1,119 research outputs found
ANCHOR: logically-centralized security for Software-Defined Networks
While the centralization of SDN brought advantages such as a faster pace of
innovation, it also disrupted some of the natural defenses of traditional
architectures against different threats. The literature on SDN has mostly been
concerned with the functional side, despite some specific works concerning
non-functional properties like 'security' or 'dependability'. Though addressing
the latter in an ad-hoc, piecemeal way, may work, it will most likely lead to
efficiency and effectiveness problems. We claim that the enforcement of
non-functional properties as a pillar of SDN robustness calls for a systemic
approach. As a general concept, we propose ANCHOR, a subsystem architecture
that promotes the logical centralization of non-functional properties. To show
the effectiveness of the concept, we focus on 'security' in this paper: we
identify the current security gaps in SDNs and we populate the architecture
middleware with the appropriate security mechanisms, in a global and consistent
manner. Essential security mechanisms provided by anchor include reliable
entropy and resilient pseudo-random generators, and protocols for secure
registration and association of SDN devices. We claim and justify in the paper
that centralizing such mechanisms is key for their effectiveness, by allowing
us to: define and enforce global policies for those properties; reduce the
complexity of controllers and forwarding devices; ensure higher levels of
robustness for critical services; foster interoperability of the non-functional
property enforcement mechanisms; and promote the security and resilience of the
architecture itself. We discuss design and implementation aspects, and we prove
and evaluate our algorithms and mechanisms, including the formalisation of the
main protocols and the verification of their core security properties using the
Tamarin prover.Comment: 42 pages, 4 figures, 3 tables, 5 algorithms, 139 reference
Automatic Parallelization of Software Network Functions
Software network functions (NFs) trade-off flexibility and ease of deployment
for an increased challenge of performance. The traditional way to increase NF
performance is by distributing traffic to multiple CPU cores, but this poses a
significant challenge: how to parallelize an NF without breaking its semantics?
We propose Maestro, a tool that analyzes a sequential implementation of an NF
and automatically generates an enhanced parallel version that carefully
configures the NIC's Receive Side Scaling mechanism to distribute traffic
across cores, while preserving semantics. When possible, Maestro orchestrates a
shared-nothing architecture, with each core operating independently without
shared memory coordination, maximizing performance. Otherwise, Maestro
choreographs a fine-grained read-write locking mechanism that optimizes
operation for typical Internet traffic. We parallelized 8 software NFs and show
that they generally scale-up linearly until bottlenecked by PCIe when using
small packets or by 100Gbps line-rate with typical Internet traffic. Maestro
further outperforms modern hardware-based transactional memory mechanisms, even
for challenging parallel-unfriendly workloads.Comment: 21 pages, 14 figures, to be published in NSDI2
Modeling crosstalk and afterpulsing in silicon photomultipliers
An experimental method to characterize the crosstalk and afterpulsing in silicon photomultipliers has been developed and applied to two detectors fabricated by Hamamatsu. An analytical model of optical crosstalk that we presented in a previous publication has been compared with new measurements, confirming our results. Progresses on a statistical model to describe afterpulsing and delayed crosstalk are also shown and compared with preliminary experimental data. (C) 2014 Elsevier B.V. All rights reserved
- …