A seman(c firewall for Content Centric Networking - - PowerPoint PPT Presentation

▶
a seman c firewall for content centric networking
SMART_READER_LITE
LIVE PREVIEW

A seman(c firewall for Content Centric Networking - - PowerPoint PPT Presentation

Dec 12, 2022 259 likes •673 views

A seman(c firewall for Content Centric Networking IFIP/IEEE Integrated Network Management Symposium (IM 2013) - MC2: Security Management and Recovery May 27 - 31, 2013 David Goergen Thibault Cholez Jrme

slide-1
SLIDE 1

SnT – Interdisciplinary Centre for Security, Reliability and Trust

A ¡seman(c ¡firewall ¡for ¡Content ¡Centric ¡ Networking ¡

IFIP/IEEE Integrated Network Management Symposium (IM 2013) - MC2: Security Management and Recovery May 27 - 31, 2013

David Goergen Thibault Cholez Jérôme François Thomas Engel

slide-2
SLIDE 2

OUTLINE ¡

  • Introduction
  • Content Centric Networking

background

  • Design
  • Implementation
  • Evaluation
  • Conclusion

2 / 39

slide-3
SLIDE 3

INTRODUCTION ¡

A semantic firewall for Content Centric Networking

3 / 39

slide-4
SLIDE 4

Introduc(on ¡

  • Trend towards content retrieval
  • Content Centric Networking is built and

designed to follow this

– Some security measures already built-in

  • Authentication of content

– But real security tools missing

  • Our contribution:

– Identify the security needs for a CCN architecture – Design of a semantic CCN firewall – Performance evaluation

4 / 39

slide-5
SLIDE 5

Related ¡work ¡

  • Jacobson, V., Smetters, D.K., Thornton, J.D., Plass, M.F.,

Briggs, N.H., Braynard, R.L.: Networking named content. In: Proceedings of the 5th international conference on Emerging networking experiments and technologies. pp. 1–12. CoNEXT ’09, ACM, New York, NY, USA (2009)

  • D. Smetters, V. Jacobson: Securing Network Content

(October 2009)

  • Lauinger, T.: Security & scalability of content-centric

networking (September 2010)

  • Goergen, David; Cholez, Thibault; François, Jérôme; Engel,

Thomas: Security monitoring for Content Centric Networking, Data Privacy Management and Autonomous Spontaneous Security, Volume 7731 (2013)

  • partly funded by BUTLER and IoT6 FP7 EU projects under the

grant agreements 287901 and 88445

5 / 39

slide-6
SLIDE 6

CONTENT ¡CENTRIC ¡NETWORKING ¡ BACKGROUND ¡

A semantic firewall for Content Centric Networking

6 / 39

slide-7
SLIDE 7

Content ¡Centric ¡Networking ¡-­‑ ¡CCN ¡

  • New paradigm proposed by Van Jacobson

et al.

  • Redesign networking focusing on data

instead of hosts (who provide the data)

  • Shift from a communication oriented

paradigm to a distribution oriented

  • To provide the same functionalities as

TCP/IP with build in security features, more efficient content diffusion, mobility, …

7 / 39

slide-8
SLIDE 8

How ¡does ¡it ¡work? ¡

  • Routable data instead of routable host
  • Content is named in a hierarchical prefix based

way

Examples:

− uni.lu/people/goergen/presentation/im2013 − thisRoom/projector

  • Like IP, CCN is semantic free. Meaning is

defined by application, global conventions, etc.

  • Content is requested by user’s Interest
  • Anyone who has the solicited content can

answer

8 / 39

slide-9
SLIDE 9

CCN ¡architecture ¡

  • CCN Packets:

– Interest Packets that express Interest for a certain content – Data Packets, signed by the contents producer, reply to a certain Interest and consume it

  • CCN tables:

– Content store

  • local repository filled with shared content

– Pending Interest Table (PIT)

  • Contains pending Interest requests send upstream to a

content provider

– Forward Information Base Table (FIB)

  • Contains the faces which correspond to a certain Interest

9 / 39

slide-10
SLIDE 10

CCN ¡node ¡model ¡

10 / 39

slide-11
SLIDE 11

Rou(ng ¡example ¡

11 / 39

slide-12
SLIDE 12

Rou(ng ¡example ¡cont’d ¡

12 / 39

slide-13
SLIDE 13

Rou(ng ¡example ¡cont’d ¡

13 / 39

slide-14
SLIDE 14

Rou(ng ¡example ¡cont’d ¡

14 / 39

slide-15
SLIDE 15

Rou(ng ¡example ¡cont’d ¡

15 / 39

slide-16
SLIDE 16

Rou(ng ¡example ¡cont’d ¡

16 / 39

slide-17
SLIDE 17

Rou(ng ¡example ¡cont’d ¡

17 / 39

slide-18
SLIDE 18

Rou(ng ¡example ¡cont’d ¡

18 / 39

slide-19
SLIDE 19

Rou(ng ¡example ¡cont’d ¡

19 / 39

slide-20
SLIDE 20

Rou(ng ¡example ¡cont’d ¡

20 / 39

slide-21
SLIDE 21

Security ¡layer ¡ ¡

  • No Content transmission before Interest

reception

– Renders classic Denial-of-Service, like flooding, inefficient

  • Strongly relies on cryptography

– Authentication of Content and its producer – Exclusion of untrustworthy sources

  • But new kind of attacks

– Stateful routers  More vulnerable ? – Missing tool for enforcing security policies

21 / 39

slide-22
SLIDE 22

DESIGN ¡

A semantic firewall for Content Centric Networking

22 / 39

slide-23
SLIDE 23

IP ¡firewall ¡general ¡use ¡cases ¡

  • IP_UC1

– Based on the protocol

  • Example: http, mail, p2p, voip, …
  • IP_UC2

– According to the status of the connection

  • IP_UC3

– Using known blacklisted IP addresses

  • IP_UC4

– Unusual inbound traffic

  • From a denial of service attack

23 / 39

slide-24
SLIDE 24

CCN-­‑specific ¡use ¡cases ¡

  • CCN_UC1

– Filtering on content provider

  • Example: known untrustworthy or banned
  • CCN_UC2

– Filtering on bad signature

  • CCN_UC3

– Filtering on content name and semantic

  • Example: excluding files with certain extensions
  • CCN_UC4

– Composition (content provider & content name)

24 / 39

slide-25
SLIDE 25

CCN-­‑specific ¡use ¡cases ¡

  • CCN_UC5

– Filtering on content direction

  • Example: avoid leakage of certain documents
  • CCN_UC6

– Filtering on heavy traffic

  • Perservation of QoS
  • CCN_UC7

– Filtering of stored data

  • Example: Only storing specific content

25 / 39

slide-26
SLIDE 26

Comparison ¡

IP use cases CCN use cases Filtering on IP_UC1 CCN_UC3 Protocol / Content name IP_UC2

  • Status of the connection

IP_UC3 CCN_UC1 Listed IP / Content provider IP_UC4 CCN_UC6 Unusual / Heavy traffic

  • CCN_UC2

Bad signature

  • CCN_UC4

Composition of filters

  • CCN_UC5

Content direction

  • CCN_UC7

Stored data

26 / 39

slide-27
SLIDE 27

IMPLEMENTATION ¡

A semantic firewall for Content Centric Networking

27 / 39

slide-28
SLIDE 28

Syntax ¡defini(on ¡

  • Syntax based on iptables

– Ease of use and readability

  • Distinguish between 3 types of rules

– r_interest

  • interest SP direction SP

match_interest SP “pit” SP action

– r_face

  • face SP number

– r_data

  • data SP direction SP match_data SP

[“cs” | “pit”] SP action

28 / 39

slide-29
SLIDE 29

r_interest ¡& ¡r_face ¡

interest SP direction SP match_interest SP “pit” SP action

  • direction

– int | ext | *

  • match_interest

– * or regular expression

  • action

– forward | drop

  • example :

interest * \@game|play|fun\@ 15 pit drop face SP number

Number of active faces

  • example :

face 200

29 / 39

slide-30
SLIDE 30

r_data ¡

data SP direction SP match_data SP [“cs” | “pit”] SP action

  • direction

– int | ext | *

  • match_data

– content_name SP provider

  • content_name

– * or regular expression

  • provider

– sign_check SP provider_sign

  • signcheck

– 0 | 1

  • provider_sign

– * or hex representation of one or more signatures

  • action

– forward | drop

  • example :

data * \@game|fun\@ 0 0 123456789ABCDEF;FFFF0000AAAA pit drop

30 / 39

slide-31
SLIDE 31

Pre-­‑processing ¡with ¡Disco ¡

  • >= 3 character

sequences are extracted

  • Segmented as real

human-readable words

  • For each sequence

find x similar alternative sequences

  • Recombine with
  • riginal to create new

regular expression

31 / 39

slide-32
SLIDE 32

Implementa(on ¡into ¡CCN ¡stack ¡

32 / 39

slide-33
SLIDE 33

EVALUATION ¡

A semantic firewall for Content Centric Networking

33 / 39

slide-34
SLIDE 34

Setup ¡

  • 6 nodes
  • Intermediate routers

don’t cache

  • Consumer request

single binary file 500MB or 1GB

  • Measured transfer

time request  received

34 / 39

slide-35
SLIDE 35

1st ¡evalua(on: ¡Impact ¡of ¡rules ¡

  • Impact on the

number of processed rules

– Increasing step 100 – Request 500 MB and 1 GB file

  • Shows small to no

impact on transfer time

35 / 39

slide-36
SLIDE 36

2nd ¡evalua(on: ¡Clean ¡vs. ¡Firewall ¡

  • Repeated

experiment to obtain significant results

  • Firewalled CCN

– 1000 rules

  • Request 500 MB file
  • Applied Chi-square

and KS-test on

  • btain result

36 / 39

slide-37
SLIDE 37

CONCLUSION ¡

A semantic firewall for Content Centric Networking

37 / 39

slide-38
SLIDE 38

Conclusion ¡

  • Introduction of a first firewall

implementation dedicated to CCN

– Use case analysis – Grammar definition – Implementation

  • Use of semantic tools
  • Overhead of the firewall is neglectable
  • Future Work

– Rule reordering – Using Bloom filters

38 / 39

slide-39
SLIDE 39

THANK ¡YOU ¡FOR ¡YOUR ¡ATTENTION ¡ QUESTIONS? ¡

39 / 39