Rule-Based Forwarding
|
|
|
- Sylvia Jennings
- 6 years ago
- Views:
Transcription
1 Building Extensible Networks with Rule-Based Forwarding Lucian Popa Norbert Egi Sylvia Ratnasamy Ion Stoica UC Berkeley/ICSI Lancaster Univ. Intel Labs Berkeley UC Berkeley
2 Making Internet forwarding flexible A network s core functionality is to forward packets Power of a network flexibility of its forwarding plane A long-held goal: flexible forwarding
3 Making Internet forwarding flexible A long-held goal: flexible forwarding Example: Middlebox-aware forwarding S Intrusion Detection System (IDS) D
4 Making Internet forwarding flexible A long-held goal: flexible forwarding Example: Middlebox-aware forwarding Intrusion Detection System (IDS) S Port!= 80 D Port = 80
5 Making Internet forwarding flexible A long-held goal: flexible forwarding Example: Middlebox-aware forwarding Intrusion Detection System (IDS) S Port!= 80 D Port = 80 Many such examples: source routes, multiple paths, anycast, mobility, multicast, active networks, etc.
6 Making Internet forwarding flexible A long-held goal: flexible forwarding Example: Middlebox-aware forwarding Intrusion Detection System (IDS) S Port!= 80 D Port = 80 Many such examples: source routes, multiple paths, anycast, mobility, multicast, active networks, etc. Using general forwarding directives instructions to the network on how to forward packets
7 Thesis Flexibility alone is not enough Can compromise network security E.g., source routing, active networks
8 Thesis Flexibility alone is not enough Can compromise network security E.g., source routing, active networks Flexibility must be balanced by policy support Every forwarding directive can be constrained by policies Policy Flexibility Policy
9 Thesis Flexibility alone is not enough Can compromise network security E.g., source routing, active networks Flexibility must be balanced by policy support Every forwarding directive can be constrained by policies Real world example: 1. A car can be driven only by its owner
10 Thesis Flexibility alone is not enough Can compromise network security E.g., source routing, active networks Flexibility must be balanced by policy support Every forwarding directive can be constrained by policies Real world example: 1. A car can be driven only by its owner 2. Anyone can drive any car
11 Thesis Flexibility alone is not enough Can compromise network security E.g., source routing, active networks Flexibility must be balanced by policy support Every forwarding directive can be constrained by policies Real world example: 1. A car can be driven only by its owner 2. Anyone can drive any car 3. Can only drive a car with the approval of its owner
12 Thesis Flexibility alone is not enough Can compromise network security E.g., source routing, active networks Flexibility must be balanced by policy support Every forwarding directive can be constrained by policies Every entity that explicitly appears in a forwarding directive can refuse that directive
13 Constrain forwarding directives Every entity that explicitly appears in a forwarding directive y y p y pp g can refuse that directive
14 Constrain forwarding directives Every entity that explicitly appears in a forwarding directive can refuse that directive Example: apply thesis to current Internet Forwarding directive = Send to destination D Policy of D = No packets from S Not respected in the current Internet S D
15 Constrain forwarding directives Every entity that explicitly appears in a forwarding directive can refuse that directive Example: IP source routing Option available with current IP spec Not supported by ISPs since there is no way to constrain it Desirable: ISPs get to approve source routes S D
16 Constrain forwarding directives Every entity that explicitly appears in a forwarding directive can refuse that directive Example: Middlebox-aware forwarding Allows use of in-network processing Policy of M: only process S-D traffic S D M
17 Constrain forwarding directives Every entity that explicitly appears in a forwarding directive can refuse that directive = Policy-compliance
18 Goal Flexible and Policy-Compliant architecture Flexible: path control, use in-network network functionality and state Policy-compliant: all stakeholders policies are respected Flexibility Policy Compliance
19 Idea: Packet Rule Forwarding directives carried in packet Current Internet packet sent to destination Rule Based Forwarding packet sent to rule Rule Packet
20 Idea: Packet Rule Forwarding directives carried in packet Rule: if(packet.dest_port == 80) sendto D else sendto M S Port!= 80 M Port = 80 D
21 Idea: Packet Rule Forwarding directives carried in packet Rules tell network how to forward packets
22 Idea: Packet Rule Forwarding directives carried in packet All rule participants p authorize (sign) the rule
23 Idea: Packet Rule Forwarding directives carried in packet All rule participants p authorize (sign) the rule S Port!= 80 M Rule Port = 80 Rule D
24 Idea: Packet Rule Forwarding directives carried in packet All rule participants p authorize (sign) the rule All packets carry rules
25 Idea: Packet Rule Forwarding directives carried in packet All rule participants p authorize (sign) the rule All packets carry rules Rules tell network which h packets kt can be forwarded dd
26 Idea: Packet Rule Forwarding directives carried in packet Rules tell network how to forward packets Rules tell network which packets can be forwarded
27 Idea: Packet Rule Rules naturally tie in flexibility and policy-compliance Rule
28 Idea: Packet Rule Rules naturally tie in flexibility and policy-compliance Specifies flexible directives Rule
29 Idea: Packet Rule Rules naturally tie in flexibility and policy-compliance Specifies flexible directives Rule Policies approve/disapprove rule
30 Idea: Packet Rule Rules naturally tie in flexibility and policy-compliance Specifies flexible directives Rule Encapsulates proof of policy-compliance Policies approve/disapprove rule
31 Idea: Packet Rule Rules naturally tie in flexibility and policy-compliance Specifies flexible directives Rule Encapsulates proof of policy-compliance Policies approve/disapprove rule Routers only need information in packet (rule) to: Forward the packet Verify that it complies with policies of all parties
32 Outline Motivation & Solution Overview Rule-Based Forwarding Architecture Overview Rule Forwarding Mechanism & Examples Evaluation
33 Rule-Based Forwarding (RBF) Architecture t Destinations own rules Senders Routers Destinations
34 Rule-Based Forwarding (RBF) Architecture t RCE For policy-compliance, rules are certified by trusted entities Rule Certification Entities (RCEs) D Senders Routers Destinations
35 Rule-Based Forwarding (RBF) Architecture t All entities named in the rule (destination, middleboxes, routers) must authorize the rule RCE M Rule Rule D Senders Routers Destinations
36 Rule-Based Forwarding (RBF) Architecture t RCE R_D D Senders Routers Destinations
37 Rule-Based Forwarding (RBF) Architecture t DNS RCE Extended DNS: returns rule instead of address R_D Insert rules into DNS D Senders Routers Destinations
38 Rule-Based Forwarding (RBF) Architecture t R_D DNS RCE Sources obtain rules S D Senders Routers Destinations
39 Rule-Based Forwarding (RBF) Architecture t DNS RCE Insert them in packets kt S R_D Payload D Senders Routers Destinations
40 Rule-Based Forwarding (RBF) Architecture t DNS RCE S Routers Verify yrule signature Follow rule directives R_D Payload D Senders Routers Destinations
41 Rule-Based Forwarding (RBF) Architecture t DNS RCE Packets may contain a return rule S R_S R_D Payload D R_D R_S Payload Senders Routers Destinations
42 Rule-Based Forwarding (RBF) Architecture t Control Plane DNS RCE Distribution Certification Data Plane Senders Routers Destinations
43 Rule-Based Forwarding (RBF) Architecture t Control Plane DNS RCE Distribution Certification Data Plane Senders Routers Destinations
44 RBF Assumptions Anti-spoofing mechanism Ingress filtering Existence of Rule Certifying Entities and distribution of RCE keys to routers RCEs few largeverisign-like like entities or AS based Rule distribution (DNS) well provisioned against DDoS u e st but o ( S) we p ov s o e aga st os attacks
45 Outline Motivation & Solution Overview Rule-Based Forwarding Architecture Overview Rule Forwarding Mechanism & Examples Evaluation
46 RBF Mechanism Specification Rule: sequence of actions conditioned by if-then-else statements if(<condition>) ACTION1 else ACTION2 Conditions: comparison operations on packet header & router state (attributes)
47 RBF Mechanism Actions Rule actions are: 1. Modify packet header (attributes) 2. Drop packet 3. Forward packet (destination / next waypoint) 4. Invoke upper layer functionality (if available)
48 Rule Forwarding Mechanism Current IP routers IP Forwarding FIB IP
49 Rule Forwarding Mechanism RBF routers New forwarding layer Rule Forwarding IP Forwarding Router Attributes FIB RBF IP
50 Rule Forwarding Mechanism RBF routers IDS Multic cast Cachin ng Specialized forwarding functions (optional) New forwarding layer Rule Forwarding IP Forwarding Router Attributes FIB RBF IP
51 Rule Forwarding Mechanism IDS Multic cast Cachin ng Controlled by ISPs and middlebox owners Rule Forwarding Router Attributes IP Forwarding FIB
52 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rule Forwarding IP Forwarding Router Attributes FIB Examples: router s address queue size availability of specialized function
53 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rules cannot modify router attributes Rule Forwarding IP Forwarding Router Attributes FIB Examples: router s address queue size availability of specialized function
54 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rule Forwarding Router Attributes IP Forwarding FIB 5 tuple Abit Arbitrary semantics (e.g., middlebox was visited) Rule Attributes 1 Payload
55 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rule Forwarding Router Attributes Rules can modify packet attributes IP Forwarding FIB 5 tuple Abit Arbitrary semantics (e.g., middlebox was visited) Rule Attributes 1 Payload
56 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rule Attributes 1 Payload Rule Forwarding IP Forwarding Router Attributes FIB
57 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rule can: 1. Modify packet attributes Rule Attributes 12 Payload Rule Forwarding IP Forwarding Router Attributes FIB
58 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rule can: 1. Modify packet attributes Rule Attributes 2 Payload Rule Forwarding IP Forwarding Router Attributes FIB Example: if(router.congestion > pkt.max_congestion) pkt.max_congestion = router.congestion sendto D
59 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rule can: 1. Modify packet attributes Rule Attributes 2 Payload Rule Forwarding Router Attributes 2. Drop packet IP Forwarding FIB
60 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rule can: 1. Modify packet attributes Rule Attributes 2 Payload Rule Forwarding Router Attributes 2. Drop packet IP Forwarding FIB Example: if(pkt.source!= S) drop sendto D
61 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rule can: 1. Modify packet attributes Rule Attributes 2 Payload Rule Forwarding IP Forwarding Router Attributes FIB 2. Drop packet 3. Forward Rule Attributes 2 Payload
62 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rule can: 1. Modify packet attributes Rule Attributes 2 Payload Rule Forwarding IP Forwarding Router Attributes FIB 2. Drop packet 3. Forward Example: sendto D Rule Attributes 2 Payload
63 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rule can: 1. Modify packet attributes Rule Attributes 2 Payload Rule Forwarding IP Forwarding Router Attributes FIB 2. Drop packet 3. Forward 4. Invoke
64 Rule Forwarding Mechanism IDS Multic cast Cachin ng Rule can: 1. Modify packet attributes Rule Attributes 2 Payload Rule Forwarding IP Forwarding Router Attributes FIB 2. Drop packet 3. Forward Example: if(router.has_caching == TRUE) invoke CachingFunc sendto D 4. Invoke
65 RBF Mechanism Rule Lease Each rule has an associated lease period Routers drop expired rules
66 Examples Waypoint R_D: Go to R1 before reaching D R1 S D
67 Examples Waypoint R_D: if(packet.been_to_r1 to == 0) if(router.address!= R1) sendto R1 else packet.been_to_r1 to = 1 if(packet.been_to_r1 == 1) sendto D R1 S D
68 Examples Waypoint R_D: if(packet.been_to_r1 to == 0) if(router.address!= R1) sendto R1 else packet.been_to_r1 to = 1 if(packet.been_to_r1 == 1) sendto D Packet attribute indicating whether h packet has visited i R1 S R1 R_D been_to_r1 = 0 D
69 Examples Waypoint R_D: if(packet.been_to_r1 to == 0) if(router.address!= R1) sendto R1 else packet.been_to_r1 to = 1 if(packet.been_to_r1 == 1) sendto D Before waypoint R1 S R1 R_D been_to_r1 = 0 D
70 Examples Waypoint R_D: if(packet.been_to_r1 to == 0) if(router.address!= R1) sendto R1 else packet.been_to_r1 to = 1 if(packet.been_to_r1 == 1) sendto D At the waypoint S R1 R_D been_to_r1 = 1 D
71 Examples Waypoint R_D: if(packet.been_to_r1 to == 0) if(router.address!= R1) sendto R1 else packet.been_to_r1 to = 1 if(packet.been_to_r1 == 1) sendto D After the waypoint R1 S R_D been_to_r1 = 1 D
72 Examples Middlebox R_D: if(packet.been_to_r1 to == 0) if(router.address!= R1) sendto R1 else packet.been_to_r1 = 1 invoke IDS_func if(packet.been_to_r1 _ == 1) sendto D R1 IDS functionality Addition to the waypoint rule S D
73 Examples Secure Middlebox R_D: if(packet.been_to_r1 to == 0) if(router.address!= R1) sendto R1 else packet.been_to_r1 = 1 invoke IDS_func if(packet.been_to_r1 _ == 1) sendto D R1 Malicious user could set the packet attributes so that packet appears to have visited the middlebox S R_D been_to_r1 _ = 1 D
74 Examples Secure Middlebox (1) R_D: if(packet.been_to_r1 to == 0) if(router.address!= R1) sendto R1 else packet.been_to_r1 = 1 packet.source = R1 invoke IDS_func if(packet.been_to_r1 == 1) if(packet.source == R1) sendto D Allow only packets from R1 when state equals 1 Anti-spoofing does not allow spoofing the source attribute
75 Examples Secure Middlebox (2) R_D: if(packet.been_to_r1 to == 0) if(router.address!= R1) sendto R1 else packet.been_to_r1 = 1 invoke Crypto_proof if(packet.been_to_r1 _ == 1) packet. been_to_r1 = 2 invoke IDS_func if(packet.been_to_r1 == 2) if(router.address!= D) sendto D else invoke Verify_and_Deliver Invoke functionality to (cryptographically) prove packet visited middlebox Invoke functionality to verify the middlebox proofs at D
76 Examples Conditioned Middlebox R_D: if(packet.dest_port port == 80) sendto D else //Middlebox rule... Use the Middlebox only for packets not destined to port 80 IDS S Port!= 80 Port = 80 D
77 Examples DoS protection Create capability-like rules, e.g., for a client with address S R_S_D: if(packet.source!= S) drop sendto D
78 Examples DoS protection Create capability-like rules, e.g., for a client with address S R_S_D: if(packet.source!= S) drop sendto D D can control number of simultaneous clients by controlling number of authorized rules (a rule for each client)
79 Examples DoS protection Create capability-like rules, e.g., for a client with address S R_S_D: if(packet.source!= S) drop sendto D D can control number of simultaneous clients by controlling number of authorized rules (a rule for each client) Need to grant rules on demand Dynamic (vs. static DNS) Provision this service against DDoS (denial of rule) DNS redirects to third parties providing this service
80 RBF Examples Filter ports/prefixes only receive specific traffic Protect t against DoS attacks Mobility Middleboxes Secure loose path forwarding select provider, reliability Multiple paths Anycast Record path state network probing, ECN, path identifier On-path redirection Delay Tolerant Networks Use on-path router functions deployed by ISPs Multicast, caching, WAN optimizers, content-routing, energy efficiency...
81 Rule Properties 1. Flexible
82 Rule Properties 1. Flexible Rules enable endpoints to: a) Block unwanted packets in the network b) Control path selection using waypoints c) Use router state in forwarding decisions and record this state d) Use specialized functions at middleboxes and routers, if available
83 Rule Properties 1. Flexible 2. Policy Compliant
84 Rule Properties 1. Flexible 2. Policy Compliant Rules are certified by trusted entities Rule Certifying Entities (RCEs) Rules are above routing-controlled layer IP Route discovery and computation fully controlled by ISPs
85 Rule Properties 1. Flexible 2. Policy Compliant 3. Safe
86 Rule Properties 1. Flexible 2. Policy Compliant 3. Safe Bounded forwarding time No loops, only comparison operations, cannot modify payload Cannot modify router state Cannot amplify traffic No network loops (static analysis), cannot replicate packets Invoked functions are fully controlled by ISPs/Mbox owners Resource isolation and access control to prevent attacks Rules merely offer a (policy compliant) mechanism to use them
87 Related Work 1. Flexibility 2. Policy-Compliance 3. Some of each
88 Related Work 1. Flexibility Active Networks, ESP, Overlays (e.g., i3, DOA), Loose path forwarding, DTN, Mobility (e.g., Mobile IP, HIP), Multiple paths (e.g., g, MIRO), etc. Rules vs. Active Networks: Forwarding directives vs. programs Safe and statically analyzable Policy-compliance for multiple-parties Allow invoking ISP deployed functions for processing
89 Related Work 1. Flexibility 2. Policy-Compliance In-network filters (PushBack, AITF, StopIt, PredicateRouting, Off-by-default), Network Capabilities (TVA, SIFF) RBF: Adds flexibility Adds multi-party policy compliance
90 Related Work 1. Flexibility 2. Policy-Compliance 3. Some of each E.g. Platypus, NUTSS, ICING enable policy-compliant source routing RBF: Generalizes flexibility Enables richer policies based on entire forwarding behavior
91 Outline Motivation & Solution Overview Rule-Based Forwarding Architecture Overview Rule Forwarding Mechanism & Examples Evaluation
92 Evaluation Questions Size overhead of rules Forwarding overhead Fast path (no rule verification) Slow path (involves rule verification) Performance isolation between invoked functions and forwarding Load on RCEs Security analysis
93 Evaluation Questions Size overhead of rules Forwarding overhead Fast path (no rule verification) Slow path (involves rule verification) Performance isolation between invoked functions and forwarding Load on RCEs Security analysis
94 Evaluation Rule Sizes Byte es Rule Encoding Control Signature
95 Evaluation Rule Sizes Byte es Rule Encoding Control Signature Overhead of one rule is ~ bytes 0
96 Evaluation Rule Sizes Byte es Rule Encoding Control Signature Average 85 bytes: 13% average Internet t packet (630B) 0
97 Evaluation Rule Sizes Byte es Rule Encoding Control Signature Average 85 bytes: 13% average Internet t packet (630B) 0 27% if using RSA signatures
98 Evaluation Prototype RBF Router Software router on top of RouteBricks [SOSP 2009] 8 core Nehalem server, 2 dual-port NICs Example router setup: Kernel Kernel User level RBF + IP RBF + IP RBF + IP RBF + IP Memory controller Memory controller Firewa all Multica ast Firewa all Multica ast IDS Cachin ng IDS Cacnin ng Cache Cache CPU Cores Socket 0 Socket 1
99 Gbp ps Evaluation Forwarding Using Rules No signature verification, using all 8 cores RBF over RouteBricks RouteBricks alone
100 Evaluation Forwarding Using Rules Gbp ps RBF over RouteBricks RouteBricks alone Rule forwarding incurs little overhead on Routebricks
101 Evaluation Forwarding Using Rules Gbp ps RBF over RouteBricks RouteBricks alone No overhead for packets > 500B
102 Evaluation Forwarding Using Rules Gbp ps RBF over RouteBricks RouteBricks alone Soft router RBF can forward 35Gbps real traffic
103 Evaluation Signature Verification Only at trust boundary routers (lower traffic than core) Result can be cached Cache is small (e.g., 19 bytes/rule) and exact match lookup Packets from new flows represent 1% of backbone link capacity on average, worst case 5% of packets Doable with existing hardware (crypto processors, ASICs) 10% slow down on prototype router with RSA signatures & real traffic Can be parallelized!
104 Summary RBF flexible and policy compliant architecture Packets carry rules Rule contains forwarding directives Flexible: if-then-else conditions on packet & router attributes, modify packet header and use in-network functions Policy-compliant: signed by third parties RCEs Safe: cannot corrupt routers or amplify traffic
Rule based Forwarding (RBF): improving the Internet s flexibility and security. Lucian Popa, Ion Stoica, Sylvia Ratnasamy UC Berkeley Intel Labs
Rule based Forwarding (RBF): improving the Internet s flexibility and security Lucian Popa, Ion Stoica, Sylvia Ratnasamy UC Berkeley Intel Labs Motivation Improve network s flexibility Middlebox support,
Building Extensible Networks with Rule-Based Forwarding
Building Extensible Networks with Rule-Based Forwarding Lucian Popa Norbert Egi Sylvia Ratnasamy Ion Stoica Abstract We present a network design that provides flexible and policy-compliant forwarding.
Rule-based Forwarding (RBF): improving the Internet s flexibility and security
1 Introduction Rule-based Forwarding (RBF): improving the Internet s flexibility and security Lucian Popa Ion Stoica Sylvia Ratnasamy From active networks [33] to the more recent efforts on GENI [5], a
A Policy Framework for a Secure
A Policy Framework for a Secure Future Internet Jad Naous(Stanford University) Arun Seehra(UT Austin) Michael Walfish(UT Austin) David Mazières(Stanford University) Antonio Nicolosi(Stevens Institute of
Internet Indirection Infrastructure (i3)
Internet Indirection Infrastructure (i3) Ion Stoica UC Berkeley March 20, 2003 The Problem Indirection: a key technique in implementing many network services, e.g., Mobility Multicast, anycast Web caching,
To Filter or to Authorize: Network-Layer DoS Defense against Multimillion-node Botnets. Xiaowei Yang Duke Unversity
To Filter or to Authorize: Network-Layer DoS Defense against Multimillion-node Botnets Xiaowei Yang Duke Unversity Denial of Service (DoS) flooding attacks Send packet floods to a targeted victim Exhaust
Secure Neighbor Discovery. By- Pradeep Yalamanchili Parag Walimbe
Secure Neighbor Discovery By- Pradeep Yalamanchili Parag Walimbe Overview Neighbor Discovery Protocol (NDP) Main Functions of NDP Secure Neighbor Discovery (SEND) Overview Types of attacks. NDP Nodes on
Forwarding Architecture
Forwarding Architecture Brighten Godfrey CS 538 February 14 2018 slides 2010-2018 by Brighten Godfrey unless otherwise noted Building a fast router Partridge: 50 Gb/sec router A fast IP router well, fast
SafeBricks: Shielding Network Functions in the Cloud
SafeBricks: Shielding Network Functions in the Cloud Rishabh Poddar, Chang Lan, Raluca Ada Popa, Sylvia Ratnasamy UC Berkeley Network Functions (NFs) in the cloud Clients 2 Enterprise Destination Network
RouteBricks: Exploiting Parallelism To Scale Software Routers
outebricks: Exploiting Parallelism To Scale Software outers Mihai Dobrescu & Norbert Egi, Katerina Argyraki, Byung-Gon Chun, Kevin Fall, Gianluca Iannaccone, Allan Knies, Maziar Manesh, Sylvia atnasamy
And Then There Were More:
David Naylor Carnegie Mellon And Then There Were More: Secure Communication for More Than Two Parties Richard Li University of Utah Christos Gkantsidis Microsoft Research Thomas Karagiannis Microsoft Research
Host Identity Indirection Infrastructure Hi 3. Jari Arkko, Pekka Nikander and Börje Ohlman Ericsson Research
Host Identity Indirection Infrastructure Hi 3 Jari Arkko, Pekka Nikander and Börje Ohlman Ericsson Research Presentation outline Motivation Background Secure i 3 Hi 3 Summary 2 Hi 3 motivation Question:
PacketShader: A GPU-Accelerated Software Router
PacketShader: A GPU-Accelerated Software Router Sangjin Han In collaboration with: Keon Jang, KyoungSoo Park, Sue Moon Advanced Networking Lab, CS, KAIST Networked and Distributed Computing Systems Lab,
Abstrac(ons for Middleboxes. à StonyBrook
Abstrac(ons for Middleboxes Vyas Sekar Intel Labs à StonyBrook Sylvia Ratnasamy UC Berkeley 1 Need for In- Network Func(ons Changing applica(ons Evolving threats Performance Security Compliance Policy
Extensible Routers. Jeff Chase Duke University
Extensible Routers Jeff Chase Duke University Motivation We ve looked at many different proposals for router extensions and changes. There are many others (multicast, anycast, IPv6) There are huge obstacles
TVA: A DoS-limiting Network Architecture L
DoS is not even close to be solved : A DoS-limiting Network Architecture L Xiaowei Yang (UC Irvine) David Wetherall (Univ. of Washington) Thomas Anderson (Univ. of Washington) 1 n Address validation is
Protecting Network Quality of Service Against Denial of Service Attacks
Protecting Network Quality of Service Against Denial of Service Attacks Douglas S. Reeves Peter Wurman NC State University S. Felix Wu U.C. Davis Dan Stevenson Xiaoyong Wu MCNC DARPA FTN PI Meeting January
Embark: Securely Outsourcing Middleboxes to the Cloud
Embark: Securely Outsourcing Middleboxes to the Cloud Chang Lan, Justine Sherry, Raluca Ada Popa, Sylvia Ratnasamy, Zhi Liu UC Berkeley Tsinghua University 1 Background Middleboxes are prevalent and problematic
Virtual Private Networks
EN-2000 Reference Manual Document 8 Virtual Private Networks O ne of the principal features of routers is their support of virtual private networks (VPNs). This document discusses transmission security,
CS 356 Internet Security Protocols. Fall 2013
CS 356 Internet Security Protocols Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5
CPS 510 final exam, 4/27/2015
CPS 510 final exam, 4/27/2015 Your name please: This exam has 25 questions worth 12 points each. For each question, please give the best answer you can in a few sentences or bullets using the lingo of
Last time. Security Policies and Models. Trusted Operating System Design. Bell La-Padula and Biba Security Models Information Flow Control
Last time Security Policies and Models Bell La-Padula and Biba Security Models Information Flow Control Trusted Operating System Design Design Elements Security Features 10-1 This time Trusted Operating
Fundamental Questions to Answer About Computer Networking, Jan 2009 Prof. Ying-Dar Lin,
Fundamental Questions to Answer About Computer Networking, Jan 2009 Prof. Ying-Dar Lin, ydlin@cs.nctu.edu.tw Chapter 1: Introduction 1. How does Internet scale to billions of hosts? (Describe what structure
Extensible Network Security Services on Software Programmable Router OS. David Yau, Prem Gopalan, Seung Chul Han, Feng Liang
Extensible Network Security Services on Software Programmable Router OS David Yau, Prem Gopalan, Seung Chul Han, Feng Liang System Software and Architecture Lab Department of Computer Sciences Purdue University
Understanding Layer 2 Encryption
Understanding Layer 2 Encryption TECHNICAL WHITEPAPER Benefits of Layer 2 Encryption Lowest cost of ownership Better bandwith efficiency (up to 50%) Minimal ongoing maintenance routing updates transparent
The Design Space of Network Mobility
The Design Space of Network Mobility Key ideas Network Mobility Seamless Mobility Overview of implementations and challenges Geomorphic model New abstraction for the network stack Helps us discuss, understand
HIP Host Identity Protocol. October 2007 Patrik Salmela Ericsson
HIP Host Identity Protocol October 2007 Patrik Salmela Ericsson Agenda What is the Host Identity Protocol (HIP) What does HIP try to solve HIP basics Architecture The HIP base exchange HIP basic features
Power Management for Networked Systems
Power Management for Networked Systems Sylvia Ratnasamy (Intel Research Berkeley) Work in collaboration with UC Berkeley, Univ. of Washington and Lawrence Berkeley National Lab How do networks contribute
Open vswitch Extensions with BPF
Open vswitch Extensions with BPF Paul Chaignon Orange Labs, France December 5, 2018 Open vswitch Fall Conference 2018 Not a New Datapath! Previous and next talks on new I/O techniques for OVS 1/19 Open
Protocol for Tetherless Computing
Protocol for Tetherless Computing S. Keshav P. Darragh A. Seth S. Fung School of Computer Science University of Waterloo Waterloo, Canada, N2L 3G1 1. Introduction Tetherless computing involves asynchronous
lecture 18: network virtualization platform (NVP) 5590: software defined networking anduo wang, Temple University TTLMAN 401B, R 17:30-20:00
lecture 18: network virtualization platform (NVP) 5590: software defined networking anduo wang, Temple University TTLMAN 401B, R 17:30-20:00 Network Virtualization in multi-tenant Datacenters Teemu Koponen.,
T Computer Networks II. Mobility Issues Contents. Mobility. Mobility. Classifying Mobility Protocols. Routing vs.
T-0.50 Computer Networks II Mobility Issues 6.0.008 Overview Mobile IP NEMO Transport layer solutions i SIP mobility Contents Prof. Sasu Tarkoma Mobility What happens when network endpoints start to move?
Our Narrow Focus Computer Networking Security Vulnerabilities. Outline Part II
Our Narrow Focus 15-441 15-441 Computer Networking 15-641 Lecture 22 Security: DOS Peter Steenkiste Fall 2016 www.cs.cmu.edu/~prs/15-441-f16 Yes: Creating a secure channel for communication (Part I) Protecting
Network Security. Thierry Sans
Network Security Thierry Sans HTTP SMTP DNS BGP The Protocol Stack Application TCP UDP Transport IPv4 IPv6 ICMP Network ARP Link Ethernet WiFi The attacker is capable of confidentiality integrity availability
IP Security. Have a range of application specific security mechanisms
IP Security IP Security Have a range of application specific security mechanisms eg. S/MIME, PGP, Kerberos, SSL/HTTPS However there are security concerns that cut across protocol layers Would like security
NetBricks: Taking the V out of NFV. Aurojit Panda, Sangjin Han, Keon Jang, Melvin Walls, Sylvia Ratnasamy, Scott Shenker UC Berkeley, Google, ICSI
NetBricks: Taking the V out of NFV Aurojit Panda, Sangjin Han, Keon Jang, Melvin Walls, Sylvia Ratnasamy, Scott Shenker UC Berkeley, Google, ICSI What the heck is NFV? A Short Introduction to NFV A Short
this security is provided by the administrative authority (AA) of a network, on behalf of itself, its customers, and its legal authorities
INFRASTRUCTURE SECURITY this security is provided by the administrative authority (AA) of a network, on behalf of itself, its customers, and its legal authorities Goals * prevent or mitigate resource attacks
Distributed Systems. 27. Firewalls and Virtual Private Networks Paul Krzyzanowski. Rutgers University. Fall 2013
Distributed Systems 27. Firewalls and Virtual Private Networks Paul Krzyzanowski Rutgers University Fall 2013 November 25, 2013 2013 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive
OpenADN: A Case for Open Application Delivery Networking
OpenADN: A Case for Open Application Delivery Networking Subharthi Paul, Raj Jain, Jianli Pan Washington University in Saint Louis {Pauls, jain, jp10}@cse.wustl.edu International Conference on Computer
Lecture 10. Denial of Service Attacks (cont d) Thursday 24/12/2015
Lecture 10 Denial of Service Attacks (cont d) Thursday 24/12/2015 Agenda DoS Attacks (cont d) TCP DoS attacks DNS DoS attacks DoS via route hijacking DoS at higher layers Mobile Platform Security Models
QUIZ: Longest Matching Prefix
QUIZ: Longest Matching Prefix A router has the following routing table: 10.50.42.0 /24 Send out on interface Z 10.50.20.0 /24 Send out on interface A 10.50.24.0 /22 Send out on interface B 10.50.20.0 /22
Hybrid Information-Centric Networking
Hybrid Information-Centric Networking ICN inside the Internet Protocol Luca Muscariello, Principal Engineer Giovanna Carofiglio, Distinguished Engineer Jordan Augé, Michele Papalini, Mauro Sardara, Alberto
Int ernet w orking. Internet Security. Literature: Forouzan: TCP/IP Protocol Suite : Ch 28
Int ernet w orking Internet Security Literature: Forouzan: TCP/IP Protocol Suite : Ch 28 Internet Security Internet security is difficult Internet protocols were not originally designed for security The
Internet Indirection Infrastructure
Motivations Internet Indirection Infrastructure Modified version of Ion Stoica s talk at ODU Nov 14, 05 Today s Internet is built around a unicast point-to-point communication abstraction: Send packet
CIS 6930/4930 Computer and Network Security. Topic 8.1 IPsec
CIS 6930/4930 Computer and Network Security Topic 8.1 IPsec 1 IPsec Objectives Why do we need IPsec? IP V4 has no authentication IP spoofing Payload could be changed without detection. IP V4 has no confidentiality
Ethane: taking control of the enterprise
Ethane: taking control of the enterprise Martin Casado et al Giang Nguyen Motivation Enterprise networks are large, and complex, and management is distributed. Requires substantial manual configuration.
Interdomain Routing Design for MobilityFirst
Interdomain Routing Design for MobilityFirst October 6, 2011 Z. Morley Mao, University of Michigan In collaboration with Mike Reiter s group 1 Interdomain routing design requirements Mobility support Network
CSE398: Network Systems Design
CSE398: Network Systems Design Instructor: Dr. Liang Cheng Department of Computer Science and Engineering P.C. Rossin College of Engineering & Applied Science Lehigh University March 14, 2005 Outline Classification
VPN World. MENOG 16 Istanbul-Turkey. By Ziad Zubidah Network Security Specialist
VPN World MENOG 16 Istanbul-Turkey By Ziad Zubidah Network Security Specialist What is this Van used for?! Armed Van It used in secure transporting for valuable goods from one place to another. It is bullet
Networking interview questions
Networking interview questions What is LAN? LAN is a computer network that spans a relatively small area. Most LANs are confined to a single building or group of buildings. However, one LAN can be connected
Internet Indirection Infrastructure. Karthik Lakshminarayanan UC Berkeley
Internet Indirection Infrastructure Karthik Lakshminarayanan UC Berkeley Contrasting LNA, HIP, and i3 LNA = Layered Naming Architecture LNA, HIP, i3: All network architecture proposals Separate location
Open Systems Interconnection (OSI) Routing Protocol
CHAPTER 41 Open Systems Interconnection (OSI) Protocol Background The International Organization for Standardization (O) developed a complete suite of routing protocols for use in the Open Systems Interconnection
Internet Indirection Infrastructure (i3) Ion Stoica, Daniel Adkins, Shelley Zhuang, Scott Shenker, Sonesh Surana. UC Berkeley SIGCOMM 2002
Internet Indirection Infrastructure (i3) Ion Stoica, Daniel Adkins, Shelley Zhuang, Scott Shenker, Sonesh Surana UC Berkeley SIGCOMM 2002 Motivations Today s Internet is built around a unicast pointto-point
OS Security IV: Virtualization and Trusted Computing
1 OS Security IV: Virtualization and Trusted Computing Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab2 More questions? 3 Virtual machine monitor +-----------+----------------+-------------+
DYNAMIC SERVICE CHAINING DYSCO WITH. forcing packets through middleboxes for security, optimizing performance, enhancing reachability, etc.
DYNAMIC SERVICE CHAINING WITH DYSCO forcing packets through es for security, optimizing performance, enhancing reachability, etc. Pamela Zave AT&T Labs Research Ronaldo A. Ferreira UFMS, Brazil Xuan Kelvin
(a) Which of these two conditions (high or low) is considered more serious? Justify your answer.
CS140 Winter 2006 Final Exam Solutions (1) In class we talked about the link count in the inode of the Unix file system being incorrect after a crash. The reference count can either be either too high
DDoS made easy. IP reflection attacks for fun and profit. Gert Döring, SpaceNet AG, München. DECIX/ECO security event,
DDoS made easy IP reflection attacks for fun and profit Gert Döring, SpaceNet AG, München DECIX/ECO security event, 04.12.14, Frankfurt Agenda what are IP reflection attacks? why are they so effective
Control Plane Security Overview
Control Plane Security Overview Wes Doonan Control Plane R&D Hybrid Networks Packet-based Delivery ( ) Packets delivered via standard IP infrastructure Routes configured or learned, packets forwarded per
EECS 122: Introduction to Computer Networks Switch and Router Architectures. Today s Lecture
EECS : Introduction to Computer Networks Switch and Router Architectures Computer Science Division Department of Electrical Engineering and Computer Sciences University of California, Berkeley Berkeley,
Unicast Reverse Path Forwarding Loose Mode
The feature creates a new option for Unicast Reverse Path Forwarding (Unicast RPF), providing a scalable anti-spoofing mechanism suitable for use in multihome network scenarios. This mechanism is especially
Overview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet. SSL ensures the secure transmission of data between a client and a server through
Your projected and optimistically projected grades should be in the grade center soon o Projected: Your current weighted score /30 * 100
You should worry if you are below this point Your projected and optimistically projected grades should be in the grade center soon o Projected: Your current weighted score /0 * 100 o Optimistic: (Your
LECTURE 8. Mobile IP
1 LECTURE 8 Mobile IP What is Mobile IP? The Internet protocol as it exists does not support mobility Mobile IP tries to address this issue by creating an anchor for a mobile host that takes care of packet
NIST SP : Guidelines for the Secure Deployment of IPv6
NIST SP 800-119: Guidelines for the Secure Deployment of IPv6 Sheila Frankel Computer Security Division NIST sheila.frankel@nist.gov US Government IPv6 Directives: Office of Management and Budget (OMB)
Stratum Filtering for DDoS Resilient Clouds
Stratum Filtering for DDoS Resilient Clouds Michael Waidner Joint work with Amir Herzberg and Haya Shulman A CRISP Member 8rd ACM Cloud Computing Security Workshop Vienna,
Survey of Cyber Moving Targets. Presented By Sharani Sankaran
Survey of Cyber Moving Targets Presented By Sharani Sankaran Moving Target Defense A cyber moving target technique refers to any technique that attempts to defend a system and increase the complexity of
CSE 461 MIDTERM REVIEW
CSE 461 MIDTERM REVIEW NETWORK LAYERS & ENCAPSULATION Application Application Transport Transport Network Network Data Link/ Physical Data Link/ Physical APPLICATION LAYER Application Application Used
Page 1. Quality of Service. CS 268: Lecture 13. QoS: DiffServ and IntServ. Three Relevant Factors. Providing Better Service.
Quality of Service CS 268: Lecture 3 QoS: DiffServ and IntServ Ion Stoica Computer Science Division Department of Electrical Engineering and Computer Sciences University of California, Berkeley Berkeley,
Internet Control Message Protocol
Internet Control Message Protocol The Internet Control Message Protocol is used by routers and hosts to exchange control information, and to inquire about the state and configuration of routers and hosts.
OCALA Overlay Convergence Architecture for supporting Legacy Applications on Overlays
OCALA Overlay Convergence Architecture for supporting Legacy Applications on Overlays Dilip Antony Joseph 1, Jayanth Kannan 1, Ayumu Kubota 2, Karthik Lakshminarayanan 1, Ion Stoica 1, Klaus Wehrle 3 1
Application Firewalls
Application Moving Up the Stack Advantages Disadvantages Example: Protecting Email Email Threats Inbound Email Different Sublayers Combining Firewall Types Firewalling Email Enforcement Application Distributed
Monitoring the Device
The system includes dashboards and an Event Viewer that you can use to monitor the device and traffic that is passing through the device. Enable Logging to Obtain Traffic Statistics, page 1 Monitoring
Exam : Title : Security Solutions for Systems Engineers. Version : Demo
Exam : 642-566 Title : Security Solutions for Systems Engineers Version : Demo 1. Which one of the following elements is essential to perform events analysis and correlation? A. implementation of a centralized
Sleep/Wake Aware Local Monitoring (SLAM)
Sleep/Wake Aware Local Monitoring (SLAM) Issa Khalil, Saurabh Bagchi, Ness Shroff Dependable Computing Systems Lab (DCSL) & Center for Wireless Systems and Applications (CWSA) School of Electrical and
Host Identity Protocol, PLA, and PSIRP
Contents Host Identity Protocol, PLA, and PSIRP Prof. Sasu Tarkoma 23.02.2009 Introduction Current state Host Identity Protocol (HIP) Packet Level Authentication (PLA) Overlays (i3 and Hi3) Clean-slate
IPv6: An Introduction
Outline IPv6: An Introduction Dheeraj Sanghi Department of Computer Science and Engineering Indian Institute of Technology Kanpur dheeraj@iitk.ac.in http://www.cse.iitk.ac.in/users/dheeraj Problems with
Data Plane Protection. The googles they do nothing.
Data Plane Protection The googles they do nothing. Types of DoS Single Source. Multiple Sources. Reflection attacks, DoS and DDoS. Spoofed addressing. Can be, ICMP (smurf, POD), SYN, Application attacks.
Proposal of an IP QoS framework:
Proposal of an IP QoS framework: Scalable Services - ScalServ Jaime Dias, Manuel Ricardo ScalServ - Classes of Service Application real-time elastic Best Effort () reference service. Majority of the applications
Implemen'ng IPv6 Segment Rou'ng in the Linux Kernel
Implemen'ng IPv6 Segment Rou'ng in the Linux Kernel David Lebrun, Olivier Bonaventure ICTEAM, UCLouvain Work supported by ARC grant 12/18-054 (ARC-SDN) and a Cisco grant Agenda IPv6 Segment Rou'ng Implementa'on
AccessEnforcer Version 4.0 Features List
AccessEnforcer Version 4.0 Features List AccessEnforcer UTM Firewall is the simple way to secure and manage your small business network. You can choose from six hardware models, each designed to protect
SR for SD-WAN over hybrid networks
SR for SD-WAN over hybrid networks to optimize SD-WAN services over long distance https://datatracker.ietf.org/doc/draft-dunbar-sr-sdwan-over-hybrid-networks/ Linda.Dunbar@Huawei.com Mehmet.toy@Verizon
Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE i, IEEE 802.1X P2.
P2 Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE 802.11i, IEEE 802.1X P2.2 IP Security IPsec transport mode (host-to-host), ESP and
Towards an Evolvable Internet Architecture
lthomas@student.ethz.ch December 19, 2007 Topics: Goals: How to evolve from IPv(N-1) to IPvN How to use overlay networks in legacy applications Show some nice ideas for evolvability Describe needed technologies
14. Internet Security (J. Kurose)
14. Internet Security (J. Kurose) 1 Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice: application layer:
Computer Networks. General Course Information. Addressing and Routing. Computer Networks 9/8/2009. Basic Building Blocks for Computer Networks
Outline: Computer Networks Introduction General course information. Some basic concepts for computer s. Network programming. General Course Information Course Web page http://www.cs.rochester.edu/~kshen/csc257-fall2009
Networking: Network layer
control Networking: Network layer Comp Sci 3600 Security Outline control 1 2 control 3 4 5 Network layer control Outline control 1 2 control 3 4 5 Network layer purpose: control Role of the network layer
Cisco Next Generation Firewall Services
Toronto,. CA May 30 th, 2013 Cisco Next Generation Firewall Services Eric Kostlan Cisco Technical Marketing 2011 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 1 Objectives At the
Security-by-Contract for Applications Evolution in Multi-Application Smart Cards
Security-by-Contract for Applications Evolution in Multi-Application Smart Cards Nicola Dragoni ndra@imm.dtu.dk http://www2.imm.dtu.dk/~ndra Embedded Systems Engineering (ESE) Section DTU Informatics Technical
TCP/IP Networking. Training Details. About Training. About Training. What You'll Learn. Training Time : 9 Hours. Capacity : 12
TCP/IP Networking Training Details Training Time : 9 Hours Capacity : 12 Prerequisites : There are no prerequisites for this course. About Training About Training TCP/IP is the globally accepted group
The IP Data Plane: Packets and Routers
The IP Data Plane: Packets and Routers EE 122, Fall 2013 Sylvia Ratnasamy http://inst.eecs.berkeley.edu/~ee122/ Material thanks to Ion Stoica, Scott Shenker, Jennifer Rexford, Nick McKeown, and many other
Internet Indirection Infrastructure
Ke Observation Internet Indirection Infrastructure Virtuall all previous proposals use indirection, e.g., Phsical indirection point mobile IP Logical indirection point IP multicast Ion Stoica UC Berkele
Managing and Securing Computer Networks. Guy Leduc. Chapter 2: Software-Defined Networks (SDN) Chapter 2. Chapter goals:
Managing and Securing Computer Networks Guy Leduc Chapter 2: Software-Defined Networks (SDN) Mainly based on: Computer Networks and Internets, 6 th Edition Douglas E. Comer Pearson Education, 2015 (Chapter
Cryptography and Network Security
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown Chapter 15 Electronic Mail Security Despite the refusal of VADM Poindexter and LtCol North to appear,
19: Networking. Networking Hardware. Mark Handley
19: Networking Mark Handley Networking Hardware Lots of different hardware: Modem byte at a time, FDDI, SONET packet at a time ATM (including some DSL) 53-byte cell at a time Reality is that most networking
CIS Controls Measures and Metrics for Version 7
Level 1.1 Utilize an Active Discovery Tool 1.2 Use a Passive Asset Discovery Tool 1.3 Use DHCP Logging to Update Asset Inventory 1.4 Maintain Detailed Asset Inventory 1.5 Maintain Asset Inventory Information
IPv6 CGAs: Balancing between Security, Privacy and Usability
IPv6 CGAs: Balancing between Security, Privacy and Usability Ahmad Alsadeh Birzeit university 1 Outline IPv6 Configuration IPv6 StateLess Address Auto-Configuration Extended Unique ID (EUI-64) Privacy
Configuring VPN Policies
VPN Configuring VPN Policies Configuring Advanced VPN Settings Configuring DHCP Over VPN Configuring L2TP Server Configuring VPN Policies VPN > Settings VPN Overview Configuring VPNs in SonicOS Configuring
- Hubs vs. Switches vs. Routers -
1 Layered Communication - Hubs vs. Switches vs. Routers - Network communication models are generally organized into layers. The OSI model specifically consists of seven layers, with each layer representing
Access Control Using Intrusion and File Policies
The following topics describe how to configure access control policies to use intrusion and file policies: Intrusions and Malware Inspection Overview, page 1 Access Control Traffic Handling, page 2 File
MODULE: NETWORKS MODULE CODE: CAN1102C. Duration: 2 Hours 15 Mins. Instructions to Candidates:
BSc.(Hons) Computer Science with Network Security BEng (Hons) Telecommunications Cohort: BCNS/17B/FT Examinations for 2017-2018 / Semester 2 Resit Examinations for BCNS/15A/FT, BTEL/15B/FT & BTEL/16B/FT