arXiv subjects

Ali Jose Mashtizadeh

Publications and source records attributed to Ali Jose Mashtizadeh.

3 recordsLinked to original sources

arXiv2020

Constellation: A High Performance Geo-Distributed Middlebox Framework

Middleboxes are increasingly deployed across geographically distributed data centers. In these scenarios, the WAN latency between different sites can significantly impact the performance of stateful middleboxes. The deployment of middleboxes across such infrastructures can even become impractical due to the high cost of remote state accesses. We introduce Constellation, a framework for the geo distributed deployment of middleboxes. Constellation uses asynchronous replication of specialized state objects to achieve high performance and scalability. The evaluation of our implementation shows that, compared with the state-of-the-art [80], Constellation improves the throughput by a factor of 96 in wide area networks.

cs.NI↗

arXiv2020

Fault Tolerance for Service Function Chains

Enterprise network traffic typically traverses a sequence of middleboxes forming a service function chain, or simply a chain. Tolerating failures when they occur along chains is imperative to the availability and reliability of enterprise applications. Making a chain fault-tolerant is challenging since, in the event of failures, the state of faulty middleboxes must be correctly and quickly recovered while providing high throughput and low latency. In this paper, we introduce FTC, novel system design and protocol for fault-tolerant service function chaining. FTC provides strong consistency with up to f middlebox failures for chains of length f+1 or longer without requiring dedicated replica nodes. In FTC, state updates caused by packet processing at a middlebox are collected, piggybacked into the packet, and sent along the chain to be replicated. The evaluation of our FTC implementation shows that compared with the state of art [46], FTC improves throughput by 2-3.5x for a chain of two to five middleboxes.

cs.NI↗

arXiv2014

Cryptographically Enforced Control Flow Integrity

Recent Pwn2Own competitions have demonstrated the continued effectiveness of control hijacking attacks despite deployed countermeasures including stack canaries and ASLR. A powerful defense called Control flow Integrity (CFI) offers a principled approach to preventing such attacks. However, prior CFI implementations use static analysis and must limit protection to remain practical. These limitations have enabled attacks against all known CFI systems, as demonstrated in recent work. This paper presents a cryptographic approach to control flow integrity (CCFI) that is both fine-grain and practical: using message authentication codes (MAC) to protect control flow elements such as return addresses, function pointers, and vtable pointers. MACs on these elements prevent even powerful attackers with random read/write access to memory from tampering with program control flow. We implemented CCFI in Clang/LLVM, taking advantage of recently available cryptographic CPU instructions. We evaluate our system on several large software packages (including nginx, Apache and memcache) as well as all their dependencies. The cost of protection ranges from a 3-18% decrease in request rate.

cs.CR↗