论文标题
关于对开放vswitch的元组太空爆炸攻击的可行性和增强
On the Feasibility and Enhancement of the Tuple Space Explosion Attack against Open vSwitch
论文作者
论文摘要
作为网络系统的关键部分，数据包分类必须高效。但是，云环境中的软件切换仍然面临性能挑战。最近提出的元组爆炸（TSE）攻击利用了开放式VSWITCH（OVS）中的算法缺陷。在TSE中，合法的低利率攻击流量使培养基空间搜索（TSS）算法中的基本线性搜索算法花费了无法承受的时间来对每个数据包进行分类，从而为其余的用户提供了拒绝服务（DOS）。在本文中，我们从多个角度研究了TSE的可行性。除了表明TSE在较新版本的OVS中仍然有效，我们还表明，当将内核数据从其他来源汇编而成时，它可以将其性能降低到其基线的〜1％，而小于1 Mbps的攻击率。最后，我们表明，由于其TSS实施中的排名增强，TSE与用户空间Datapath对OVS-DPDK的有效性要小得多。因此，我们建议TSE 2.0打败排名过程并对OVS-DPDK实现完整的DO。此外，我们提出了TSE 2.1，该TSE 2.1实现了相同的目标，即在多个内核上运行的OVS-DPDK，而不会显着提高攻击率。
Being a crucial part of networked systems, packet classification has to be highly efficient; however, software switches in cloud environments still face performance challenges. The recently proposed Tuple Space Explosion (TSE) attack exploits an algorithmic deficiency in Open vSwitch (OVS). In TSE, legitimate low-rate attack traffic makes the cardinal linear search algorithm in the Tuple Space Search (TSS) algorithm to spend an unaffordable time for classifying each packet resulting in a denial-of-service (DoS) for the rest of the users. In this paper, we investigate the feasibility of TSE from multiple perspectives. Besides showing that TSE is still efficient in the newer version of OVS, we show that when the kernel datapath is compiled from a different source, it can degrade its performance to ~1% of its baseline with less than 1 Mbps attack rate. Finally, we show that TSE is much less effective against OVS-DPDK with userspace datapath due to the enhanced ranking process in its TSS implementation. Therefore, we propose TSE 2.0 to defeat the ranking process and achieve a complete DoS against OVS-DPDK. Furthermore, we present TSE 2.1, which achieves the same goal against OVS-DPDK running on multiple cores without significantly increasing the attack rate.
