Search

V industriji obstaja veliko zahtev po izboljšanju storitev v bolj agilnem okolju in iskanju stroškovno učinkovitejših rešitev. Z virtualizacijo tehnologije in popularizacijo računalništva v oblaku tehnologija napreduje. Pri razvoju produktov, ki tečejo na virtualiziranih platformah je ključnega pomena zajem omrežnega prometa z uporabo zrcaljenja za potrebe odpravljanja napak, reševanja težav in končno tudi funkcionalnosti za zakonito prestrezanje. Pri produktih, ki tečejo na virtualiziranih platformah, določen omrežni promet ne zapušča strežnika, zato je potrebno omrežni promet zrcaliti na virtualizirani omrežni opremi. Programsko definirana omrežja avtomatizirajo omrežne sisteme in naredijo bolj programabilna omrežja, tako postane usmerjanje paketov bolj prilagodljivo. Tehnologija SDN omogoča centralizirano upravljanje zrcaljenja tako strojnih omrežnih naprav kot tudi virtualiziranih omrežnih naprav. S tem je upravljanje z zrcaljenjem kot tudi celotno upravljanje z omrežjem poenostavljeno tudi pri velikih postavitvah. V delu je prikazana vzpostavitev sistema za zrcaljenje prometa, kot en od primerov uporabe programsko definiranih omrežij. Ta rešitev uporablja omrežna stikala, ki s krmilnikom omogočajo lažjo in bolj dinamično konfiguracijo sistema za spremljanje in analizo paketov. Pri programsko definiranem omrežju obstajajo varnostni pomisleki, ker virtualizacija omrežne infrastrukture poveča potencialne vektorje napadov. Krmilnik, kot centralna točka odločanja, je običajno primarna tarča napadalcev. Zaradi te centralizirane zasnove programsko definiranih omrežij je ogrožanje varnosti krmilnika enako ogrožanju varnosti celotnega omrežja. Implementacija varnosti je nujna za nemoteno delovanje omrežja in zagotavljanje funkcije zrcaljenja prometa. V magistrskem delu smo najprej naredili pregled področja obstoječih tehnologij, nato pa še pregled varnostnih zahtev in ranljivosti v omrežju SDN. Raziskali smo različne grožnje in varnostna vprašanja krmilnika OpenDaylight. Na praktičnih primerih smo preverili napade na krmilnik in kako napadi vplivajo na zagotavljanje funkcije zrcaljenja prometa. Na koncu smo identificirali napade in predlagali tehnike za zaščito pred napadi. There are many demands in the industry to improve services in a more agile environment and find more cost-effective solutions. With virtualization and the popularization of cloud computing, technology is advancing. When developing products running on virtualized platforms, it is critical to capture network traffic using mirroring for debugging, troubleshooting, and lawful interception functionality. For products running on virtualized platforms, certain network traffic does not leave the server, so it is necessary to mirror the network traffic on the virtualized network equipment. Software Defined Networks (SDN) automate network systems and make networks more programmable, making packet routing more flexible. SDN technology enables centralized mirroring management of both hardware network devices and virtualized network devices. This simplifies mirroring management as well as overall network management even in large setups. The thesis shows how to set up a traffic mirroring system, as one of the examples of the use of software defined networks. This solution uses network switches with a controller that allows easier and more dynamic configuration of the system for packet monitoring and analysis. There are security concerns with SDN because virtualizing the network infrastructure increases potential attack vectors. The controller, as the central decision point, is usually the primary target of attackers. Because of this centralized design of SDN, compromising the security of a controller is tantamount to compromising the security of the entire network. The implementation of security is necessary for the smooth operation of the network and the provision of the traffic mirroring function. In the master's thesis, we reviewed the field of existing technologies, security requirements, and vulnerabilities in the SDN network. We investigated various threats and security issues of the OpenDaylight controller. Using practical examples, we evaluated possible attacks on the controller and how these affect the provision of the traffic mirroring function. Finally, we identified the attacks and suggested techniques to protect against the attacks.

V magistrskem delu je predstavljen koncept virtualizacije omrežnih funkcij s poudarkom na verifikaciji omrežnih funkcionalnosti na oblačni platformi Openstack. Delo je razdeljeno na tri večje sklope. V prvem sklopu je predstavljena tehnologija virtualizacije omrežnih funkcij s poudarkom na arhitekturi omrežja, ki uporablja virtualizacijo. Opisane so prednosti in slabosti omrežja, ki uporablja virtualizacijo, in podani so razlogi za prehod iz tradicionalnih omrežij v omrežja, ki temeljijo na virtualizaciji. V drugem sklopu je opisana platforma Openstack, ki je odprtokodna platforma za izdelavo oblačnih sistemov. Opisani so ključni gradniki, ki jih uporablja platforma Openstack. Naloge posameznega projekta Openstack so opisane samostojno in v okviru verifikacije omrežnih funkcionalnosti. Fokus magistrske naloge sta projekta Openstack Nova in Neutron, ki sta glavna projekta, odgovorna za omrežne funkcionalnosti na oblačni arhitekturi. Opisani so tudi praktični izzivi izvajanja verifikacije, povezane s projektoma Openstack Nova in Neutron. V zadnjem sklopu so predstavljeni praktični primeri verifikacijskih scenarijev na platformi Openstack. Opisani so problemi izvajanja verifikacije na platformi Openstack zaradi obsežne abstrakcije, ki jo uporabljajo virtualna omrežja. Izpostavljene so potrebe po detajlnih opisih testnih scenarijev, kjer so zahteve testnih scenarijev podane po posameznih projektih Openstack. Problemi verifikacije so prav tako predstavljeni z vidika uporabe spletne dokumentacije. Podani so trije primeri verifikacijskih scenarijev na platformi Openstack. Verifikacijski scenarij, ki pretežno uporablja le projekte Openstack, scenarij, kjer poleg projektov Openstack uporabljamo tudi neodvisne tehnologije, in scenarij, ki ni neposredno povezan z omrežnimi funkcionalnostmi, vendar se vseeno izvaja kot del verifikacije omrežnih funkcionalnosti. Vsak verifikacijski scenarij je opisan kot skupek nalog posameznih projektov Openstack in neodvisnih tehnologij. Izpostavljene so tudi potrebe po pisanju verifikacijskih dokumentov, na katere se lahko sklicujemo v prihodnosti, ko isto funkcionalnost testiramo na novejši različica sistema. The master's thesis presents the concepts of network function virtualization with an emphasis on the verification of network services on the opensource platform Openstack. The thesis is divided into three key chapters. The first chapter gives an introduction into the technology of network virtualization with an emphasis on the architectural aspects of network virtualization. This chapter also specifies the pros and cons of network virtualization and provides reasoning as to why a move from traditional networking into the domain of virtualization is needed. The second chapter focuses on the opensource platform Openstack. The chapter describes the main elements of Openstack and describes the functionality of each Openstack project that is used when developing a cloud architecture. The functionality of each Openstack project is described in isolation and in the context of network verification. Openstack projects neutron and nova are described in detail as they are the main projects responsible for network functionality on the Openstack platform. Practical verification challenges of neutron and nova are also described in this chapter. The last chapter covers practical examples of verification scenarios on the Openstack platform. The chapter covers challenges in creating and executing verification scenarios due to amount of abstraction that network virtualization uses. The need for detailed description of testing scenarios is covered with an emphasis on why testing scenarios need to be designed in such a way that it covers the tasks and responsibilities of each Openstack project separately and in combination with each other. The problems of using internet sources as part of the verification process is also described. The chapter consists of three verification scenarios that were executed on the Openstack platform. The first scenario covers the verification of Openstack projects in isolation, the second scenario covers Openstack projects combined with a technology that is not connected to Openstack and the last scenario covers the verification of a service that is not directly connected to network verification. The need for keeping detailed records of testing scenarios is described throughout the entire chapter.

Danes je na trgu veliko ponudnikov oblačnih storitev, pri katerih lahko najamemo celotna podatkovna središča. Ponudniki oblačnih storitev ponujajo predvsem storitve, ki so vezane na strežniško infrastrukturo. Takemu modelu oblačnih storitev pravimo infrastruktura kot storitev (IaaS). Omogočajo oblikovanje po meri storitev strežniške infrastrukture, ne zagotavljajo pa ji oblikovanja omrežne infrastrukture po meri. Razlog je predvsem v tem, da večina oblačnih storitev še vedno temelji na principu klasične omrežne arhitekture. Tako se poraja potreba po novi arhitekturi, ki bi omogočala prilagajanje omrežja glede na individualne potrebe po oblačnih storitvah. Za zagotavljanje takih storitev moramo razširiti arhitekturo oblaka, tako da vanjo vključimo arhitekturo programsko določenega omrežja (SDN). Integracija arhitekture programsko določenega omrežja v obstoječo oblačno arhitekturo je še vedno v fazi razvoja, zato je takšnih ponudnikov storitev malo. Razlog za to so tudi proizvajalci programske in strojne opreme, ki so še vedno nagnjeni h klasičnemu modelu omrežne arhitekture. Ponudniki oblačnih storitev uporabniku že v naprej pripravijo določeno topologijo omrežja, ki jo nato uporabnik uporabi pri postavitvi svojih infrastrukturnih storitev, s tem pa ga omejijo v njegovem oblačnem okolju. V tem magistrskem delu smo predlagali rešitev, ki je pokazala, kako lahko razširimo oblačni arhitekturni model IaaS in mu dodamo arhitekturo programsko določenega omrežja (SDN). Do predloga smo prišli tako, da smo analizirali nekaj oblačnih rešitev in nato predlagali najbolj ustrezno. Enako smo naredili pri kontrolniku programsko določenega omrežja in nato z nekaj primeri uporabe programsko določenega omrežja v praksi predstavili delovanje take postavitve. Za predlagano rešitev smo izbrali oblačno platformo OpenStack in jo razširili na funkcionalnost programsko določenega omrežja z integracijo kontrolnika Open Daylight. Nato smo izvedli postavitev v testnem okolju, kjer smo skozi aplikacijo na kontrolniku Open Daylight pokazali njeno uporabo. S tem smo dosegli cilj magistrske naloge in pokazali delovanje rešitve v praksi. Pokazali smo tudi njeno uporabnost z vidika varnosti oblačnih storitev. Ugotovili smo, da so nastavitve prikazane rešitve zelo kompleksne, in se tudi zavedamo, da se bo morala tovrstna tehnologija še nekoliko razviti, preden preide v masovno uporabo. These days there is a large number of cloud service providers on the market where one can rent entire data centers. Cloud providers tend to offer services based on their server infrastructure. This service model is called Infrastructure as a Service. They enable us to design customized server infrastructure services but do not provide for similar possibilities when designing network infrastructure. The reason for this is mostly classical network architecture which is still used in cloud environments. Because of growing demands after flexibility in network area a new approach is needed which suits the cloud services. To achieve this kind of service we need to expand cloud architecture to include the architecture of software defined networks (SDN). The process of integrating a cloud infrastructure with software defined network is still in development. There are only a few cloud providers that offer these kinds of services. The reason for this are mostly software and hardware providers who still rely on the classical network architecture. Because of this most cloud providers offer predefined network topologies and thus limit customers regarding topology in their cloud infrastructure. We proposed a solution that has shown how IaaS cloud architecture model can be expanded with the functionality of software defined networks (SDN). We came up with this solution by researching some existing cloud solutions and selecting the most suitable. Same was done for the software defined network solution. We have also prepared some use cases to show how our proposed solution works in practice. For the proposed solution we used OpenStack cloud platform, which we then extended with the functionality of SDN network by integrating the OpenDaylight controller. We then built a test environment where we demonstrated practical use with the application on the ODL controller.