1 Resonance: Dynamic Access Control in Enterprise Networks Ankur Nayak, Alex Reimers, Nick Feamster, Russ Clark School of Computer Science Georgia Institute of Technology

2 Motivation Enterprise and campus networks are dynamic –Hosts continually coming and leaving –Hosts may become infected Today, access control is static, and poorly integrated with the network layer itself Resonance: Dynamic access control –Track state of each host on the network –Update forwarding state of switches per host as these states change

3 State of the Art Todays networks have many components bolted on after the fact –Firewalls, VLANs, Web authentication portal, vulnerability scanner Separate (and perhaps competing) devices for performing the following functions –Registration (based on MAC addresses) –Scanning –Filtering and rate limiting traffic

4 Authentication at GT : START 3. VLAN with Private IP 6. VLAN with Public IP ta.1. New MAC Addr2. VQP 7. REBOOT Web Portal 4. Web Authentication 5. Authentication Result VMPS Switch New Host

5 Problems with Current Architecture Access Control is too coarse-grained –Static, inflexible and prone to misconfigurations –Need to rely on VLANs to isolate infected machines Cannot dynamically remap hosts to different portions of the network –Needs a DHCP request which for a windows user would mean a reboot Monitoring is not continuous Idea: Express access control to incorporate network dynamics.

6 Resonance Approach Step 1: Associate each host with generic states and security classes Step 2: Specify a state machine for moving machines from one state to the other Step 3: Control forwarding state in switches based on the current state of each machine –Actions from other network elements, and distributed inference, can affect network state

7 Applying resonance to START Registration Authenticated Operation Quarantined Successful Authentication Vulnerability detected Clean after update Failed Authentication Infection removed or manually fixed Still Infected after an update

8 Resonance: Step by Step Internet 3. Scanning 1. DHCP request 4. To the Internet 2. Web Authenticai- tion Controller Openflow Switch New Host DHCP Server Web Portal

9 Preliminary Implementation: OpenFlow OpenFlow: Flow-based control over the forwarding behavior of switches and routers –A switch, a centralized controller and end-hosts –Switches communicate with the controller through an open protocol over a secure channel Why OpenFlow? –Dynamically change security policies –Central control enables Specifying a single, centralized security policy Coordinating the mechanisms for switches Granularity of control. VLANs dont provide that granularity

10 Resonance Controller: NOX NOX: Programmatic interface to the OpenFlow controller –Ability to add, remove and reuse components We are building the Resonance controller using NOX

11 Research Testbed

12 Potential Challenges Scale –How many forwarding entries per switch? OF switches support ~130K flow entries and 100 wildcard entries. –How much traffic at the controller? Performance –Responsiveness Security –MAC address spoofing –Securing the controller (and control framework)

13 Summary Resonance: An architecture to secure and maintain enterprise networks. –Preliminary design –Application to Georgia Tech campus network –Planned evaluation Many challenges remain –Scaling –Performance Questions?

14

15 Applying Resonance to START

16 Resonance: Step-by-Step

17 Authentication at GT: START

18 Problems with Current Approaches Existing enterprise security techniques are reactive and ad-hoc A mix of security middleboxes, intrusion detection systems etc. result in collection of complex network configurations Possible negative side effects –Misconfiguration –Security problems

19

ppt material (prototype implementation)

21 Host Scanner Network Monitors Openflow Switch Controller Web portal DNS server Openflow Switch Openflow Switch DHCP server Openflow Switch