Hybrid hardware/software datapath for near real-time reconfigurable high-speed packet filtering

doctoral thesis

• Title (croatian): Hibridna sklopovsko/programska podatkovna staza za brzo filtriranje paketa rekonfigurabilna u približno stvarnom vremenu
• Author: Denis Salopek
• Mentor: Miljenko Mikuc (mentor)
• Committee member: Miljenko Mikuc (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; (Department of Telecommunications); Zagreb
• Defense date and country: 2022, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing
• Universal decimal classification (UDC): 004 - Computer science and technology. Computing. Data processing

Abstract

The increasing number of volumetric Distributed Denial-of-Service (DDoS) attacks, as well as their intensity and scale, have led many security experts to research and work on solutions to protect against these types of attacks. Although solutions to combat such attacks already exist, they are typically based on expensive and inflexible network equipment or on the (half-true) assumption that software filters running on commodity hardware are incapable of handling high-speed traffic and delivering sufficient throughput. The idea of combining the best of both worlds (hardware speed and software versatility) is found in a number of solutions, but cannot prevail against massive DDoS attacks with millions of attackers, as such solutions often rely on rulesets with a large number of IP prefixes used with a rule-by-rule packet filtering paradigm. This thesis presents and evaluates a hybrid hardware / software packet filter prototype as a method for mitigating volumetric DDoS attacks using a NetFPGA SUME prototyping board and a high-performance, high-speed, reduced feature-set software packet filter. It demonstrates a novel approach to offload the filtering rules (or parts of them) to the hardware by taking advantage of a modern Longest Prefix Matching (LPM) algorithm to utilize allowlists and blocklists for protection against millions of IP prefixes. The results of this work show that this type of filtering can be performed in high-speed network environments using a single CPU core. The system architecture is designed to allow scaling to much higher throughput. The results of this thesis show improvements over software-only filtering of up to nearly 30%, depending on the combination of rulesets used, the offloading methods, and the type of traffic filtered. The components of the hybrid filter can be implemented on commodity hardware and provide an alternative to expensive or less effective filters. Developing a system that combines fast DDoS detection (with low response times) and this type of filtering could provide high-speed protection against volumetric DDoS attacks. Internet Service Providers (ISPs) and datacenters could take advantage of such filtering methods without being harmed by DDoS attacks or having to compromise the privacy of their data by outsourcing filtering to third parties. Due to the low cost of the commodity, off-the-shelf hardware that these filters use, they can also be deployed by small or medium-sized businesses.

Abstract (croatian)

Porast broja volumetrijskih distribuiranih napada uskraćivanjem resursa (DDoS napada), kao i njihovog intenziteta i razmjera, već dugo potiču stručnjake iz područja sigurnosti na istraživanje i rad na rješenjima za zaštitu od njih. Iako postoji niz rješenja za borbu protiv takvih napada, oni su obično temeljeni na skupoj i nefleksibilnoj sklopovskoj mrežnoj opremi ili pretpostavci da programski filtri koji rade na računalima opće namjene nisu sposobni obraditi promet pri velikim brzinama i tako osigurati dovoljno veliku propusnost. Ideja o kombiniranju najboljeg iz oba svijeta (sklopovska brzina i svestranost programskog rješenja pristupa) također se nalazi u brojnim rješenjima, ali u obliku u kojem se ne mogu boriti protiv masivnih DDoS napada s milijunima napadača jer se često oslanjaju na skupove pravila s velikim brojem IP prefiksa i paradigmom filtriranja paketa pravilo po pravilo. U ovoj disertaciji predstavlja se i ispituje implementacija prototipa hibridnog sklopovsko / programskog filtra paketa za ublažavanje volumetrijskih DDoS napada pomoću razvojne pločice za prototipiziranje mrežnih funkcija NetFPGA SUME i jednostavnog programskog filtra. Predlaže se novi pristup za rasterećivanje pravila (ili dijelova pravila) za filtriranje na sklopovlju koristeći moderni LPM algoritam i popise dopuštenih i nedopuštenih IP prefiksa za zaštitu i od više milijuna napadača. Disertacija prikazuje rezultate filtriranja izmjerene u 10G mreži. Mjerenja su izvedena na jednoj jezgri procesora, ali s mogućnošću skaliranja na više jezgri za mnogo veću propusnost filtra. Hibridni podatkovni put predstavljen u ovoj disertaciji prikazuje poboljšanja u odnosu na podatkovni put bez sklopovskog rasterećivanja. Ovakav sustav može filtrirati pakete s visokom propusnošću, osobito kada se koristi LPM za spremanje i pretraživanje IP adresa. Rezultati prikazuju poboljšanja u rasponu do oko 30%, ovisno o kombinaciji skupova pravila, metoda rasterećivanja i vrsti prometa koji dolazi do filtra. Komponente hibridnog filtra mogu se implementirati na računalima opće namjene i pružaju alternativu skupim sklopovskim ili manje učinkovitim programskim filtrima. Pružatelji pristupa Internetu (ISP), mala i srednja poduzeća te podatkovni centri mogli bi iskoristiti navedene metode filtriranja bez rizika štete od DDoS napada ili ugrožavanja privatnosti svojih podataka prenošenjem odgovornosti filtriranja na treće strane.

• Keywords: hybrid hardware/software datapath; hybrid filter; DDoS attacks
• Keywords (croatian): hibridna sklopovsko/programska podatkovna staza; hibridni filtar; DDoS napad
• Language: english
• URN:NBN: urn:nbn:hr:168:584365
• Promotion: 2022
• Study programme: Title: Computer Science; Study programme type: university; Study level: postgraduate; Academic / professional title: Doktor znanosti (Doktor znanosti)
• Type of resource: Text
• Extent: xii, 102 str. : graf. prikaz ; 30 cm + CD-ROM
• File origin: Born digital
• Access conditions: Open access
• Created on: 2022-05-19 10:04:21