3 ms·

Maybe I missed it but where's the discussion of security issues and how to prevent code tampering within programmable switches? It's great to be able to program

Maybe I missed it but where's the discussion of security issues and how to prevent code tampering within programmable switches? It's great to be able to program the data plane on demand to trace problems but this also opens up a huge opportunity for technically astute evildoers. I would expect at the very least to see some discussion of risks as well as possible solutions like code signing or secure enclaves but this seems to be absent from both the white paper as well as the cited sources. In contrast other efforts on networking like Martin Casado's Sane work [1] and OpenFlow [2] explicitly addressed security issues up front. [1] http://yuba.stanford.edu/ethane/sane.pdf http://yuba.stanford.edu/ethane/sane.pdf [2] http://archive.openflow.org/documents/openflow-wp-latest.pdf http://archive.openflow.org/documents/openflow-wp-latest.pdf

sargun 9y ago
Switches are already programmable to a degree. This is out of scope -- and yes, it's slightly worse than the existing story, but not that much worse. I believe, as a community, we've decided that trusting the transport is a bad idea.
- hodgesrm 9y ago
  You are of course right that switches are partially programmable but I don't think believe the argument about never trusting the transport really holds up. First, getting code into the data plane opens up the entire network to new attacks or at least makes them far easier. For instance, just knowing the bytes that are traversing the network gives you a lot of information about what applications are doing, regardless of application encryption. [See https://news.ycombinator.com/item?id=14070130 https://news.ycombinator.com/item?id=14070130 for an enjoyable discussion.] In short this would undo the benefits of strategies like micro-segmentation. Second, a lot of backend traffic is unencrypted because managing the crypto infrastructure (e.g., managing X509 certs, keeping up ciphers, staying fully patched) is a pain in the tail when you have communication between hundreds or thousands of services. Individual services can do it, yes, but as far as I can tell there's no general solution for managing application-level security across diverse services. My current employer is pretty sophisticated about enterprise security but we really struggle with this problem. At some point you just say some parts of the network are trusted.
  - hodgesrm 9y ago
    p.s., Did I mention denial-of-service attacks? All you need is intermittent failures in packet forwarding to sow chaos.

sargun 9y ago

Switches are already programmable to a degree. This is out of scope -- and yes, it's slightly worse than the existing story, but not that much worse. I believe, as a community, we've decided that trusting the transport is a bad idea.

hodgesrm 9y ago
You are of course right that switches are partially programmable but I don't think believe the argument about never trusting the transport really holds up. First, getting code into the data plane opens up the entire network to new attacks or at least makes them far easier. For instance, just knowing the bytes that are traversing the network gives you a lot of information about what applications are doing, regardless of application encryption. [See https://news.ycombinator.com/item?id=14070130 https://news.ycombinator.com/item?id=14070130 for an enjoyable discussion.] In short this would undo the benefits of strategies like micro-segmentation. Second, a lot of backend traffic is unencrypted because managing the crypto infrastructure (e.g., managing X509 certs, keeping up ciphers, staying fully patched) is a pain in the tail when you have communication between hundreds or thousands of services. Individual services can do it, yes, but as far as I can tell there's no general solution for managing application-level security across diverse services. My current employer is pretty sophisticated about enterprise security but we really struggle with this problem. At some point you just say some parts of the network are trusted.
- hodgesrm 9y ago
  p.s., Did I mention denial-of-service attacks? All you need is intermittent failures in packet forwarding to sow chaos.