PPT标准模版

Size: px

Start display at page:

Download "PPT标准模版"

责央高
5 years ago
Views:

1 探索软件定义的新型防护体系绿盟科技刘文懋资深研究员博士密级 : 公开使用 nsfocus.com 2010 绿盟科技

2 Agenda 1 新型网络的安全防护体系 2 软件定义的安全防护实践 3 附录

3 Network management is pain Distributed Network Management CLI,Serial Distributed Compute& Storage Management WEB portal Perl, Expect Puppet Hadoop, Storm

4 SDN 是未来网络的希望之路软件定义计算存储网络 vs 安全 APP APP APP Network controller Openflow handling system Special packet forwarding hardware Openflow Switch Openflow handling system Special packet forwarding hardware Openflow Switch Openflow handling system Special packet forwarding hardware Openflow Switch Openflow handling system 安全呢?! Special packet forwarding hardware Openflow Switch 能否在 SDN 网络中部署现有的安全产品? 能否使用软件定义的理念重构我们的安全解决方案?

5 Flow-level security Lightweight DDoS flooding attack detection using NOX/OpenFlow [2] Source address validation solution with OpenFlow/NOX architecture [3] Packet-level security FleXam, a flexible sampling OpenFlow extension [4] Architecture FRESCO [1] Defense4All in Opendaylight, radware SDN 安全的相关工作

6 当前 SDN 安全架构案例 Defense4All Fresco

7 形式化的当前 SDN 安全架构 Security Kernel Network Controller Data Request Comman d Network device Data Data Security Device Security Device Security Device

8 The SDSA Architecture I Network Sec App App input output input output Network Controller Sec Agent Commands Data, Topology Security Controller Commands Data Request Policies Status Reports Alerts Network device Stats Data Security Device Security Device Security Device

The SDSA Architecture II input Network App output Network Controller Sec App Sec App Sec App Sec Agent Commands Data, Topology Sec events commands Security

9 The SDSA Architecture II input Network App output Network Controller Sec App Sec App Sec App Sec Agent Commands Data, Topology Sec events commands Security Controller Tenant Info IaaS NV Commands Data Request Poli cies Status Reports Alerts Network device Stats Data Security Device Security Device Security Device

10 The SDSA controller

策略解析 Security App APP 策略流指令 Network Controller Policy Resolver

a security device, or the network controller Action is a verb

collection of tenants, VMs or networks flows.

11 策略解析 Security App APP 策略流指令 Network Controller Policy Resolver 设备规则 Security Device Subject is the policy executor: a SC module, a security device, or the network controller Action is a verb denoting how to deal with objects: {BLOCK, CLEAN, LOG } Objects a collection of tenants, VMs or networks flows. Each has a unique identifier ObjID, its type ObjType, and a compound matching expression ObjMatch.

12 重构安全设备 APP APP APP Orchestration 控制层 APP APP Porta l Operating System 策略反馈 Special packet forwarding hardware Security device 计算决策层策略管理安全分析知识库信誉库安全状态机规则策略日志告警 Security rule handling system Special packet forwarding hardware 安全设备规则库 SD-security device 数据判断逻辑决策逻辑数据

13 Agenda 1 新型网络的安全防护体系 2 软件定义的安全防护实践 3 附录

return Flow event 4 add app-reg event Event Scheduler 14 add push Policy event 10

found 17 push commands Flow Pusher 16 send flow commands 15 broadcast policy Policy

14 软件定义的 DDoS 防护 APP SA 3 app reg 5 subscribe flows push policies suspicious data NC SC Age nt Security Controller 7 query flows Flow Polling 8 return flows 9 add return Flow event 4 add app-reg event Event Scheduler 14 add push Policy event 10 broadcast flows APP Manager 6 subscribe Flows event Flow Monitor 11 suspicious Data found 17 push commands Flow Pusher 16 send flow commands 15 broadcast policy Policy Resolver 2 add dev-reg event Device Manager Policies APPs Devices Flows 18 redirect flows 1 device reg ADS

15 4000 flows/s, 90% detected within 1.5s 实验结果

16 Related works:defense4all

17 Related works:defense4all ONS 2014 IDOL :Real-time SDN Analytics for DDoS mitigation - Broadcade 绿盟 -NTA 设备 docker 化后的软件定义抗 DDoS 防护绿盟软件定义的 DDoS 检测原型架构绿盟云监护抗拒绝服务系统凭借优质 DDoS 清洗服务产品获得美国知名杂志信息安全产品指南金奖

Case: 端口扫描 Table1 Normal port scan Scan type Live ports Unestablished rate TCP scan 735 98.28% 4.573 TCP SYN scan 970 98.22% 6.

384 Normal 3 1.6% 0.02 I Figure 6: Distributed flow processing.

18 Case: 端口扫描 Table1 Normal port scan Scan type Live ports Unestablished rate TCP scan % TCP SYN scan % Normal % I Table2 Slow port scan Scan type Live ports Unestablishe d rate Slow syn scan % Normal 3 1.6% 0.02 I Figure 6: Distributed flow processing. I = x U i nr + 1 x) A i nc Table3 Detection overhead Scan overhead (μs/pkt) TCP SYN scan TCP scan Slow scan Flow monitor Snort plugin Figure 7: Cluster time consuming comparison.

19 CSA:SDP(Perimeter) Access control in SDN Garnter: Adaptive Access Control Checkpoint:SDP(Protection)

20 Case: Software defined access control in Internet NSFOCUS Intranet 外部网关 SDN 交换机 NF 软件定义的边界 WAF ADS CONTROLLER GRE Tunnel 内部网关 br-ex br-int br-tun 传统交换机

21 下一代威胁来势汹汹

22 RSA SecruID 攻击 Oday 持续渗透分支 HR 财务主管特权用户定向攻击零日漏洞多阶段攻击高级逃逸技术 RSA 令牌种子服务器洛克马丁等军工企业

23 Anti-APT(Advanced persistent threat) To the point: the five style of advanced threat defense, Lawrence Orans, Gartner

24 IPS 示例 Data flow Controller command (both Proactive and reactive) Security Controller VM1 VM2 L7filter+iptables eth1 IPS eth2 br-int br-tun br-tun br-in br-out GRE Tunnel

25 Video Demo: 流 + 数据包层协同防护 Security Controller reports Gray data Abnormal data NIPS WAF Clean data Flows Global Flow Knowledge 绿盟实现了先使用全局流表对所有网络设备的流做广谱分析, 将异常流牵引到入侵防护设备作进一步分析, 当出现异常时及时阻断可做到检测范围和检测效率的平衡

26 服务链简介 I Rack 交换机计算节点 IPS ADS WAF vswitch hypervisor 输入网卡输出网卡计算节点 VM1 VM2 VM3 vswitch hypervisor 网卡 Openflow 指令 SDN 控制器云计算控制节点安全控制平台

27 服务链简介 II Rack 交换机计算节点 IPS ADS WAF vswitch hypervisor 输入网卡输出网卡计算节点 VM1 VM2 VM3 vswitch hypervisor 网卡 Openflow 指令 SDN 控制器云计算控制节点流量调度指令安全控制平台

28 Demo: 多种 Web 安全设备协同

29 Case: Software defined Anti-APT solution Security Controller Entity Database Flow Database Reputation Database RSAS Data TAC IDS Video

30 Case:Live protection for Openstack web servers Security Controller SDN Controller Rewrite pkg destination to WAF Launch instances Push commands WAF WAF WAF web 集群

31 Demo:WAF VM+Openstack+SDN controller Video

32 Agenda 1 新型网络的安全防护体系 2 软件定义的安全防护实践 3 附录

33 云杉 LiveCloud+ 绿盟安全服务发布会

34 与 LiveCloud 的合作 -WAF

35 与 LiveCloud 的合作 - 漏扫服务

36 基于 SDN 技术的恶意行为监测系统 2015 全球 SDN 大会 show case

37 用户云端认证, 快速部署更新应用实现应用容器级的隔离, 增量更新 APPStore: 安全交付模式的革命 Security APP Store Security Controller Deploy, update Authentication Purchase Update Security Controller Deploy, update APP Server APP APP APP Server Company A APP Server APP APP APP Server Company B

38 APPStore

幻灯片 1

幻灯片 1 SDN 和分布式网络虚拟化设计 QQ : 67278439 新浪微博 :@ 盛科张卫峰 Topic SDN 对云计算网络的价值 SDN 网络虚拟化方案一览从 OVN 看分布式网络虚拟化设计基于硬件 SDN 交换机的网络虚拟化 SDN 是一种思想 SDN 不是一种具体的