Exploiting Temporal Vulnerabilities for Unauthorized Access in Intent-based Networking
Name
3658644.3670301.pdf
Size
1.94 MB
Format
Adobe PDF
Checksum (MD5)
b8ec0a1c3183c7de014587649705694d
Author(s)
Weintraub, Ben
Kim, Jiwon
Tao, Ran
Nita-Rotaru, Cristina
Okhravi, Hamed
Tian, Dave (Jing)
Ujcich, Benjamin
Date Issued
December 2, 2024
Publisher
ACM|Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security
Citation
CCS ’24, October 14–18, 2024, Salt Lake City, UT, USA
Version
Final published version
Abstract
Intent-based networking (IBN) enables network administrators to express high-level goals and network policies without needing to specify low-level forwarding configurations, topologies, or protocols. Administrators can define intents that capture the overall behavior they want from the network, and an IBN controller compiles such intents into low-level configurations that get installed in the network and implement the desired behavior.
We discovered that current IBN specifications and implementations do not specify that flow rule installation orderings should be enforced, which leads to temporal vulnerabilities where, for a limited time, attackers can exploit indeterminate connectivity behavior to gain unauthorized network access.
In this paper, we analyze the causes of such temporal vulnerabilities and their security impacts with a representative case study via the ONOS IBN implementation. We devise the Phantom Link attack and demonstrate a working exploit to highlight the security impacts. To defend against such attacks, we propose Spotlight, a detection method that can alert a system administrator of risky intent updates prone to exploitable temporal vulnerabilities. Spotlight is effective in identifying risky updates using realistic network topologies and policies. We show that Spotlight can detect risky updates in a mean time of 0.65 seconds for topologies of over 1,300 nodes.
Description
CCS ’24, October 14–18, 2024, Salt Lake City, UT, USA
MIT Department
Lincoln Laboratory
Terms of Use
Creative Commons Attribution
Persistent DSpace Link
DOI of Published Version
https://doi.org/10.1145/3658644.3670301
