Offloading Security Services to the Cloud Infrastructure

International audienceCloud applications rely on a diverse set of security services fromapplication-layer rate-limiting to TCP SYN cookies and applicationfirewalls. Some of these services are implemented at the infrastructurelayer, on the host or in the NIC, to filter attacks closer totheir source and free CPU cycles for the tenants’ applications. Mostsecurity services, however, remain difficult to implement at theinfrastructure layer because they are closely tied to the applicationsthey protect.In this paper, we propose to allow tenants to offload small filteringprograms to the infrastructure. We design a mechanism toensure fairness in resource consumption among tenants and showthat, by carefully probing specific points of the infrastructure, allresource consumption can be accounted for.We prototype our solution over the new high-performance datapathof Linux. Our preliminary experiments show that an offload tothe host’s CPU can bring a 4-6x performance improvement. In addition,fairness among tenants introduces an overhead of only 14%in the worst case and approximately 3% for realistic applications