Protecting Telecom Core with Intel® SGX
Transcript of Protecting Telecom Core with Intel® SGX
Protecting Telecom Core with Intel® SGXSomnath Chakrabarti - Security & Privacy Research/Intel Labs
SGX Day 2020
Disclaimer
Intel provides these materials as-is, with no express or implied warranties.
All products, dates, and figures specified are preliminary, based on current expectations, and are subject to change without notice.
Intel, processors, chipsets, and desktop boards may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.
Intel technologies' features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.
Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and providedto you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.
Intel and the Intel logo are trademarks of Intel Corporation in the United States and other countries. *Other names and brands may be claimed as the property of others.
© Intel Corporation
2
Why Mobile Core ?
Source: IHS Markit ™ SDN & NFV Intelligence Service; Update 2H 2018
Source: IHS Markit ™ SDN & NFV Intelligence Service; Update 2H 2018
Business Intersect Interest
$37.5Bn investment target only on Network Function Virtualization (NFV) with an aggressive 64% roll out by 2020
4
Telco Networks and Security Risk…
“…security vulnerabilities can be overcome but with a heavy compromise on performance” – 5g-ppp.eu
“…the weak isolation and security vulnerabilities attached with containers pose an impediment for its use in multi-tenant environments in 5G” – 5g-ppp.eu
Attacks are happening on telco networks – csiag.org
5
Goal of ONF/OMEC - Open Mobile Evolved Corehttps://www.opennetworking.org/omec
Mobile Network Core
(EPC)
DATACENTERS
Access Network Network
Backhaul
Can we securely run Telco core infrastructure on high volume servers to deliver operational capacity?
Build
BaseStation
(eNB)
Control
User Data
InternetMME Service
Gateway(SGW)
HSS PCRF
MME: Mobility Management Engine (Control)HSS: Home Subscriber Services (Authentication)PCRF: Policy and Charging Rules FunctionS-GW: Service Gateway (Charging, services, …)P-GW: Packet Gateway (Router)
①②
③④
Packet Gateway
(PGW)
Charging
6
Router
Firewall
Load Balancer
Deep Packet Inspection/ IDS
Router EPC VPN Firewall LoadBalancer DPI/IDS
N-tupleLookup
Filters
StateMachines
KeyManager
Hash Table
PolicyManager …
…
Software Building Blocks
EPC
VPN
Virtual network functions on commodity hardwareFixed network functions on proprietary hardware
VS.
Virtual Network Function – Software Building Blocks
Can SGX help protect these VNFs ?
Build
Design choices : Packet processing inside SGX enclave
• Enclave packet access mechanisms
• 1 core - Calling into enclave to transfer every packet or burst of packets – (wouldn’t help)
• ~14 million packets appear on the interface every second
• Enclave can only spend ~200 cycles per packet – The packet budget
• Just one enclave Entry/Exit roundtrip is around ~8000 cycles
• 1 core - Calling into enclave everytime to transfer pointers to packets (still wouldn't help)
• 2 cores – I/O core outside the enclave. Packet processing core inside the enclave
• Call into enclave just once to initialize Rx and Tx ring pointers – exitless pattern for high performance
• Other researchers have also reached the same conclusion that - This is the most effective pattern for high speed
network packet processing !!
• But can we do exitless with just 1 core ?7
Build
SGX Billing Dealer In
Msg Router
SGX Billing Dealer Out
SGX enabled Secure and Auditable Billing
Key Store
CDR
8
Service Gateway Control(SGW-C)
Packet Gateway Control(PGW-C)
Service Gateway User Data(SGW-U)
Packet Gateway User Data(PGW-U)
Forwarding Policy Control (FPC) SDN Controller
Mobility Management Entity(MME)
Home Subscription Server (HSS)
Policy Charging Rules Function(PCRF)
Subscriber Data Base
CTF
CDF
Internet
Offline Charging Service(OFCS)
Mobile Network Core orEvolved Packet Core (EPC)
Data
Control
Opensourced vEPC in 2018 - Released OMEC 1.0 in collaboration with Sprint
Access Network
①
② ③
⑤
④
⑥
SharedStorage
⑦Data
Build
MME: Mobility Management Engine (Control)HSS: Home Subscriber Services (Authentication)PCRF: Policy and Charging Rules FunctionSGW-C: Service Gateway ControlSGW-U: Serving Gateway UserPGW-C: Packet Gateway ControlPGW-U: Packet Gateway UserSubscriber DatabaseFPC: Forwarding Policy Control (IETF)SDN: Software Defined Network ControllerOFCS: Offline Charging ServiceCTF: Charge Trigger FunctionCDF: Charge Data FunctionVNF: Virtual Network Function
E2E Comprehensive EPC Infrastructure (with guidance from Sprint) :
• Distributed architecture decoupling events form packet processing i.e. 5G CUPS
• Secured, Distributed & Auditable SGX based billing system. Provides confidentiality and integrity of Charge Data Records
• Cross platform deployment orchestration, provisioning and network configuration tools ready- KVM, AWS, Docker, K8, …
• Operationally deployable single instance enabling micro-service architecture
9
OMEC – SGX based Charge Data and Billing Record Transfer
Charge TriggerFunction
CDR
Service Gateway User Data
(SGWU/SGWC)
KeyGen
Dealer Enclave measurements
OperatorServer Cert
IntelIAS Cert
Dealer Enclave measurements
IntelIAS Cert
Billing Dealer In
KeyGen Enclave measurements
IntelIAS Cert
OperatorCA Cert
Billing Dealer Out
KeyGen Enclave measurements
IntelIAS Cert
OperatorCA Cert
TLSClient Auth
+ SGX Attestation
RA-TLS
RSA 3072 + SHA256
With
SGX
Mutual Atte
statio
n
RA-TLS
RSA 3072 + SHA256
With SGX
Mutual Attestation
Dealer Enclave measurements
OperatorServer Cert
IntelIAS Cert
TLSClient Auth
+ SGX Attestation
RA-TLS - https://arxiv.org/pdf/1801.05863.pdf ; https://github.com/cloud-security-research/sgx-ra-tls
10
Q4 2019 – T-Mobile’s New Fixed Mobile Service (FMS) Deployment
Key Points:- 3GPP release 13 compliance with full Control User Plane Separation (CUPS)
- Full interoperation with incumbent equipment CISCO aggregation routers, Ericsson MME on TMOPL production network
- SGX Secured CDR system with conformant interfaces for TMOPL’s current billing system
- Commercial grade operational stability… i.e. 24 x 7 x 365 operation with near 0.99999 Mean Time Between Failure (MTBF)
SGX enabled Secure and Auditable Billing
SGX Billing Dealer In
SGX Billing Dealer OutSGX Key Store
Service Gateway Control(SGW-C)
Packet Gateway Control(PGW-C)
Service Gateway User Data(SGW-U)
Packet Gateway User Data(PGW-U)
Mobility Management Entity(MME)
Home Subscription Server (HSS)
Policy Charging Rules Function(PCRF)
Subscriber Data Base
CDF
CTF
Internet
Offline Charging Service(OFCS)
Mobile Network Core orEvolved Packet Core (EPC)
Data
Control
Access Network
MME: Mobility Management Engine (Control)HSS: Home Subscriber Services (Authentication)PCRF: Policy and Charging Rules FunctionSGW-C: Service Gateway ControlPGW-C: Packet Gateway ControlSGW-U: Serving Gateway UserPGW-U: Packet Gateway UserSubscriber DatabaseOFCS: Offline Charging ServiceCTF: Charge Trigger FunctionCDF: Charge Data FunctionVNF: Virtual Network FunctionFMS: Fixed Mobile Service
Data
Legend- TMOPL FMS Infrastructure ---- Incumbent Equipment (CISCO,E///) --
FTP/SSL
ASN.1/SSL
Build
11
European Telecom Standard based LI interfaces on gateways – X1, X2 and X3
ETSI Technical Specification:ETSI TS 103 221-1ETSI TS 103 221-2 V1.1.1
Picture Source : https://www.etsi.org/deliver/etsi_ts/103200_103299/10322102/01.01.01_60/ts_10322102v010101p.pdf 11
Control Plane (SPGW-C)Data Plane (SPGW-U)
POI - Point of InterceptNF – Network Function
TargetInformation
ContentContent
A.2 X2 Security requirements A.2.1 Authentication and Authorization The X2 architecture and message exchange technique shall provide authentication and authorization of end points. A.2.2 Accounting and Audit The X2 architecture and message exchange technique shall provide Accounting and Auditing. A.2.3 Integrity Protection The X2 message exchange technique shall provide integrity protection for all messages exchanged between nodes in the X2 architecture. Use of Integrity protection shall be mandatory. A.2.4 Confidentiality Protection The X2 message exchange technique shall provide confidentiality protection for all messages exchanged between nodes in the X2 architecture. A.2.5 Replay Protection The X2 message exchange technique shall provide replay protection for all messages exchanged between nodes in the X2 architecture. A.2.6 Standalone interface The X2 architecture and message exchange technique shall be designed as a standalone physically dedicated LI interface. The design and selection of the protocol shall where possible ensure that vulnerabilities in non-LI interfaces on the same node shall not impact LI interfaces and security. A.2.7 Minimum Security Level The X2 architecture and message exchange techniques shall provide a minimum level of security (including cypher suites and key length), which shall be supported by all nodes. At least two algorithms shall be specified. The protocol and algorithms shall be resistant to bid down attack. A.2.8 Underlying Infrastructure Trust The X2 architecture and message exchange techniques shall assume by default that the underlying network communication links and infrastructure are untrusted.
12
Regulatory Compliance (LI) interfaces Security Requirements and Intel® SGXETSI Technical Specification:ETSI TS 103 221-1 Section A.2, A.3ETSI TS 103 221-2 V1.1.1 Section A.3
Picture Source : https://www.etsi.org/deliver/etsi_ts/103200_103299/10322102/01.01.01_60/ts_10322102v010101p.pdf
Build
✓ SGX
✓ SGX
✓ SGX
✓ SGX✓ SGX
✓ SGX
✓ SGX
Original OMEC Packet Gateway T-Mobile’s SGX based Packet Gateway
OMEC code re-factored for SGX based Packet gateway and Regulatory compliance
Build
Future - OMEC with SGX secured functions and containers – 2020+
Service Gateway Control(SGW-C)
Service Gateway User Data(SGW-U)
Mobility Management Entity(MME)
Home Subscription Server (HSS)
Policy Charging Rules Function(PCRF)
Subscriber Data Base(Cassandra DB)
CDF/CTF
Internet
Telco Offline Charging/Billing Service(OFCS)
Future Mobile Network Core orEvolved Packet Core (EPC)
Data on IPSec
Control
Access Network
Data
CDR
GW GWData
For Securing -• SPGW-U and SPGW-C• Charging and Billing Systems• Subscriber databases• Transient databases• MME• GTP-C/U links and slices• LI Interfaces
SGX Dealer IN/OUT
Thank YouQuestions ?
15