Inferring Firewall Rules by Cache Side-channel Analysis in Network Function Virtualization

Youngjoo Shin; Dongyoung Koo; Junbeom Hur

doi:10.1109/INFOCOM41043.2020.9155449

Inferring Firewall Rules by Cache Side-channel Analysis in Network Function Virtualization

Youngjoo Shin, Dongyoung Koo, Junbeom Hur

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

6 Citations (Scopus)

Abstract

Network function virtualization takes advantage of virtualization technology to achieve flexibility in network service provisioning. However, it comes at the cost of security risks caused by cache side-channel attacks on virtual machines. In this study, we investigate the security impact of these attacks on virtualized network functions. In particular, we propose a novel cache-based reconnaissance technique against virtualized Linux-based firewalls. The proposed technique has significant advantages in the perspective of attackers. First, it enhances evasiveness against intrusion detection owing to the ability of source spoofing. Second, it allows inference on a wide variety of filtering rules. During experiment in VyOS, the proposed method could infer the firewall rules with an accuracy of more than 90% by using only a few dozen packets. We also present countermeasures to mitigate cache-based attacks on virtualized network functions.

Original language	English
Title of host publication	INFOCOM 2020 - IEEE Conference on Computer Communications
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	1798-1807
Number of pages	10
ISBN (Electronic)	9781728164120
DOIs	https://doi.org/10.1109/INFOCOM41043.2020.9155449
Publication status	Published - 2020 Jul
Event	38th IEEE Conference on Computer Communications, INFOCOM 2020 - Toronto, Canada Duration: 2020 Jul 6 → 2020 Jul 9

Publication series

Name	Proceedings - IEEE INFOCOM
Volume	2020-July
ISSN (Print)	0743-166X

Conference

Conference	38th IEEE Conference on Computer Communications, INFOCOM 2020
Country/Territory	Canada
City	Toronto
Period	20/7/6 → 20/7/9

Bibliographical note

Publisher Copyright:
© 2020 IEEE.

Keywords

Cache side-channel analysis
Firewall reconnaissance
Network function virtualization

ASJC Scopus subject areas

General Computer Science
Electrical and Electronic Engineering

Access to Document

10.1109/INFOCOM41043.2020.9155449

Cite this

Shin, Y., Koo, D., & Hur, J. (2020). Inferring Firewall Rules by Cache Side-channel Analysis in Network Function Virtualization. In INFOCOM 2020 - IEEE Conference on Computer Communications (pp. 1798-1807). Article 9155449 (Proceedings - IEEE INFOCOM; Vol. 2020-July). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/INFOCOM41043.2020.9155449

Inferring Firewall Rules by Cache Side-channel Analysis in Network Function Virtualization. / Shin, Youngjoo; Koo, Dongyoung; Hur, Junbeom.
INFOCOM 2020 - IEEE Conference on Computer Communications. Institute of Electrical and Electronics Engineers Inc., 2020. p. 1798-1807 9155449 (Proceedings - IEEE INFOCOM; Vol. 2020-July).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Shin, Y, Koo, D & Hur, J 2020, Inferring Firewall Rules by Cache Side-channel Analysis in Network Function Virtualization. in INFOCOM 2020 - IEEE Conference on Computer Communications., 9155449, Proceedings - IEEE INFOCOM, vol. 2020-July, Institute of Electrical and Electronics Engineers Inc., pp. 1798-1807, 38th IEEE Conference on Computer Communications, INFOCOM 2020, Toronto, Canada, 20/7/6. https://doi.org/10.1109/INFOCOM41043.2020.9155449

@inproceedings{60db7f3ca59f42edacb77416b43b06a4,

title = "Inferring Firewall Rules by Cache Side-channel Analysis in Network Function Virtualization",

abstract = "Network function virtualization takes advantage of virtualization technology to achieve flexibility in network service provisioning. However, it comes at the cost of security risks caused by cache side-channel attacks on virtual machines. In this study, we investigate the security impact of these attacks on virtualized network functions. In particular, we propose a novel cache-based reconnaissance technique against virtualized Linux-based firewalls. The proposed technique has significant advantages in the perspective of attackers. First, it enhances evasiveness against intrusion detection owing to the ability of source spoofing. Second, it allows inference on a wide variety of filtering rules. During experiment in VyOS, the proposed method could infer the firewall rules with an accuracy of more than 90% by using only a few dozen packets. We also present countermeasures to mitigate cache-based attacks on virtualized network functions.",

keywords = "Cache side-channel analysis, Firewall reconnaissance, Network function virtualization",

author = "Youngjoo Shin and Dongyoung Koo and Junbeom Hur",

note = "Publisher Copyright: {\textcopyright} 2020 IEEE.; 38th IEEE Conference on Computer Communications, INFOCOM 2020 ; Conference date: 06-07-2020 Through 09-07-2020",

year = "2020",

month = jul,

doi = "10.1109/INFOCOM41043.2020.9155449",

language = "English",

series = "Proceedings - IEEE INFOCOM",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "1798--1807",

booktitle = "INFOCOM 2020 - IEEE Conference on Computer Communications",

}

TY - GEN

T1 - Inferring Firewall Rules by Cache Side-channel Analysis in Network Function Virtualization

AU - Shin, Youngjoo

AU - Koo, Dongyoung

AU - Hur, Junbeom

PY - 2020/7

Y1 - 2020/7

N2 - Network function virtualization takes advantage of virtualization technology to achieve flexibility in network service provisioning. However, it comes at the cost of security risks caused by cache side-channel attacks on virtual machines. In this study, we investigate the security impact of these attacks on virtualized network functions. In particular, we propose a novel cache-based reconnaissance technique against virtualized Linux-based firewalls. The proposed technique has significant advantages in the perspective of attackers. First, it enhances evasiveness against intrusion detection owing to the ability of source spoofing. Second, it allows inference on a wide variety of filtering rules. During experiment in VyOS, the proposed method could infer the firewall rules with an accuracy of more than 90% by using only a few dozen packets. We also present countermeasures to mitigate cache-based attacks on virtualized network functions.

AB - Network function virtualization takes advantage of virtualization technology to achieve flexibility in network service provisioning. However, it comes at the cost of security risks caused by cache side-channel attacks on virtual machines. In this study, we investigate the security impact of these attacks on virtualized network functions. In particular, we propose a novel cache-based reconnaissance technique against virtualized Linux-based firewalls. The proposed technique has significant advantages in the perspective of attackers. First, it enhances evasiveness against intrusion detection owing to the ability of source spoofing. Second, it allows inference on a wide variety of filtering rules. During experiment in VyOS, the proposed method could infer the firewall rules with an accuracy of more than 90% by using only a few dozen packets. We also present countermeasures to mitigate cache-based attacks on virtualized network functions.

KW - Cache side-channel analysis

KW - Firewall reconnaissance

KW - Network function virtualization

UR - http://www.scopus.com/inward/record.url?scp=85090265258&partnerID=8YFLogxK

U2 - 10.1109/INFOCOM41043.2020.9155449

DO - 10.1109/INFOCOM41043.2020.9155449

M3 - Conference contribution

AN - SCOPUS:85090265258

T3 - Proceedings - IEEE INFOCOM

SP - 1798

EP - 1807

BT - INFOCOM 2020 - IEEE Conference on Computer Communications

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 38th IEEE Conference on Computer Communications, INFOCOM 2020

Y2 - 6 July 2020 through 9 July 2020

ER -

Inferring Firewall Rules by Cache Side-channel Analysis in Network Function Virtualization

Abstract

Publication series

Conference

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this