Eric Keller

With the increase in connected devices comes an increase in network traffic. Applications that we use every day, such as video conferencing, each need to have traffic processed to secure and optimize the application. Current network infrastructure is showing signs that in the near future it won't be able to keep up with the growing demand or increased needs, such as having higher definition video calls with more participants and imperceptible delays in the communication. While some solutions have been proposed to help solve this problem, they do so at the cost of compatibility, which would require rewriting a large body of software that has been developed and tested over the course of over a decade. This proposal introduces a new way of thinking about the way network traffic is handled that will enable both forward and backwards compatibility with modern software while meeting the needs of applications.

In particular, this proposal introduces Transparent Network Acceleration (TNA), which is a novel architecture that decomposes Linux network functionality into fast-path and slow-path functions with explicitly optimized execution environments for each. TNA dynamically and automatically builds a minimal fast path that is instantiated and adjusted at run-time, leading to a transparently accelerated networking stack that fully retains the Linux networking interfaces. Two core mechanisms are introduced. First, to create a highly efficient fast path, TNA automatically and dynamically instantiates only the part of the network stack that is used. New techniques are introduced to introspect the Linux kernel, build a dependency graph of functions, and assemble and deploy an optimal fast path. Second, it targets two fast-path execution environments from a single source code description of modules: (i) the eXpress Data Path (XDP), for in-kernel processing, and (ii) a field programmable gate array (FPGA) based SmartNIC, for hardware accelerated processing. As part of these targets, the design of modules, the compilation to hardware or software, and synchronizing the state represent a novel and complete design flow. In order to demonstrate the effectiveness of these two core mechanisms, we complete the project with a case study of automatically accelerating a selective forwarding unit (SFU) video conferencing network function deployed with considerations such as firewalling and container networking.

The proliferation of 5G networks around the world presents an attractive opportunity for U.S. government organizations, nongovernmental humanitarian aid organizations, and private sector enterprises to eliminate the costs of installing and maintaining an alternate communications infrastructure by making use of indigenous 5G networks. However, in many areas of the world, 5G networks are deployed and operated by organizations that are untrusted and potentially hostile to the U.S. In these environments, new security technologies are needed to secure operations. While 5G encrypts data packets and subscriber IDs, analysis of network activity can reveal detailed information about individuals and groups. For example, pattern-of-life analysis can be used to identify and track users. Similarly, traffic analysis can reveal details of an organization?s structure and operations. The 5G Hidden Operations through Securing Traffic (GHOST) project provides four additional layers of security to protect against these threats. First, GHOST protects individuals by swapping subscriber and device IDs, along with usage patterns, or personas. Second, GHOST prevents traffic analysis by introducing ghost users and ghost traffic into the network to obscure real activity. Third, the GHOST project further frustrates traffic analysis by injecting ?false flag? traffic that models real events and operations. Finally, GHOST secures devices at the hardware level by locating GHOST software inside Trusted Execution Environments (TEEs). The GHOST technology will enable organizations to securely operate over foreign 5G networks, regardless of the politics of the network operators.

GHOST addresses threats that cannot be countered by traditional cyber security solutions. The GHOST project will demonstrate an integrated solution on a real 5G network and evaluate GHOST effectiveness in multiple operational scenarios. The GHOST project will yield four major intellectual benefits to the research and operational communities. (i) First, the GHOST project will deliver technology to anonymize or disguise end-user identities and their association with locations, and communications endpoints. End-user identities will be protected by dynamically allocating software defined credentials and associated software defined personas. Association with locations are protected by correlating movement history with compromising patterns of movement. Communications connections are protected by peer-to-peer anonymization. (ii) Second, the GHOST project will deliver technology to overlay normal network activity with ghost activity to obfuscate traffic analysis and hide regular patterns of activity or changes in activity. (iii) Third, the GHOST project will deliver technology to model, generate, and inject ?false flag? traffic into the network to make it appear to a network analyst that a real event is occurring at a particular location. (iv) Fourth, the GHOST project will deliver technology that will protect end-user devices and non-indigenous networking equipment from penetration and compromise through the use of TEEs. The idea behind a TEE is that no software, privileged or not, should be able to access or modify protected data. TEEs enable the process of attestation of both the hardware and the software. The GHOST software will run inside the TEE to be able to attest to the security of the protocol and protect it in case of capture.

GHOST technology will benefit end-users of any untrusted network, not just untrusted 5G networks. The primary criteria for success of the GHOST project will be: (i) Prevention of identification and tracking of individuals by a network operator. (ii) Inability of a network analyst to determine regular activity patterns, or significant changes in activity. (iii) Mis-leading a network analyst by injection of ?false flag? activity. (iv) GHOST software deployment in TEEs with no observable degradation in device performance.