Flexible Data Plane for Zero Trust Security in Data Centers and Its Instantiation using ONOS Intent Framework

Zero Trust security in a data center requires that every entity (VMs, hosts, users, etc.) within the data center is protected from one another through strict traffic scrutiny. Current solutions enforce this by controlling the reachability of traffic in and out of any entity. However, the security functions must be more stringent with stateful operations to enforce zero trust. This paper addresses this issue by enforcing application of stateful security operations to entities in an automated fashion. The control plane is realized by extending the Intent Framework of Open Network Operating System (ONOS) to handle security policies that go beyond reachability checks. Stateful data plane operations are realized via elastic data plane services (DPS) running alongside the software switch in the hotst's hypervisor. We implement a prototype based on our extended ONOS and the Open vSwitch (OVS) as a software switch. We choose the Snort intrusion detection as an example DPS since it cannot be instantiated as simple flow rules.