Routing Security* CSE598K/CSE545 - Advanced Network Security Prof. - - PowerPoint PPT Presentation

▶
routing security
SMART_READER_LITE
LIVE PREVIEW

Routing Security* CSE598K/CSE545 - Advanced Network Security Prof. - - PowerPoint PPT Presentation

May 30, 2023 618 likes •864 views

slide-1
SLIDE 1

฀฀฀฀ ฀

  • ฀฀฀฀

฀฀฀฀฀ ฀฀฀฀฀฀

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Routing Security*

CSE598K/CSE545 - Advanced Network Security

  • Prof. McDaniel - Spring 2008

1

* Thanks to Steve Bellovin for slide source material.

slide-2
SLIDE 2

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Routing 101

  • Network routing exists to

provide hosts desirable paths from the source to destination

  • What desirable means depends on

the types of protocols being used

  • Two main approaches to routing
  • Link state - collected/metrics of

paths between hosts, e.g., OSPF

  • Distance vector - shortest path

based on exchanged routing tables, e.g., BGP

2

slide-3
SLIDE 3

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Routing Security

  • Bad guys play games with routing protocols.
  • Traffic is diverted.
  • Enemy can see the traffic.
  • Enemy can easily modify the traffic.
  • Enemy can drop the traffic.
  • Cryptography can mitigate effects, but not stop them.
  • History: we don’t have a lot of good answers!

3

slide-4
SLIDE 4

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Why So Little Progress?

  • It's a really, really hard problem.
  • Actually, getting routing to work well is hard enough.
  • Has been outside the scope of traditional

communications security.

4

slide-5
SLIDE 5

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

How is it Different?

  • Most communications security failures happen because
  • f buggy code or broken protocols.
  • Routing security failures happen despite good code

and functioning protocols. The problem is a dishonest participant.

  • Hop-by-hop authentication isn't sufficient.

5

slide-6
SLIDE 6

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Routing ...

6

X Z X Host A Host B X X X X X X X

slide-7
SLIDE 7

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

The Enemy's Goal?

7

X Z X Host A Host B X X X X X X X

slide-8
SLIDE 8

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Routing Protocols

  • Routers speak to each other.
  • They exchange topology information and cost

information.

  • Each router calculates the shortest path to each

destination.

  • Routers forward packets along locally shortest path.
  • Attacker can lie to other routers

8

slide-9
SLIDE 9

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Normal Behavior

9

X Z X Host A Host B

5 5 5 10 10

Y → X:B(10) Y → Z :B(10) Z → X:Y (5), B(15) X → A:Z(5), Y (5), B(15)

slide-10
SLIDE 10

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Malicious Behavior

10

X Z X Host A Host B

5 5 5 10 10

Y → X:B(10) Y → Z :B(10) Z → X:Y (5), B(3) X → A:Z(5), Y (5), B(15)

slide-11
SLIDE 11

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Why is the Problem Hard?

  • X has no knowledge of Z's real connectivity.
  • Even Y has no such knowledge.
  • The problem isn't the link from X to Z; the problem is

the information being sent. (Note that Z might be deceived by some other neighbor Q.)

11

slide-12
SLIDE 12

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Worm-Holing

12

X X X Host A Host B X X Z X X Z X

slide-13
SLIDE 13

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Worm-Holing

13

X X X Host A Host B X X Z X X Z X

slide-14
SLIDE 14

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Link Cutting

14

X X X Host A Host B X X Z X X Z X

slide-15
SLIDE 15

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Link Cutting

15

X X X Host A Host B X X Z X X Z X

slide-16
SLIDE 16

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Routing in the Internet

  • Two types, internal and external routing.
  • Intradomin - Internal (within ISP, company): primarily OSPF.
  • Interdomain routing - external (between ISPs, and some

customers): BGP.

  • Topology matters.

16

slide-17
SLIDE 17

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

OSPF (Open Shortest Path First)

  • Each node announces its own connectivity.

Announcement includes link cost.

  • Each node reannounces all information received from peers.
  • Every node learns the full map of the network.
  • Each node calculates the shortest path to all destinations.
  • Note: limited to a few thousand nodes at most.

17

X Z X Host A Host B

5 5 5 10 10

slide-18
SLIDE 18

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Characteristics of Internal Networks

  • Common management.
  • Common agreement on cost metrics.
  • Companies have less rich topologies, but less

controlled networks.

  • ISPs have very rich---but very specialized---topologies,

but well-controlled networks.

  • Often based on Ethernet and its descendants.

18

slide-19
SLIDE 19

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Secure OSPF?

  • Simple link security is hard: multiple-access net.
  • Shared secrets guard against new machines being

plugged in but not against an authorized party being dishonest.

  • Solution: digitally sign each routing update (expensive!)
  • List authorizations in certificate.
  • Experimental RFC by Murphy et al., 1997.
  • Note: everyone sees the whole map; monitoring

station can note discrepancies from reality. (But bad guys can send out different announcements in different directions.)

19

slide-20
SLIDE 20

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

BGP (Border Gateway Protocol)

  • BGP is the protocol used to

route information at the autonomous system level - (distance vector protocol)

  • Everyone builds a route to every

AS in the internet based on paths received from neighbors

  • Routes are flooded to neighbors
  • Path selection is based on policy

(not always shortest path)

20

slide-21
SLIDE 21

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

External Routing via BGP

  • No common management
  • hence no metrics beyond hop count
  • No shared trust.
  • Policy considerations: by intent,

not all paths are actually usable.

  • Controls address management

21

The control plane for the Internet.

slide-22
SLIDE 22

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Secure BGP?

  • Kent et al. created the sBGP

protocol which:

  • Signs routes
  • Signs address advertisements
  • Based on the idea that we can

setup parallel PKI to support trust in the routing and address use.

  • Several RFCs, many papers.
  • Not really gotten traction because
  • f costs and limitations of trust.

22

slide-23
SLIDE 23

CSE598K/CSE545 - Advanced Network Security - McDaniel Page

Problems to Solutions?

  • Independent of the type, this all relates to securing the

following information for a source:

  • where the destination address?
  • what is the best path to that address?
  • Answering these questions in practice is complex, as it

necessarily requires us to trust foreign entities or devices for which we may know little (if anything).

  • This is the nasty secure distributed computation all
  • ver again, only everyone on the Internet must play.
  • Next week: exploring the solution space!

23