Security & fault tolerance in fresco
- 1. Security & Fault Tolerance in FRESCO AMIT LANJEWAR |SYMBIOSIS
- 2. Introduction Modular Compassable Security Service An OF security application development framework Facilitates rapid designing, modular composition of modules. Offers a CLICK-inspired programming framework. Designed with an intent to address several key issues accelerating composition of new OF-enabled security services.
- 3. FRESCO Exports scripting API. Libraries represent the elementary processing units in FRESCO. 16 re-usable modules. FRESCO introduces minimal overhead. Can produce flow rules, and thus provide an efficient means to implement security directives. Security Functions such as - simple address blocking to complex flow redirection procedures. Fresco Countermeasure module. Fresco Response module. Fresco Database module. Summary – Simplifies development and deployment of security services for OF n/w. Enables rapid creation of popular security functions with significantly (over 90%) fewer lines of code.
- 7. FRESCO DESIGN FRESCO Framework Application Layer Security Enforcement Kernel (SEK)
- 8. FRESCO Script Language To simplify development of security applications FRESCO provides its own script language. configure modules through a FRESCO script. Defining an instance is very similar to defining a function in C or C++.
- 9. Operational illustration of running FRESCO script
- 10. FRESCO Security Enforcement Kernel Security applications developed in FRESCO - security policies, such as DROP, REDIRECT, QUARANTINE. These policies will be automatically translated into flow rules. Flow rules for non-security-critical applications:- 1. Rule Source Identification 2. Rule Conflict Detection 3. Conflict Resolution
- 11. Case Study Implementing Reflector Net Cooperating with a Legacy Security Application :-
- 12. Implementation of Fresco Architecture Implementation We have developed a prototype implementation of the FRESCO architecture. The FRESCO Application Layer prototype is implemented in Python and runs as an OpenFlow application on NOX. The prototype operates on NOX version 0.5.0 using the OpenFlow 1.1.0 protocol, and is implemented in approximately 3,000 lines of Python.
- 13. Fresco Services 1. FRESCO Scan Deflector Service
- 14. 2. FRESCO BotMiner Service
- 15. FRESCO P2P Plotter Service
- 16. Advantages Enables rapid creation of popular security functions. Fewer lines of code. minimal overhead for use in live network environments. FRESCO also exports a high-level API in the FRESCO language that abstracts away complexities relating to switch management and specific controller implementations. can enforce diverse security policies Implementing Reflector Net FRESCO’s power stems from its ability to use OpenFlow to effectively reprogram the underlying network infrastructure to defend the network against an emerging threat
- 17. Thank You!