ing: Application layer Comp Sci 3600 Security
Outline 1 2 3 4 5 6 7
Classic text-based that became popular in the 1970s and 1980s: text email, remote access to computers, file transfers, and newsgroups. Killer application of the mid-1990s, the World Wide Web, encompassing Web surfing, search, and electronic commerce. Instant messaging and file sharing, the two killer introduced at the end of the millennium. Since 2000, voice-over-ip (VoIP), YouTube, Netflix, World of Warcraft, Facebook, and Twitter,
End system at application layer
Goal: write programs that: run on (different) end systems communicate over network e.g., web server software communicates with browser software no need to write software for network-core devices network-core devices do not run user on end systems allows for rapid app development, propagation
Client-server versus peer-to-peer ()
Client-server architecture Server Always-on host, called the server, which requests from many other hosts, called clients. permanent IP address Web server requests from browsers running on client hosts. When a Web server receives a request for an object from a client host, it responds by sending the requested object to the client host. Client communicate with server may be intermittently connected may have dynamic IP addresses do not communicate directly with each other
architecture minimal (or no) reliance on dedicated servers in data centers. direct between pairs of intermittently connected hosts, called peers. The peers are not owned by the service provider, but are instead desktops and laptops controlled by users, with most of the peers residing in homes, universities, and offices. self-scalability: each peer adds service capacity to the system by distributing files to other peers. cost effective, since they normally don t require significant server infrastructure and server bandwidth (in contrast with clients-server designs with datacenters) Peers often exchange IP addresses
Outline 1 2 3 4 5 6 7
via sockets
es Not actually programs, but processes that communicate. is a program that is running within an end system. When processes are running on the same end system, they can communicate with each other with interprocess es on two different end systems communicate with each other by exchanging messages across the computer network. A sending process creates and sends messages into the network a receiving process receives these messages and possibly responds by sending messages back. that initiates the (that is, initially contacts the other process at the beginning of the session) is labeled as the client. The process that waits to be contacted to begin the session is the server.
s Any message sent from one process to another must go through the underlying network. A process sends messages into, and receives messages from, the network through a software interface called a socket. socket is the interface between the application layer and the transport layer within a host. It is also referred to as the Application Programming Inter- face (API) between the application and the network, since the socket is the interface with which network are built.
Addresses In order for a process running on one host to send packets to a process running on another host, the receiving process needs to have an address with: address of the host identifier that specifies the receiving process in the destination host
Hosts are identified by IP address IP address is a 32-bit quantity uniquely identifying the host. the sending process must also identify the receiving process (more specifically, the receiving socket) running in the host. This information is needed because in general a host could be running many network. A destination port number serves this purpose. Popular have been assigned specific port numbers, e.g., a Web server is identified by port number 80. A mail server process (using the protocol) is identified by port number 25.
Outline 1 2 3 4 5 6 7
Service requirements for?
Applications usually choose between and and are transport layer, and are employed by most application layer programs Other layer exist: SCTP (stream control transmission protocol), SSU (I2P app), DCCP, R, -lite, etc An application designer could design their own transport layer protocol, since layer and up runs on end hosts, as opposed to network infrastructure.
is a Connection-oriented service has the client and server exchange transport-layer control information with each other before the application-level messages begin to flow. This so-called handshaking procedure alerts the client and server, allowing them to prepare for an onslaught of packets. After the handshaking phase, a connection is said to exist between the sockets of the two processes. The connection is a full-duplex connection in that the two processes can send messages to each other over the connection at the same time. When the application finishes sending messages, it must tear down the connection.
has a Reliable data transfer service The communicating processes can rely on to deliver all data sent without error and in the proper order.
also includes a congestion-control mechanism The congestion-control mechanism throttles a sending process (client or server) when the network is congested between sender and receiver.
is a no-frills, lightweight transport protocol, providing minimal. is connectionless, so there is no handshaking before the two processes start to communicate. provides an unreliable data transfer service when a process sends a message into a socket, provides no guarantee that the message will ever reach the receiving process. messages that do arrive at the receiving process may arrive out of order. does not include a congestion-control mechanism, so the sending side of can attempt to pump data into the layer below (the network layer) at any rate it pleases
Neither base nor provide any encryption Enhancement for, called Secure s Layer (SSL), provides encryption, data integrity, and end-point authentication. SSL is not a third Internet transport protocol, on the same level as and, but an enhancement of, at the application layer. Application needs to include SSL code (existing libraries) in both the client and server sides of the application. SSL has its own socket API that is similar to the traditional socket API. sending process passes cleartext data to the SSL socket; SSL in the sending host then encrypts the data and passes the encrypted data to the socket. encrypted data travels over the Internet to the socket in the receiving process. receiving socket passes the encrypted data to SSL, which decrypts the data. SSL passes the cleartext data through its SSL socket to the receiving process.
layer used
Outline 1 2 3 4 5 6 7
Application An application-layer protocol defines how an application s processes, running on different end systems, pass messages to each other, for example: The types of messages exchanged, for example, request messages and response messages The syntax of the various message types, such as the fields in the message and how the fields are delineated The semantics of the fields, that is, the meaning of the information in the fields Rules for determining when and how a process sends messages and responds to messages
Outline 1 2 3 4 5 6 7
Web server and clients
Web pages A Web page (also called a document) consists of objects. An object is simply a file such as an HTML file, a JPEG image, a Java applet, or a video clip that is addressable by a single URL. If a Web page contains HTML text and five JPEG images, then the Web page has six objects: the base HTML file plus the five images. The base HTML file references the other objects in the page with the objects URLs. Each URL has two components: the hostname of the server that houses the object and the object s path name. For example, the URL http://www.someschool.edu/somedepartment/picture.gif has www.someschool.edu for a hostname and /somedepartment/picture.gif for a path name.
uses (not ) The client first initiates a connection with the server. Once the connection is established, the browser and the server processes access through their socket interfaces. Server sends requested files to clients without storing any state information about the client, a stateless protocol.
Outline 1 2 3 4 5 6 7
Either: Each request/response pair sent over a separate connection (non-persistent connections), or All of the requests and their corresponding responses sent over the same connection (persistent connections)
sequence A base HTML file and 10 JPEG images, and that all 11 of these objects reside on the same server: http://www.someschool.edu/somedepartment/home.index 1 client process initiates a connection to the server www.someschool.edu on port number 80, which is the default port number for. Associated with the connection, there will be a socket at the client and a socket at the server. 2 client sends an request message to the server via its socket. The request message includes the path name /somedepartment/home.index. 3 server process receives the request message via its socket, retrieves the object /somedepartment/home.index from its storage (RAM or disk), encapsulates the object in an response message, and sends the response message to the client via its socket. 4 server process tells to close the connection. (But doesn t actually terminate the connection until it knows for sure that the client has received the response message intact.) 5 client receives the response message. The connection terminates. The message indicates that the encapsulated object is an HTML file. The client extracts the file from the response message, examines the HTML file, and finds references to the 10 JPEG objects. 6 first four steps are then repeated for each of the referenced JPEG objects.
Time to fill a request
Disadvantages of non-persistent connections First, a brand-new connection must be established and maintained for each requested object. For each of these connections, buffers must be allocated and variables must be kept in both the client and server. Each object suffers a delivery delay of two RTTs one RTT to establish the connection and one RTT to request and receive an object.
Persistent connections With persistent connections, the server leaves the connection open after sending a response. Subsequent requests and responses between the same client and server can be sent over the same connection. Multiple Web pages residing on the same server can be sent from the server to the same client over a single persistent connection. Requests for objects can be made back-to-back, without waiting for replies to pending requests (pipelining). Typically, the server closes a connection when it isn t used for a certain time (a configurable timeout interval).
Outline 1 2 3 4 5 6 7
request message GET / somedir / page. html /1.1 Host : www. mst. edu Connection : c l o s e User agent : M o z i l l a /5.0 Accept language : en
General request sp=space; cr=carriage return; lf=line feed
Response Message /1.1 200 OK Connection : c l o s e Date : Tue, 09 Aug 2011 1 5 : 4 4 : 0 4 GMT S e r v e r : Apache / 2. 2. 3 ( CentOS ) Last M o d i f i e d : Tue, 09 Aug 2011 1 5 : 1 1 : 0 3 GMT Content Length : 6821 Content Type : t e x t / html ( data data data data data... The e n t i t y body i s the meat o f the message, i t c o n t a i n s the r e q u e s t e d o b j e c t i t s e l f )
General reply sp=space; cr=carriage return; lf=line feed
Server responses 200 OK: Request succeeded and the information is returned in the response. 301 Moved Permanently: Requested object has been permanently moved; the new URL is specified in Location: header of the response message. The client software will automatically retrieve the new URL. 400 Bad Request: This is a generic error code indicating that the request could not be understood by the server. 404 Not Found: The requested document does not exist on this server. 505 Version Not Supported: The requested protocol version is not supported by the server.
Example: Open connection, send GET request t e l n e t c i s. p o l y. edu 80 GET / r o s s / / 1.1 Host : c i s. p o l y. edu
Outline 1 2 3 4 5 6 7
Outline 1 2 3 4 5 6 7
Proxy server can cache
Bottleneck
helps bottleneck
Outline 1 2 3 4 5 6 7
File Transfer Protocol
control and data connections uses two parallel connections to transfer a file, a control connection and a data connection. The control connection is used for sending control information between the two hosts, information such as user identification, password, commands to change remote directory, and commands to put and get files. The data connection is used to actually send a file. is said to send its control information out-of-band. sends request and response header lines into the same connection that carries the transferred file itself, named in-band.
sequence When a user starts an session with a remote host, the client side of (user) first initiates a control connection with the server side (remote host) on server port number 21. client side of sends the user identification and password over this control connection. client side of also sends, over the control connection, commands to change the remote directory. When the server side receives a command for a file transfer over the control connection (either to, or from, the remote host), the server side initiates a data connection to the client side. sends exactly one file over the data connection and then closes the data connection. If, during the same session, the user wants to transfer another file, opens another data connection. Control connection remains open throughout the duration of the user session, but a new data connection is created for each file transferred within a session (data connections are non-persistent).
requests Commands, from client to server, and replies, from server to client, are sent across the control connection in 7-bit ASCII format. In order to delineate successive commands, a carriage return and line feed end each command.
requests Each command consists of four uppercase ASCII characters, some with optional arguments: USER username: Used to send the user identification to the server. PASS password: Used to send the user password to the server. LIST: Used to ask the server to send back a list of all the files in the current remote directory. The list of files is sent over a (new and non-persistent) data connection rather than the control connection. RETR filename: Used to retrieve (that is, get) a file from the current directory of the remote host. This command causes the remote host to initiate a data connection and to send the requested file over the data connection. STOR filename: Used to store (that is, put) a file into the current directory of the remote host.
replies Some typical replies, along with their possible messages, are as follows: 331 Username OK, password required 125 Data connection already open; transfer starting 425 Can t open data connection 452 Error writing file
Outline 1 2 3 4 5 6 7
Overview:, mail servers, mail user agents
Outline 1 2 3 4 5 6 7
Alice sends a message to Bob
Basic process 1 Alice invokes her user agent for e-mail, provides Bob s e-mail address (for example, bob@someschool.edu), composes a message, and instructs the user agent to send the message. 2 Alice s user agent sends the message to her mail server, where it is placed in a message queue. 3 The client side of, running on Alice s mail server, sees the message in the message queue. It opens a connection to an server, running on Bob s mail server. 4 After some initial handshaking, the client sends Alice s message into the connection. 5 At Bob s mail server, the server side of receives the message. Bob s mail server then places the message in Bob s mailbox. 6 Bob invokes his user agent to read the message at his convenience.
Example transcript Hostname of the client is crepes.fr Hostname of the server is server.edu S : 220 s e r v e r. edu C : HELO c r e p e s. f r S : 250 H e l l o c r e p e s. f r, p l e a s e d to meet you C : MAIL FROM: <a l i c e @ c r e p e s. f r> S : 250 a l i c e @ c r e p e s. f r... Sender ok C : RCPT TO: <b o b @ s e r v e r. edu> S : 250 b o b@server. edu... R e c i p i e n t ok C : DATA S : 354 Enter mail, end with. on a l i n e by i t s e l f C : Do you l i k e ketchup? C : How about p i c k l e s? C :. S : 250 Message a c c e p t e d f o r d e l i v e r y C : QUIT S : 221 s e r v e r. edu c l o s i n g c o n n e c t i o n
Another example
Outline 1 2 3 4 5 6 7
Message header Header containing peripheral information precedes the body of the message itself. The header lines and the body of the message are separated by a blank line (CRLF). RFC 5322 specifies the exact format for mail header lines as well as their semantic interpretations. As with, each header line contains readable text, consisting of a keyword followed by a colon followed by a value. Some of the keywords are required and others are optional. Every header must have a From: header line and a To: header line; a header may include a Subject: header line as well as other optional header lines. From : a l i c e @ c r e p e s. f r To : bob@hamburger. edu S u b j e c t : S e a r c h i n g f o r the meaning o f l i f e.
Outline 1 2 3 4 5 6 7
Email and direction of How does a recipient like Bob, running a user agent on his local PC, obtain his messages, which are sitting in a mail server within Bob s mail provider? Post Office Protocol Version 3 (POP3) Internet Mail Access Protocol (IMAP).
POP3 example In a POP3 transaction, the user agent issues commands, and the server responds to each command with a reply. The authorization phase has two principal commands: user < username > and pass < password >. t e l n e t m a i l S e r v e r 110 +OK POP3 s e r v e r r e a d y u s e r bob +OK p a s s hungry +OK u s e r s u c c e s s f u l l y l o g g e d on
POP3 example C: client, and S: server C : l i s t S : 1 498 S : 2 912 S :. C : r e t r 1 S : ( b l a h b l a h... S :................. S :.......... b l a h ) S :. C : d e l e 1 C : r e t r 2 S : ( b l a h b l a h... S :................. S :.......... b l a h ) S :. C : d e l e 2 C : q u i t S : +OK POP3 s e r v e r s i g n i n g o f f
Another POP3 example
Outline 1 2 3 4 5 6 7
: the problem One identifier for a host is its hostname. Hostnames such as cnn.com, www.yahoo.com, gaia.cs.umass.edu, and cis.poly.edu are mnemonic and are therefore appreciated by humans. However, hostnames provide little, if any, information about the location within the Internet of the host. Hosts are also identified by so-called IP addresses, like : 121.7.106.83 An IP address consists of four bytes and has a rigid hierarchical structure. Each period separates one of the bytes expressed in decimal notation from 0 to 255. An IP address is said to be hierarchical,. because as we scan the address from left to right, we obtain more and more specific information about where the host is located in the Internet (that is, within which network, in the network of networks).
Basics of : host aliasing 1 The same user machine runs the client side of the application. 2 The browser extracts the hostname, www.someschool.edu, from the URL and passes the hostname to the client side of the application. 3 The client sends a query containing the hostname to a server. 4 The client eventually receives a reply, which includes the IP address for the hostname. 5 Once the browser receives the IP address from, it can initiate a con- nection to the server process located at port 80 at that IP address.
Partial hierarchy of servers
Root servers
server interaction
Recursive queries in
message format
Attacks on DDoS bandwidth-flooding attack: an attacker could attempt to send to each root server a deluge of packets, so many that the majority of legitimate queries never get answered. Man-in-the-middle attack, the attacker intercepts queries from hosts and returns bogus replies. poisoning attack, the attacker sends bogus replies to a server, tricking the server into accepting bogus records into its cache. Another important attack is not an attack on the service per se, but instead exploits the infrastructure to launch a DDoS attack against a targeted host. attacker sends queries to many authoritative servers, with each query having the spoofed source address of the targeted host. The servers then send their replies directly to the targeted host.
Outline 1 2 3 4 5 6 7
vs. Client server
Outline 1 2 3 4 5 6 7
problem: Client server vs.
Distribution time for vs. Client-server
vs Client server For the architecture, the minimal distribution time is not only always less than the distribution time of the client-server architecture It is also less than a fixed duration above some number of peers N. Applications with the architecture can be self-scaling. This scalability is a direct consequence of peers being redistributors as well as consumers of bits.
BitTorrent
BitTorrent protocol: level choices BitTorrent uses as its transport protocol. The well known port for BitTorrent traffic is 6881-6889 (and 6969 for the tracker port). ( distributed sloppy hash table or simply called tracker) protocol uses various ports negotiated by the peers. based Micro Protocol, called utp. The motivation for utp is for BitTorrent clients to not disrupt internet connections, while still utilizing the unused bandwidth fully. When using regular connections BitTorrent quickly fills up the send buffer, adding multiple seconds delay to all interactive traffic
BitTorrent participation incentive Alice gives priority to the neighbors that are currently supplying her data at the highest rate. Alice continually measures the rate at which she receives bits and determines the four peers that are feeding her bits at the highest rate. She then reciprocates by sending chunks to these same four peers. Every 10 seconds, she recalculates the rates and possibly modifies the set of four peers. Every 30 seconds, she also picks one additional neighbor at random and sends it chunks, Bob Because Alice is sending data to Bob, she may become one of Bob s top four uploaders, in which case Bob would start to send data to Alice. If the rate at which Bob sends data to Alice is high enough, Bob could then, in turn, become one of Alice s top four uploaders.
Outline 1 2 3 4 5 6 7
Review: dictionaries, maps, and hash tables Θ(1) as regardless of size of data. Can store large sparse key-space in smaller array with constant access time
Problem: distributed database How to keep a database of pairings between IP addresses and torrents without a central server? Keys could be content names (e.g., names of books and software), and the value could be the IP address at which the content is stored; in this case, an example key-value pair is (ComputeringEssentials.pdf, 128.17.123.38). Building such a database is straightforward with a client-server architecture that stores all the (key, value) pairs in one central server.
Solution: distributed hash table () n users Each user identifier is an integer in the range [0, 2 n 1] Hash the key (author/book name) into a number, mod 2 n 1 The user that has the closest value after the hashed key stores the item
Problem How to lookup which user is storing a particular hashed key?
Solution: circular (a) Only index forward neighbors; number of messages is n/2 (b) Storing indices of more neighbors increases messaging efficiency, and increases storage overhead
A balance of connections: space versus time can be designed so that both the number of neighbors per peer as well as the average number of messages per query is O(log N), where N is the number of peers.
Outline 1 2 3 4 5 6 7
Outline 1 2 3 4 5 6 7
socket : see example py
Outline 1 2 3 4 5 6 7
socket: see example py
socket: see example py