Download
1 / 13
130 likes | 238 Vues
The SANE architecture simplifies enterprise networks but introduces a critical single point of failure—its central data center (DC). This design could jeopardize the entire network if compromised. The architecture's performance hinges on decryption at intermediate switches, raising concerns over scalability and network bottlenecks. With drawbacks like poor resilience against attacks and increased operational burdens, SANE might not enhance network security. This analysis compares SANE's efficiency and security shortcomings with alternative solutions like Tesseract, emphasizing the need for improved network designs.
E N D
SANE: A Protection Architecture for Enterprise Networks Offense by: Amit Mondal Bert Gonzalez
Single-point-of-failure • SANE design essentially reduces the whole network to a single DC. • If this DC fails or is compromised, the entire network is at stake. • Even with multiple DCs, the network is at a greater risk because there always a single point-of-failure • Compare with “Tesseract: A 4D Network Control Plane”
Performance • Huge performance overhead! • Decryption is involved at every intermediate switches • Compare with IPSec • Computation burden on the network switches? Bottleneck! • Decryption per packet
Scalability • Is SANE architecture scalable? • Every sender needs to get capabilities (encrypted source routes) from the DC to communicate with any other hosts • DC becomes a bottleneck! • Route computation, capability computation etc.
Network Visibility • Network switches are reduced to dumb entities • Network Monitoring • Troubleshooting • Traceroute • Failure detection • Dynamic failover • Convergence time? • Network partitioning
Packet Forwarding in Dark • Strict switch-level source routing • Dynamic load balancing • Traffic Engineering • Virus, worm propagation • Prevents deployment of advanced transport protocols e.g. XCP
Resiliency against attack • Resource exhaustion • “ … simply generates a new key; this invalidates all existing capabilities …” • What about the ongoing behaved flows? • They are just victim of DoS attack • Attack against routing infrastructure • Misbehaving switch • Advertise fake paths to DC! • Compromised DC?
Implementation and Evaluation • “– interconnecting seven physical hosts on 100 Mb Ethernet … ” • “ … only a few domain controller are necessary to handle DC requests from ten of thousands of end host.” • No justification, no evaluation!
Multiple DC? • Consistency among multiple DC? • If someone can configure and manage multiple DCs then what’s the big difference from configuring and managing firewalls, NATs and ACLs?
Performance bottleneck • Encryption/Decryption overhead • “ – 99% of CPU time was spent on decryption alone – leading to poor throughput performance”
Hardware Implementation • Cisco Catalyst 6513 Switch (Latest Model) • “Can perform MAC level encryption at 10 Gb/s” • Misleading: Model support 10 Gbps Ethernet, does not mean it encrypts at that speed. • Cisco states with the use of a Service Module, 2 Gbps of encryption can be provided.
Security Tests • Revocation • Not Tested • DoS Attacks • Not Tested • Flooding Attacks • Not Tested • Malicious DCs • Not Tested • Only one DC! • Evaluations show that SANE can fit into a network but does not show that it makes a network more secure! • Secure Architecture for the Networked Enterprise • SANE: A Protection Architecture for Enterprise Networks
