Offloading Security Services to the Cloud Infrastructure
Résumé
Cloud applications rely on a diverse set of security services from
application-layer rate-limiting to TCP SYN cookies and application
firewalls. Some of these services are implemented at the infrastructure
layer, on the host or in the NIC, to filter attacks closer to
their source and free CPU cycles for the tenants’ applications. Most
security services, however, remain difficult to implement at the
infrastructure layer because they are closely tied to the applications
they protect.
In this paper, we propose to allow tenants to offload small filtering
programs to the infrastructure. We design a mechanism to
ensure fairness in resource consumption among tenants and show
that, by carefully probing specific points of the infrastructure, all
resource consumption can be accounted for.
We prototype our solution over the new high-performance datapath
of Linux. Our preliminary experiments show that an offload to
the host’s CPU can bring a 4-6x performance improvement. In addition,
fairness among tenants introduces an overhead of only 14%
in the worst case and approximately 3% for realistic applications.
Origine : Fichiers produits par l'(les) auteur(s)