MINOS: regulating router dataplane actions in dynamic runtime environments

Programmable routers are emerging as a promising alternative which facilitates the deployment of new network technologies, for example, software-defined networking; meanwhile, theirs programmability and openness also bring risks of security vulnerabilities. Prior work has concentrated on code security and encryption to improve router action honesty. In this paper, we exploit the feasibility of regulating actions on run-time dataplanes by detecting unexpected packet processing operations, which finally provides an honest and backdoor-proof router to operators. The main challenge is to monitor and regulate the action of router dataplane in dynamic runtime environment. Hence we propose Minos, a framework to regulate router actions on dataplanes. Minos takes Action Identifier (AID) as input to perform lookups in a pre-defined white list called Regulated Action Table (RAT), and it finally verifies that the action is (ab)normal. In the end, Minos achieves a pair of irreconcilable goals for security, i.e., costs and effectiveness. We implement and evaluate Minos on Click and DPDK, separately. And our evaluation results show that Minos captures mal-actions with 2 mega-byte spatial costs and no more than 9% performance loss in both Click and DPDK.