Secure Networking. Dr. Douglas Maughan DARPA / ITO

Transcription

1 Secure Networking Dr. Douglas Maughan DARPA / ITO dmaughan@darpa.mil 1

2 Network Reliance is Pervasive 10 DoD depends on networking technology for information dominance at all levels of command hierarchy, BUT 10 DoD networks are increasingly vulnerable to attack FIDNET AFIWC Quantico Internat l Allied NIPC CERT FEMA DISA GCC FIWC LIWA PACOM ACERT Ft. Polk 6 FLT Pentagon JTF 1/3 Inf Bn Embassy CVN-65 National Region/ Agency Enterprise/ Installation Site Sensor 2

3 Networks and Systems Research Model Remote Users Extranet Intranet Sensor Networks Wireless Networks Infrastructure Intranet Intranet 10 World of networks & systems 10 Secure Networking should be addressed in this context Intranet Hosts 3

4 Active Networks (ANETS) Active Network Active Node Management Active Packets EE EE EE NodeOS Resources Policy Enforcer Security bandwidth Resources comptutation storage Policy Database 10 Performance / Metrics Performance 4

5 Dynamic Coalitions (DC) Goal: Manage dynamic coalition formation and secure sharing by authorized members 10 Multi-Dimensional Coalition Policies 10 Secure Group Management 10 Coalition Infrastructure Services Host Nation Land Forces HQ Naval Forces HQ US COMMAND NDOC Air Forces HQ 5

6 Multi-Dimensional Coalition Policies (MDCP) 10 Establish standard language for policy expression 10 Capability to negotiate policies with potential coalition partners (implies multiple at same time) 10 Dynamic policy management ❽ Multi-game 10 Policy discovery Policy E.L. Policy Compiler Policy Expressions Policy E.L. NW Info. Global Policy Firewall Host Router Local Enforcement6

7 Secure Group Management (SGM) Mobile Comms Relay Stations Mobile Control Nodes Leave Join 10 New techniques for sender authentication 10 Scalable distribution - group creation & re-key 10 Leverage secure multicast standards work 7

8 Coalition Infrastructure Services (CIS) 10 Scalable techniques for timely propagation of revocation information (e.g., compromised keys, expired certificates, etc.) 10 Extend current technologies of cross-certification for rapid coalition deployment capabilities 10 Secure identification/trust technologies (e.g., credentials) 8

9 Fault Tolerant Networks (FTN) Goal: Ensure continued network availability in the face of attack while containing attacker resources Fault-Tolerant Survivability Denying Denialof-Service Active Network Response Active Intrusion Detection & Response Attack Target Denial of Service Response 9

10 Fault-Tolerant Survivability (FTS) 10 Replication and partitioning of network services; Redundancy of network resources 10 Better understanding of network fault modeling 10 Survivable virtual network overlays 10 Create network self-healing capabilities replica replica client replica replica replica replica client 10

11 Denying Denial-of-Service (DDOS) 10 Develop market-based resource allocation strategies to limit resource consumption by attacker 10 New communication protocols that execute based on incremental progress within trust chain 10 Create accurate mechanisms for reliably attributing DoS attacks 10 Harden current routing and naming infrastructure protocols against DoS attacks 11

12 Active Network Response (ANR) 10 Leverage advanced intrusion detection techniques 10 Active networks to assist with attacker tracing and fencing 10 Immediate reaction to real-time attack, limiting damage and begin recovery The Internet Firewall Filtering Router Organization A Firewall Firewall Organization B Zombie Network IDR Mgmt Station ISP Consortium Target Web Server 12

13 Survivable Mobile Wireless Networking Ensure future mobile, wireless networks are resistant to attacks via dynamic and adaptive configuration strategies 10 Develop capabilities for dynamic, survivable wireless network establishment 10 Leverage wired information assurance solutions 10 Create survivable key management capabilities to protect against compromise and enable rapid recovery and reconstitution 10 Develop node adaptation strategies leveraging active networking 13

14 Summary / Conclusion 10 Networking technology is the cornerstone of DoD communication architectures of the future (e.g., JV 2010, JV 2020) 10 Increasing environments of collaboration require technologies for secure sharing of data and resources 10 Networks at all levels of command hierarchy must be resistant to attack and operate through those attacks which are successful 14

15 Secure Networking Dr. Douglas Maughan DARPA / ITO dmaughan@darpa.mil 15