DESIGN_AND_IMPLEMENTATION_OF_NETWORK_SECURIT
CHAPTER ONE
1.0 INTRODUCTION
Several recent proposals have argued for giving third parties and end-users control over routing in the network infrastructure. Some examples of such routing architectures include TRIAD [6], i3 [30], NIRA [39], Data Router [33], and Network Pointers [34]. While exposing control over routing to third-parties departs from conventional network architecture, these proposals have shown that such control significantly increases the flexibility and extensibility of these networks.
Using such control, hosts can achieve many functions that are difficult to achieve in the Internet today. Examples of such functions include mobility, multicast, content routing, and service composition. Another somewhat surprising application is that such control can be used by hosts to protect themselves from packet-level denial-of-service (DOS) attacks [18], since, at the extreme, these hosts can remove the forwarding state that malicious hosts use to forward packets to the hosts. While each of these specific functions can be achieved using a specific mechanism—for example, mobile IP allows host mobility— we believe that these forwarding infrastructures (FIs) provide architectural simplicity and uniformity in providing several functions that makes them worth exploring. Forwarding infrastructures typically provide user control by either allowing source-routing (such as [6], [30], [39]) or allowing users to insert forwarding state in the infrastructure (such as [30], [33], [34]). Allowing
10
forwarding entries enables functions like mobility and multicast that are hard to achieve using source-routing alone.
While there seems to be a general agreement over the potential benefits of user-controlled routing architectures, the security vulnerabilities that they introduce has been one of the important concerns that has been not addressed fully. The flexibility that the FIs provide allows malicious entities to attack both the FI as well as hosts connected to the FI.
For instance, consider i3 [30], an indirection-based FI which allows hosts to insert forwarding entries of the form (id,R), so that all packets addressed to id are forwarded to R. An attacker A can eavesdrop or subvert the traffic directed to a victim V by inserting a forwarding entry (idV ,A); the attacker can eavesdrop even when it does not have access to the physical links carrying the victim’s traffic. Alternatively, consider an FI that provides multicast; an attacker can use such an FI to amplify a flooding attack by replicating a packet several times and directing all the replicas to a victim. These vulnerabilities should come as no surprise; in general, the greater the flexibility of the infrastructure, the harder it is to make it secure.
In this project, we improve the security that flexible communication infrastructures which provide a diverse set of operations (such as packet replication) allow. Our main goal in this project is to show that FIs are no more vulnerable than traditional communication networks (such as IP networks) that do not export control on forwarding. To this end, we present several
11
mechanisms that make these FIs achieve certain specific security properties, yet retain the essential features and efficiency of their original design. Our main defense technique, which is based on light-weight cryptographic constraints on forwarding entries, prevents several attacks including eavesdropping, loops, and traffic amplification. From earlier work, we leverage some techniques, such as challenge-responses and erasure-coding, to thwart other attacks