalmente introduce latencias en el rango de milisegundos. Además, el overhead introducido por IPsec durante el cifrado limita el rendimiento de transmisión a valores entre el 20% y el 90% de la máxima tasa de datos posible sin encriptación [TRO05], [KOL13]. Aparte de lograr la confidencialidad, alguno de los métodos mencionados anteriormente también es capaz de conseguir privacidad contra intrusos pasivos [FOK11], entendiendo esta como la amenaza cuando dichos intrusos pueden detectar simplemente la presencia de comunicaciones, aunque sean incapaces de descifrar el contenido de la información de las mismas. Esta habilidad puede ofrecer seguridad contra ataques basados en el análisis de los patrones del tráfico, que permitirían revelar información del comportamiento de una compañía o instalación. Dentro de los estándares de comunicaciones ópticas, Ethernet es uno de los más empleados hoy día. Un claro ejemplo es el acceso a las redes de transporte ópticas donde este estándar es utilizado normalmente cuando las tasas de acceso superan el gigabit por segundo. Tal y como se muestra en la Fig.1-1, algunas tecnologías de acceso en los tramos de última milla de las CEN (Carrier Ethernet Networks) son Ethernet sobre fibra (Fibra Directa con Ethernet, Ethernet sobre SONET/SDH, Ethernet sobre PON), Ethernet sobre PDH o Ethernet inalámbrico [MET09]. Dos de los estándares ópticos Ethernet más empleados hoy en día son los denominados 1000Base-X y 10GBase-R con tasas de transmisión de 1 Gbps y 10 Gbps, respectivamente.OBJETIVOS-------------------En el caso de las comunicaciones sobre Ethernet óptico no existe ningún mecanismo que logre la mencionada privacidad al mismo tiempo que la confidencialidad, sin que además introduzca un overhead o latencias indeseadas. El objetivo de esta tesis es el de proporcionar soluciones a dos de los estándares ópticos Ethernet más empleados, tales como 1000Base-X o 10GBase-R, logrando las características citadas anteriormente. En general los principales aspectos que se pretenden desarrollar en esta tesis son los siguientes: • Realizar propuestas viables de modificación de ambos estándares, 1000Base-X y 10GBase-R, de forma que se pueda llevar a cabo la encriptación en la capa física. • Lograr la compatibilidad de las nuevas arquitecturas de encriptación con dichos estándares de forma que el hardware electrónico más dependiente del medio de transmisión, como los módulos ópticos SFP, los SERDES o los circuitos de recuperación de reloj y datos, no necesite modificaciones adicionales. • Realizar un estudio de los posibles esquemas de encriptación por streaming que sean capaces de cifrar datos a velocidades superiores a 1 Gbps y adaptarlos a las arquitecturas propuestas. • Estudiar posibles mecanismos para llevar a cabo la sincronización de los módulos de encriptación entre dos terminales remotos.• Lograr que las soluciones propuestas lleven a cabo la encriptación introduciendo la menor latencia posible, al menos en un orden de magnitud igual o inferior al de soluciones en otros estándares de comunicaciones como OTN. • Llevar a cabo un análisis de la seguridad de las soluciones propuestas, incluyendo el estudio de la capacidad de privacidad en las comunicaciones. • Proponer un esquema de chequeo de integridad, autenticación y refresco de claves a nivel de capa física. • Llevar a cabo la implementación y verificación física de las soluciones propuestas.PUBLICACIONES----------------------------[PER19a] A. Pérez-Resa, M. Garcia-Bosque, C. Sánchez-Azqueta, and S. Celma. "Chaotic Encryption Applied to Optical Ethernet in Industrial Control Systems". IEEE Transactions on Instrumentation and Measurement, 68(12):4876–4886, Dec 2019. [PER19b] A. Pérez-Resa, M. Garcia-Bosque, C. Sánchez-Azqueta, and S. Celma. "Physical Layer Encryption for Industrial Ethernet in Gigabit Optical Links". IEEE Transactions on Industrial Electronics, 66(4):3287–3295, April 2019. [PER19c] A. Pérez-Resa, M. Garcia-Bosque, C. Sánchez-Azqueta, and S. Celma. "Chaotic Encryption for 10-Gb Ethernet Optical Links". IEEE Transactions on Circuits and Systems I: Regular Papers, 66(2):859–868, Feb. 2019. [PER19d] A. Pérez-Resa, M. Garcia-Bosque, C. Sánchez-Azqueta, and S. Celma. "Self-Synchronized Encryption for Physical Layer in 10Gbps Optical Links". IEEE Transactions on Computers, 68(6):899–911, June 2019. [PER19e] A. Pérez-Resa, M. Garcia-Bosque, C. Sánchez-Azqueta, and S. Celma. "Self-Synchronized Encryption Using an FPE Block Cipher for Gigabit Ethernet". In 2019 15th Conference on Ph.D Research in Microelectronics and Electronics (PRIME), pages 81–84, Lausanne, Switzerland, July 2019. [PER20a] A. Pérez-Resa, M. Garcia-Bosque, C. Sánchez-Azqueta, and S. Celma. "A New Method for Format Preserving Encryption in High-Data Rate Communications". IEEE Access, 8:21003–21016, 2020. [PER20b] A. Pérez-Resa, M. Garcia-Bosque, C. Sánchez-Azqueta, and S. Celma. "Self-synchronized Encryption for Physical Layer in 1Gbps Ethernet Optical Links". IEEE Access, Pending Acceptance.<br /

Practical Encryption Gateways to Integrate Legacy Industrial Machinery

Future industrial networks will consist of a mixture of old and new components, due to the very long life-cycles of industrial machines on the one hand and the need to change in the face of trends like Industry 4.0 or the industrial Internet of things on the other. These networks will be very heterogeneous and will serve legacy as well as new use cases in parallel. This will result in an increased demand for network security and precisely within this domain, this thesis tries to answer one specific question: how to make it possible for legacy industrial machines to run securely in those future heterogeneous industrial networks. The need for such a solution arises from the fact, that legacy machines are very outdated and hence vulnerable systems, when assessing them from an IT security standpoint. For various reasons, they cannot be easily replaced or upgraded and with the opening up of industrial networks to the Internet, they become prime attack targets. The only way to provide security for them, is by protecting their network traffic. The concept of encryption gateways forms the basis of our solution. These are special network devices, that are put between the legacy machine and the network. The gateways encrypt data traffic from the machine before it is put on the network and decrypt traffic coming from the network accordingly. This results in a separation of the machine from the network by virtue of only decrypting and passing through traffic from other authenticated gateways. In effect, they protect communication data in transit and shield the legacy machines from potential attackers within the rest of the network, while at the same time retaining their functionality. Additionally, through the specific placement of gateways inside the network, fine-grained security policies become possible. This approach can reduce the attack surface of the industrial network as a whole considerably. As a concept, this idea is straight forward and not new. Yet, the devil is in the details and no solution specifically tailored to the needs of the industrial environment and its legacy components existed prior to this work. Therefore, we present in this thesis concrete building blocks in the direction of a generally applicable encryption gateway solution that allows to securely integrate legacy industrial machinery and respects industrial requirements. This not only entails works in the direction of network security, but also includes works in the direction of guaranteeing the availability of the communication links that are protected by the gateways, works to simplify the usability of the gateways as well as the management of industrial data flows by the gateways

Distributed Software Router Management

With the stunning success of the Internet, information and communication technologies diffused increasingly attracting more uses to join the the Internet arsenal which in turn accelerates the traffic growth. This growth rate does not seem to slow down in near future. Networking devices support these traffic growth by offering an ever increasing transmission and switching speed, mostly due to the technological advancement of microelectronics granted by Moore’s Law. However, the comparable growth rate of the Internet and electronic devices suggest that capacity of systems will become a crucial factor in the years ahead. Besides the growth rate challenge that electronic devices face with respect to traffic growth, networking devices have always been characterized by the development of proprietary architectures. This means that incompatible equipment and architectures, especially in terms of configuration and management procedures. The major drawback of such industrial practice, however, is that the devices lack flexibility and programmability which is one of the source of ossification for today’s Internet. Thus scaling or modifying networking devices, particularly routers, for a desired function requires a flexible and programmable devices. Software routers (SRs) based on personal computers (PCs) are among these devices that satisfy the flexibility and programmability criteria. Furthermore, the availability of large number of open-source software for networking applications both for data as well as control plane and the low cost PCs driven by PC-market economy scale make software routers appealing alternative to expensive proprietary networking devices. That is, while software routers have the advantage of being flexible, programmable and low cost, proprietary networking equipments are usually expensive, difficult to extend, program, or otherwise experiment with because they rely on specialized and closed hardware and software. Despite their advantages, however, software routers are not without limitation. The objections to software routers include limited performance, scalability problems and lack of advanced functionality. These limitations arose from the fact that a single server limited by PCI bus width and CPU is given a responsibility to process large amount of packets. Offloading some packet processing tasks performed by the CPU to other processors, such as GPUs of the same PC or external CPUs, is a viable approach to overcome some of these limitations. In line with this, a distributed Multi-Stage Software Router (MSSR) architecture has been proposed in order to overcome both the performance and scalability issues of single PC based software routers. The architecture has three stages: i) a front-end layer-2 load balancers (LBs), open-software or open-hardware based, that act as interfaces to the external networks and distribute IP packets to ii) back-end personal computers (BEPCs), also named back-end routers in this thesis, that provide IP routing functionality, and iii) an interconnection network, based on Ethernet switches, that connects the two stages. Performance scaling of the architecture is achieved by increasing the redundancy of the routing functionality stage where multiple servers are given a coordinated task of routing packets. The scalability problem related to number of interfaces per PC is also tackled in MSSR by bundling two or more PCs’ interfaces through a switch at the front-end stage. The overall architecture is controlled and managed by a control entity named Virtual Control Processor (virtualCP), which runs on a selected back-end router, through a DIST protocol. This entity is also responsible to hide the internal details of the multistage software router architecture such that the whole architecture appear to external network devices as a single device. However, building a flexible and scalable high-performance MSSR architecture requires large number of independently, but coordinately, running internal components. As the number of internal devices increase so does the architecture control and management complexity. In addition, redundant components to scale performance means power wastage at low loads. These challenges have to be addressed in making the multistage software router a functional and competent network device. Consequently, the contribution of this thesis is to develop an MSSR centralized management system that deals with these challenges. The management system has two broadly classified sub-systems: I) power management: a module responsible to address the energy inefficiency in multistage software router architecture II) unified information management: a module responsible to create a unified management information base such that the distributed multistage router architecture appears as a single device to external network from management information perspective. The distributed multistage router power management module tries to minimize the energy consumption of the architecture by resizing the architecture to the traffic demand. During low load periods only few components, especially that of routing functionality stage, are required to readily give a service. Thus it is wise to device a mechanism that puts idle components to low power mode to save energy during low load periods. In this thesis an optimal and two heuristic algorithms, namely on-line and off-line, are proposed to adapt the architecture to an input load demand. We demonstrate that the optimal algorithm, besides having scalability issue, is an off-line approach that introduce service disruption and delay during the architecture reconfiguration period. In solving these issues, heuristic solutions are proposed and their performance is measured against the optimal solution. Results show that the algorithms fairly approximate the optimal solution and use of these algorithms save up to 57.44% of the total architecture energy consumption during low load periods. The on-line algorithms are superior among the heuristic solutions as it has the advantage of being less disruptive and has minimal service delay. Furthermore, the thesis shows that the proposed algorithms will be more efficient if the architecture is designed keeping in mind energy as one of the design parameter. In achieving this goal three different approaches to design an MSSR architecture are proposed and their energy saving efficient is evaluated both with respect to the optimal solution and other similar cluster design approaches. The multistage software router is unique from a single device as it is composed of independently running components. This means that the MSSR management information is distributed in the architecture since individual components register their own management information. It is said, however, that the MSSR internal devices work cooperatively to appear as a single network device to the external network. The MSSR architecture, as a single device, therefore requires its own management information base which is built from the management information bases dispersed among internal components. This thesis proposes a mechanism to collect and organize this distributed management information and create a single management information base representing the whole architecture. Accordingly existing SNMP management communication model has been modified to fit to distributed multi-stage router architecture and a possible management architecture is proposed. In compiling the management information, different schemes has been adopted to deal with different SNMP management information variables. Scalability analysis shows that proposed management system scales well and does not pose a threat to the overall architecture scalability