Protecting Other Styles of Protocols Generally, how do you know you - - PowerPoint PPT Presentation

▶

Sep 03, 2022 332 likes •488 views

Protecting Other Styles of Protocols Generally, how do you know you should believe another router? About distance to some address space About reachability to some address space About other characteristics of a path About what

SLIDE 1

Lecture 18 Page 1 CS 236 Online

Protecting Other Styles of Protocols

Generally, how do you know you

should believe another router?

About distance to some address space
About reachability to some address

space

About other characteristics of a path
About what other nodes have told you

SLIDE 2

Lecture 18 Page 2 CS 236 Online

How Routing Protocols Pass Information

Some protocols pass full information

– E.g., BGP – So they can pass signed information

Others pass summary information

– E.g., RIP – They use other updates to create new summaries – How can we be sure they did so properly?

SLIDE 3

Lecture 18 Page 3 CS 236 Online

Who Are You Worried About?

Random attackers?

– Generally solvable by encrypting/ authenticating routing updates

Misbehaving insiders?

– A much harder problem – They’re supposed to make decisions – How do you know they’re lying?

SLIDE 4

Lecture 18 Page 4 CS 236 Online

A Sample Problem

A B C D E F G H Assume a distance vector protocol

1.2.3.*

1 1 2 2 3 1 How can H tell someone lied? How can H tell that E lied?

SLIDE 5

Lecture 18 Page 5 CS 236 Online

Types of Attacks on Distance Vector Routing Protocols

Blackhole attacks

– Claim short route to target

Claim longer distance

– To avoid traffic going through you

Inject routing loops

– Which cause traffic to be dropped

Inject lots of routing updates

– Generally for denial of service

SLIDE 6

Lecture 18 Page 6 CS 236 Online

How To Secure a Distance Vector Protocol?

Can’t just sign the hop count

– Not tied to the path

Instead, sign a length and a “second-to-

last” router identity

By iterating, you can verify path length

SLIDE 7

Lecture 18 Page 7 CS 236 Online

An Example

A B C D E F G H

1.2.3.*

H needs to build a routing table entry for 1.2.3.* Should show hop count of 3 via G, 5 via E

SLIDE 8

Lecture 18 Page 8 CS 236 Online

One Way to Do It

A B C D E F G H

H directly verifies that it’s one hop to E

E 1

E C 3 D B 4 C A 5 B

H gets signed info that D is 2 hops through E Then we iterate Now we can trust it’s five hops to A

SLIDE 9

Lecture 18 Page 9 CS 236 Online

Who Does the Signing?

The destination

– A in the example

It only signs the unchanging part

– Not the hop count

But an update eventually reaches H

that was signed by A

SLIDE 10

Lecture 18 Page 10 CS 236 Online

What About That Hop Count?

E could lie about the hop count
But he can’t lie that A is next to B
Nor that B next to C, nor C next to D,

nor D next to E

Unless other nodes collude, E can’t

claim to be closer to A than he is

SLIDE 11

Lecture 18 Page 11 CS 236 Online

What If Someone Lies?

A B C D E F G H

There’s limited scope for effective lies E can’t claim to be closer to A Since E can’t produce a routing update signed by A that substantiates that

E 1

E C 3 D B 4 C A 5 B

SLIDE 12

Lecture 18 Page 12 CS 236 Online

A Difficulty

This approach relies on a PKI
H must be able to check the various

signatures

Breaks down if someone doesn’t sign

– That’s a hole in the network, from the verification point of view – Consider, in example, what happens if C doesn’t sign

SLIDE 13

Lecture 18 Page 13 CS 236 Online

What If C Doesn’t Sign?

A B C D E F G H

E 1

E C 3 D B 4 C A 5 B

A message coming through D tells us that it’s three hops to C But H can’t verify that H knows C is next to B And that B is next to A But how can he be sure D is next to C? Other than trusting D . . .

SLIDE 14

Lecture 18 Page 14 CS 236 Online

What’s the Problem?

A B C D E F G H

E 1

E C 3 D B 4 C A 5 B

For this graph, no problem

A B C D E F G H

Protecting Other Styles of Protocols

should believe another router?

space

How Routing Protocols Pass Information

– E.g., BGP – So they can pass signed information

– E.g., RIP – They use other updates to create new summaries – How can we be sure they did so properly?

Who Are You Worried About?

– Generally solvable by encrypting/ authenticating routing updates

– A much harder problem – They’re supposed to make decisions – How do you know they’re lying?

A Sample Problem

A B C D E F G H Assume a distance vector protocol

1 1 2 2 3 1 How can H tell someone lied? How can H tell that E lied?

Types of Attacks on Distance Vector Routing Protocols

– Claim short route to target

– To avoid traffic going through you

– Which cause traffic to be dropped

– Generally for denial of service

How To Secure a Distance Vector Protocol?

– Not tied to the path

last” router identity

An Example

A B C D E F G H

H needs to build a routing table entry for 1.2.3.* Should show hop count of 3 via G, 5 via E

One Way to Do It

H directly verifies that it’s one hop to E

H gets signed info that D is 2 hops through E Then we iterate Now we can trust it’s five hops to A

Who Does the Signing?

– A in the example

– Not the hop count

that was signed by A

What About That Hop Count?

nor D next to E

claim to be closer to A than he is

What If Someone Lies?

There’s limited scope for effective lies E can’t claim to be closer to A Since E can’t produce a routing update signed by A that substantiates that

A Difficulty

signatures

– That’s a hole in the network, from the verification point of view – Consider, in example, what happens if C doesn’t sign

What If C Doesn’t Sign?

A message coming through D tells us that it’s three hops to C But H can’t verify that H knows C is next to B And that B is next to A But how can he be sure D is next to C? Other than trusting D . . .

What’s the Problem?

For this graph, no problem

But how about for this one?