SLIDE 1
Off by Default!
Hitesh Ballani, Yatin Chawathe, Sylvia Ratnasamy, Timothy Roscoe, Scott Shenker
HotNets-IV, 2005
SLIDE 2 Internet, then and now
Internet, circa 1975
◮ Trust in the ends ⇒ Universal reachability ◮ Routability implies reachability
◮ “On” by default
Internet, circa 2005
◮ Less trust in the ends
◮ every host is vulnerable to any other host(s)
◮ Firewalls/NATs
◮ end-hosts are “Off”, the network is not ◮ ad-hoc and not universal
SLIDE 3
Off by default!
SLIDE 4 Turn it “Off”
Reachability is “Off” by default
◮ Hosts turn “On” by explicitly telling the network
SLIDE 5 Turn it “Off”
Reachability is “Off” by default
◮ Hosts turn “On” by explicitly telling the network
Issues
◮ What are the advantages? ◮ What are the assumptions? ◮ What are the incentives? ◮ . . .
SLIDE 6
Is it even worth a thought?
Design a Default-Off network Evaluate its feasibility
SLIDE 7
Default-Off design
Def-Off Internet
Stub Network
End-hosts are unreachable by defaultg g
SLIDE 8
Default-Off design
Def-Off Internet
Stub Network want to be reachable
End-hosts signal their intent to turn “On” g g
SLIDE 9
Default-Off design
Def-Off Internet
Stub Network Reachability protocol
gReachability protocol propagates this intent into the network as Reachability Advertisementsg
SLIDE 10
Default-Off design
Def-Off Internet
Stub Network Reachability protocol
Na¨ ıve Approach (not feasible) Routers maintain exact reachability state for all hosts Instantaneous propagation of advertisements
SLIDE 11
Default-Off design
Def-Off Internet
Stub Network Reachability protocol
Challenges Router State Reachability dynamics
SLIDE 12 Reachability Protocol
Reachability overlaid on Routing
◮ Inherit routing trust relationships ◮ Reachability events Route recalculation
SLIDE 13 Reachability Protocol
Reachability overlaid on Routing
◮ Inherit routing trust relationships ◮ Reachability events Route recalculation
Def-Off Internet
Stub Network Routing protocol
SLIDE 14 Reachability Protocol
Reachability overlaid on Routing
◮ Inherit routing trust relationships ◮ Reachability events Route recalculation
Def-Off Internet
Stub Network Routing protocol Reachability protocol
SLIDE 15 Reachability Protocol
Reachability overlaid on Routing
◮ Inherit routing trust relationships ◮ Reachability events Route recalculation
Def-Off Internet
Stub Network Routing protocol Reachability protocol
Periodic reachability exchanges between domains
◮ Load due to dynamics Vs Turn-“On” time
SLIDE 16
Reachability Advertisements
Flexibility : allow for evolution
SLIDE 17
Reachability Advertisements
Flexibility : allow for evolution Who? What? When? How much?
SLIDE 18
Reachability Advertisements
Flexibility : allow for evolution Who? What? When? How much?
Reachability Advertisement
[ prefix, length,RC ... ,scope]
SLIDE 19
Reachability Advertisements
Flexibility : allow for evolution Who? What? When? How much?
Reachability Advertisement
[ prefix, length,RC ... ,scope]
The host whose reachability this advertisement describes
SLIDE 20 Reachability Advertisements
Flexibility : allow for evolution Who? What? When? How much?
Reachability Advertisement
[ prefix, length,RC ... ,scope]
list of constraints, for eg.
- 1. on to all [ Dst IP, Dst Port, Proto ]
- 2. on to one [ Dst IP, Dst Port, Proto, Src IP ]
SLIDE 21
Reachability Advertisements
Flexibility : allow for evolution Who? What? When? How much?
Reachability Advertisement
[ prefix, length,RC ... ,scope]
Avoids needless propagation of state
For eg. Limit advertisement in terms of AS Hops, Set of AS’es, ....
SLIDE 22
Router State : “Off” hosts
“Off” hosts do not incur state
SLIDE 23 Router State : “Off” hosts
“Off” hosts do not incur state
◮ Clients are “Off”
[Handley FDNA’04]
◮ “Off” hosts accessed using path-based addresses
(address gives path back to the “Off” host)
SLIDE 24 Router State : “Off” hosts
“Off” hosts do not incur state
◮ Clients are “Off”
[Handley FDNA’04]
◮ “Off” hosts accessed using path-based addresses
(address gives path back to the “Off” host)
P Q R S
Client A
B
Server/Peer A|B
g(“Off” host A wants to communicate with “On” host B (A|B)(
SLIDE 25 Router State : “Off” hosts
“Off” hosts do not incur state
◮ Clients are “Off”
[Handley FDNA’04]
◮ “Off” hosts accessed using path-based addresses
(address gives path back to the “Off” host)
P Q R S
Client A
B
Server/Peer A|B PA|B
g(Host B is “On” so domain P forwards it; but also adds itself into the source (PA)g(
SLIDE 26 Router State : “Off” hosts
“Off” hosts do not incur state
◮ Clients are “Off”
[Handley FDNA’04]
◮ “Off” hosts accessed using path-based addresses
(address gives path back to the “Off” host)
P Q R S
Client A
B
Server/Peer A|B PA|B QPA|B
g(At the egress of domain Q, Q is added to the source (QPA)g(
SLIDE 27 Router State : “Off” hosts
“Off” hosts do not incur state
◮ Clients are “Off”
[Handley FDNA’04]
◮ “Off” hosts accessed using path-based addresses
(address gives path back to the “Off” host)
P Q R S
Client A
B
Server/Peer A|B PA|B QPA|B RQPA|B
g(Host B can use the path (RQPA) to get to “Off” host Ag(
SLIDE 28 Router State : “Off” hosts
“Off” hosts do not incur state
◮ Clients are “Off”
[Handley FDNA’04]
◮ “Off” hosts accessed using path-based addresses
(address gives path back to the “Off” host)
P Q R S
Client A
B
Server/Peer A|B PA|B QPA|B RQPA|B B|RQPA B|RQPA B|QPA B|PA
g(Destination field is stripped off, source field accumulates the pathg(
SLIDE 29 Router State : “Off” hosts
“Off” hosts do not incur state
◮ Clients are “Off”
[Handley FDNA’04]
◮ “Off” hosts accessed using path-based addresses
(address gives path back to the “Off” host)
P Q R S
Client A
B
Server/Peer A|B PA|B QPA|B RQPA|B B|RQPA B|RQPA B|QPA B|PA
g(Issues and advantages associated with path-based addresses(
SLIDE 30
Router State : “On” hosts
Routers don’t keep exact reachability state
SLIDE 31 Router State : “On” hosts
Routers don’t keep exact reachability state
◮ Aggregation according to router memory
[ prefix, length,RC ... ,scope]
RA1
[ prefix, length,RC ... ,scope]
RA2 Aggregated Advertisement [ prefix, length,RC ... ,scope]
Union
classic prefix aggregation
SLIDE 32 Router State : “On” hosts
Routers don’t keep exact reachability state
◮ Aggregation according to router memory ◮ Introduces false-positives ◮ Default-Off offers best-effort protection to
“Off” hosts
Aggregation Increasing Protection Increasing
SLIDE 33
How effective is Default-Off at limiting unwanted traffic?
SLIDE 34 Feasibility : Router State
Simulated Default-Off operation
◮ AS-level internet topology
[Subramanian ’05]
◮ 200,000 routable prefixes
[Route-Views ’05]
Parameters of interest
◮ H - hosts per prefix that are “On” ◮ T - amount of router memory available
SLIDE 35 Feasibility : Router State
Simulated Default-Off operation
◮ AS-level internet topology
[Subramanian ’05]
◮ 200,000 routable prefixes
[Route-Views ’05]
Parameters of interest
◮ H - hosts per prefix that are “On” ◮ T - amount of router memory available
Stub A x hosts "on" ISP B ISP C ISP D
SLIDE 36 Feasibility : Router State
Simulated Default-Off operation
◮ AS-level internet topology
[Subramanian ’05]
◮ 200,000 routable prefixes
[Route-Views ’05]
Parameters of interest
◮ H - hosts per prefix that are “On” ◮ T - amount of router memory available
Stub A x hosts "on" ISP B ISP C ISP D
Reachability Advertisements (thickness is amount of state)
SLIDE 37 Feasibility : Router State
Simulated Default-Off operation
◮ AS-level internet topology
[Subramanian ’05]
◮ 200,000 routable prefixes
[Route-Views ’05]
Parameters of interest
◮ H - hosts per prefix that are “On” ◮ T - amount of router memory available
Stub A x hosts "on" ISP B ISP C ISP D Packet for "off" host
SLIDE 38 Feasibility : Router State
Simulated Default-Off operation
◮ AS-level internet topology
[Subramanian ’05]
◮ 200,000 routable prefixes
[Route-Views ’05]
Parameters of interest
◮ H - hosts per prefix that are “On” ◮ T - amount of router memory available
Stub A x hosts "on" ISP B ISP C ISP D Packet for "off" host
X
Blocked 2 AS hops from DST
SLIDE 39 Feasibility : Router State
Simulated Default-Off operation
◮ AS-level internet topology
[Subramanian ’05]
◮ 200,000 routable prefixes
[Route-Views ’05]
Parameters of interest
◮ H - hosts per prefix that are “On” ◮ T - amount of router memory available
Stub A x hosts "on" ISP B ISP C ISP D Packet for "off" host
X
Blocked 1 AS hop from DST
SLIDE 40 Feasibility : Router State
Simulated Default-Off operation
◮ AS-level internet topology
[Subramanian ’05]
◮ 200,000 routable prefixes
[Route-Views ’05]
Parameters of interest
◮ H - hosts per prefix that are “On” ◮ T - amount of router memory available
Stub A x hosts "on" ISP B ISP C ISP D Packet for "off" host
X
Blocked 0 AS hop from DST
SLIDE 41
Feasibility : Router State
H : 45 “On” hosts per prefix [Surveys; Karagiannis ’04] T : 7 MB per line card [Surveys; Keshav ’98]
0.2 0.4 0.6 0.8 1 1 2 3 4 5 6 7 CDF for unwanted packets that reached a point AS HOPS from point to Dest. Def-Off 0.2 0.4 0.6 0.8 1 1 2 3 4 5 6 7 CDF for unwanted packets that reached a point AS HOPS from point to Dest. Def-Off
SLIDE 42
Feasibility : Router State
H : 45 “On” hosts per prefix [Surveys; Karagiannis ’04] T : 7 MB per line card [Surveys; Keshav ’98]
0.2 0.4 0.6 0.8 1 1 2 3 4 5 6 7 CDF for unwanted packets that reached a point AS HOPS from point to Dest. Def-Off 0.2 0.4 0.6 0.8 1 1 2 3 4 5 6 7 CDF for unwanted packets that reached a point AS HOPS from point to Dest. Def-Off
40% of packets blocked 1-AS hop from DST 60% blocked >=2 AS hops away
∼60% packets blocked ≥2 AS-hops away from DST
SLIDE 43
Can routers handle the dynamics of hosts turning “Off”/“On”?
SLIDE 44
Can routers handle the dynamics of hosts turning “Off”/“On”? Load due to dynamics Vs Turn-“On” time controlled using the exchange period
SLIDE 45
Can routers handle the dynamics of hosts turning “Off”/“On”? Load due to dynamics Vs Turn-“On” time controlled using the exchange period Quality of protection Vs Load due to dynamics
Def-Off Internet Destination Off Source Offending packets
SLIDE 46 Can routers handle the dynamics of hosts turning “Off”/“On”? Load due to dynamics Vs Turn-“On” time controlled using the exchange period Quality of protection Vs Load due to dynamics
Def-Off Internet Destination Off Source Offending packets
Turn- Message
Knob Router Memory
SLIDE 47
Feasibility : Reachability dynamics
H : 45 “On” hosts per prefix T : 7 MB per line card
10 20 30 40 50 60 70 80 5 10 15 20 25 30 35 40 5000 10000 15000 20000 25000 Turn-on time (sec) Load (updates/sec) Exchange period (sec) ~40 sec Turn-on time 10 20 30 40 50 60 70 80 5 10 15 20 25 30 35 40 5000 10000 15000 20000 25000 Turn-on time (sec) Load (updates/sec) Exchange period (sec) ~40 sec Turn-on time
Exchange Period = 20 sec ⇒ Turn-on time ≈40 sec
SLIDE 48
Feasibility : Reachability dynamics
H : 45 “On” hosts per prefix T : 7 MB per line card
10 20 30 40 50 60 70 80 5 10 15 20 25 30 35 40 5000 10000 15000 20000 25000 Turn-on time (sec) Load (updates/sec) Exchange period (sec) ~40 sec ~2000 updates/sec Turn-on time Load 10 20 30 40 50 60 70 80 5 10 15 20 25 30 35 40 5000 10000 15000 20000 25000 Turn-on time (sec) Load (updates/sec) Exchange period (sec) ~40 sec ~2000 updates/sec Turn-on time Load
Exchange Period = 20 sec ⇒ Load ≈ 2000 updates/sec
SLIDE 49
Feasibility : Reachability dynamics
H : 45 “On” hosts per prefix T : 7 MB per line card
10 20 30 40 50 60 70 80 5 10 15 20 25 30 35 40 5000 10000 15000 20000 25000 Turn-on time (sec) Load (updates/sec) Exchange period (sec) ~40 sec ~2000 updates/sec Turn-on time Load 10 20 30 40 50 60 70 80 5 10 15 20 25 30 35 40 5000 10000 15000 20000 25000 Turn-on time (sec) Load (updates/sec) Exchange period (sec) ~40 sec ~2000 updates/sec Turn-on time Load
Actual updates per second << 2000 updates/sec
SLIDE 50
“Take Home Message”
First-cut analysis shows that Default-Off might be feasible!
SLIDE 51
Issues
Advantagesg
[Handley FDNA’04]g
Incentivesg
Existing ISP solutionsg
Usage
decision to switch on
Richness of reachability protocol
Stable (and secure) indentifiers for end-hosts, applications etc.
SLIDE 52
Issues
Advantagesg
[Handley FDNA’04]g
Incentivesg
Existing ISP solutionsg
Usage
decision to switch on
Richness of reachability protocol
Stable (and secure) indentifiers for end-hosts, applications etc.
SLIDE 53
Issues
Advantagesg
[Handley FDNA’04]g
Incentivesg
Existing ISP solutionsg
Usage
decision to switch on
Richness of reachability protocol
Stable (and secure) indentifiers for end-hosts, applications etc.
SLIDE 54
Issues
Advantagesg
[Handley FDNA’04]g
Incentivesg
Existing ISP solutionsg
Usage
decision to switch on
Richness of reachability protocol
Stable (and secure) indentifiers for end-hosts, applications etc.
SLIDE 55
Issues
Advantagesg
[Handley FDNA’04]g
Incentivesg
Existing ISP solutionsg
Usage
decision to switch on
Richness of reachability protocol
Stable (and secure) indentifiers for end-hosts, applications etc.
SLIDE 56
Issues
Advantagesg
[Handley FDNA’04]g
Incentivesg
Existing ISP solutionsg
Usage
decision to switch on
Richness of reachability protocol
Stable (and secure) indentifiers for end-hosts, applications etc.
. . . should all this be pushed into the network?
SLIDE 57
Backup slides
SLIDE 58 Conducive for policy enforcement
◮ User policy (administrator) ◮ Organization policy
Def-Off Internet
Stub Network Policy End-user Domain Policy
SLIDE 59 Conducive for policy enforcement
◮ User policy (administrator) ◮ Organization policy
Def-Off Internet
Stub Network Policy End-user Domain Policy ISP Policy
SLIDE 60 Threat Model
Compromise attacks
◮ Scanning worms ◮ Other worms (human activity based) ◮ Viruses, Spy-ware
Resource exhaustion attacks
◮ Flooding (Bandwidth/Processing) ◮ Single packet attacks
And others
◮ Spam, Phishing, . . .
THREAT MODEL
SLIDE 61 Reachability Protocol : the bigger picture
◮ Design space for access-control based solutions
at Ends in Network Proactive Firewalls Mayday, i3, SOS Reactive Reactive Firewalls Pushback, AITF
◮ Reachability protocol in a Default-Off network
◮ Encompasses several such proposals ◮ Intrinsically less trusting network
◮ Feasibility check for the extreme design point
◮ Caveat - Do not claim sufficiency or
SLIDE 62 Actual use of path-based addresses
“Off” hosts do not incur state
◮ Clients are “Off”
[Handley FDNA’04]
◮ “Off” hosts accessed using path-based addresses
P Q R S
Client A
B
Server/Peer A|B PA|B QPA|B RQPA|B
SB|RQPA SB|QPA RSB|QPA RSB|PA QRSB|PA QRSB|A
