SCION: Scalability, Control and Isolation On Next-Generation Networks

Transcription

1 SCION: Scalability, Control and Isolation On Next-Generation Networks Xin Zhang, Hsu-Chun Hsiao, Geoff Hasker, Haowen Chan, Adrian Perrig, David Andersen 1

2 After years of patching, the Internet is Reliable and Secure! Feb 2008: Pakistani ISP knocks YouTube offline through prefix hijacking Apr 2010: A small Chinese ISP inserts fake routes affecting thousands of US networks including AT&T and Level3 Aug 2010: An academic experiment by RIPE NCC and Duke University briefly disrupts 1% of Internet traffic Nov 2010: 10% of Internet traffic 'hijacked' to Chinese servers, says US report; Chinese DNS Tampering a big threat to Internet security Application Transport Network Data link Fixes to date ad hoc, patches Inconvenient truths Physical S-BGP for topology correctness delayed convergence; route oscillation Global PKI for attestation single root of trust 2

3 Reliable Network Layer Wishlist Imagine if Explicit understanding whom you must trust for network operations All relevant parties have balanced control over path selection The architecture isolates attacks to domains with common laws and economic incentives No single global root of trust High efficiency, scalability, flexibility Application Transport Network Data link Physical 3

4 Reasons for Clean-Slate Design Someone may just want to deploy a new Internet Possible for specialized high-reliability networks, e.g., smart grid Once someone wants to deploy a new Internet, we have a design ready Even if we want to evolve current Internet, we need to have a goal, know how good a network could be 4

5 Current Network-Layer Limitations No path selection by sender and receiver Path influence can enable DDoS defenses Lack of routing isolation Global visibility of paths is not scalable A failure/attack can have global effects Lack of route freshness Current (S-)BGP enables replay of old paths Explosion of routing table size More specific prefixes, multi-homing S-BGP, multi-path routing, and DNSSec do not address any of these issues! 5

6 SCION Architectural Goals High availability, even for networks with malicious parties Explicit trust for network operations Minimal TCB: limit number of entities that need to be trusted for any operation Strong isolation from untrusted parties Operate with mutually distrusting entities No single root of trust Enable route control for ISPs, receivers, senders Simplicity, efficiency, flexibility, and scalability 9

7 A B D Property: Isolation Operate with mutually distrusting entities no single root of trust localization of attacks C M L3 PSC CMU I2 Attacks (e.g., bad routes) 10

8 Property: Control A B C Hide the peering link from CMU L3 PSC I2 D Please reach me via A or B Use Level 3 by default CMU Transit ISPs: select paths to support Destination: select paths to receive packets Source: select paths to send packets Support rich policies and DDoS defenses 11

9 Property: Explicit Trust Know who needs to be trusted Select whom to trust Higher confidence in selected paths Higher reliability in data delivery Enforceable accountability X Y Z Level 3 Internet 2 PSC Go Who through will forward X and Z, Packets but on not the Y path? CMU 12

10 SCION Architecture Overview Path construction Path resolution Route joining (shortcuts) PCB PCB PCB Source Destination 13

11 SCION Architecture Details Hierarchical decomposition Trust Domain (TD) Trust Domain Core (TD Core) Autonomous Domain (AD) Path construction Address/path resolution service Route joining Forwarding 14

12 Hierarchical Decomposition Split the network into a hierarchy of trust domains (TD) TD: isolation of route computation TD cores: interconnected large ISPs Sub-TD AD: atomic failure unit Destination Source 15

13 Hierarchical Decomposition Global set of TD (Trust Domains) Map to geographic, political, legal boundaries TD Core: set of top-tier ISPs that manage TD Route to other TDs Send routing beacons Manage Address and Path Translation Servers Handle TD membership Root of trust for TD: manage root key and certificates AD is atomic failure unit, contiguous/autonomous domain Transit AD or endpoint AD 16

14 Path Construction Goal: each endpoint learns multiple verifiable paths to its core Discovering paths via Path Construction Beacons (PCBs) TD Core periodically initiates PCBs Providers advertise upstream topology to peering and customer ADs ADs perform the following operations Collect PCBs For each neighbor AD, select which k PCBs to forward Update cryptographic information in PCBs Endpoint AD will receive up to k PCBs from each upstream AD, and select k down-paths and up-paths 17

15 Path Construction Upon receiving a PCB from node i-1, node i updates the following for each path p: Interfaces that specify the path I(i) = previous-hop interfaces local interfaces Link expiration time T(i) Opaque field that the local AD will utilize for efficient, secure forwarding O(i) = local interfaces MAC over local interfaces and O(i-1) Signature Σ(i) = sign over I(i), T(i), O(i), and Σ(i-1), with cert of pub key A PCB also contains a timestamp and TD scope 18

16 Path Construction Interfaces: I(i) = previous-hop interfaces local interfaces Opaque field: O(i) = local interfaces MAC over local interfaces and O(i-1) Signature: Σ(i) = sign over I(i), T(i), O(i), and Σ(i-1), with cert of pub key TC A: I(TC): ϕ {ϕ, TC1} O(TC): {ϕ, TC1} MAC Ktc ( {ϕ, TC1} ϕ) Σ(TC): Sign( I(TC) T(TC) O(TC) ϕ) A C: I(A): I(TC) {A1, A2} O(A): {A1, A2} MAC Ka ( {A1, A2} O(TC) ) Σ(A): Sign( I(A) T(A) O(A) Σ(TC) ) E TD Core (TC) A B C D F G 19

17 Path Construction Interfaces: I(i) = previous-hop interfaces local interfaces Opaque field: O(i) = local interfaces MAC over local interfaces and O(i-1) Signature: Σ(i) = sign over I(i), T(i), O(i), and Σ(i-1), with cert of pub key C? One PCB per neighbor C E: I(C): I(A) {C1, C4} O(C): {C1, C4} MAC Ka ( {C1, C4} O(A) ) Σ(C): Sign( I(C) T(C) O(C) Σ(A) ) Also include peering link! I C,D (C): {C4, C2} TD AID D O C,D (C): {C4, C2} MAC Kc ( {C4, C2} ) Σ C,D (C): Sign( I C,D (C) T C,D (C) O C,D (C) O(C) ) E TD Core (TC) A B C D F G 20

18 Forwarding Down-path contains all forwarding decisions (AD traversed) from endpoint AD to TD core Ingress/egress points for each AD, authenticated in opaque fields ADs use internal routing to send traffic from ingress to egress point Joined end-to-end route contains full forwarding information from source to destination No routing / forwarding tables needed! 24

19 Opaque Fields for Forwarding Serve as capabilities for efficient path verification Examples From E to G without shortcut: o use up-path e and down-path g o packet contains: O e (C), O e (A), O e (TC), O g (TC), O g (B), O g (D) From E to G with shortcut: o use peering link between C, D o packet contains: O e (C), O e (A), O C,D (C), O g (B), O g (D) path e A C TD Core (TC) B D path g E F G 25

20 Security Properties Strong isolation between TDs S-BGP: colluding attacks, delayed convergence, obsolete paths SCION: No large-scale routing attacks, high path freshness and consistency, reduced TCB Minimal Trusted Computing Base (TCB) S-BGP: whole internet SCION: only ADs in the path and the TD core Operate with mutually distrusting entities S-BGP or DNSSec: a global PKI and root of trust SCION: No single root of trust 26

21 Security Properties (cont d) Control by both endpoints and transit ADs S-BGP: no path diversity Multi-path routing: destinations have little control, sources have too fine-grained control, DDoS threat SCION: k 2 path diversity; destinations have inbound traffic control, facilitating DDoS defense; control at a coarser granularity Other example attack resilience Prefix hijacking, reflection DoS attacks 27

22 Performance Benefits High scalability (S-)BGP o Cannot securely withdraw a route Adversary can intercept route withdrawals Adversary can re-advertise paths that were withdrawn o Routes cannot have fine grained timeouts All-to-all broadcast problem! SCION o Control only flows downstream Fine-grained timeouts possible Core-to-edges broadcast is much more efficient 29

23 Performance Benefits (cont d) High flexibility Transit ISPs can embed local routing policies in the opaque fields High efficiency Current network layer: routing table explosion SCION: o no forwarding table lookup, o symmetric verification during forwarding o simple routers, energy efficient, cost efficient, 30

24 Discussion Incremental Deployment Current ISP topologies are consistent with the TDs in SCION ISPs use MPLS to forward traffic within their networks Only edge routers need to deploy SCION Can use IP tunnels to connect SCION edge routers in different ADs Limitations Increased packet size Static path binding, which may hamper dynamic re-routing 31

25 Evaluation Use of CAIDA topology information Assuming 5 TDs (AfriNIC, ARIN, APNIC, LACNIC, RIPE), we partitioned ASes into 5 TDs We compare to BGP, current interdomain Internet routing protocol 32

26 Stretch Stretch: SCION path length / BGP path length Path stretch without shortcuts Average BGP path length = 3.9 AS hops Average SCION path length = 4.72 (k=1) Path stretch with shortcuts in a TD 33

27 Expressiveness Fraction of BGP paths available under SCION 34

28 Wormhole and Data-plane Attacks BGP/SBGP SCION 35

29 Related Work Routing security S-BGP, sobgp, psbgp, SPV, PGBGP. Only topological correctness; only addressed a subset of attacks addressed in SCION Routing control Source routing, multi-path (MIRO, Deflection, Path splicing, Pathlet), NIRA Only given control to the source, and/or little security assurance Next-generation architecture HLP, HAIR, RBF, AIP Focusing on other aspects (reducing routing churns and routing table sizes, enforcing routing policies, and providing source accountability) 36

30 Conclusions Basic architecture design for a next-generation network that emphasizes isolation, control and explicit trust Highly efficient, scalable, available architecture Enables numerous additional security mechanisms, e.g., network capabilities 37