Seraphim : A Security Architecture for Active Networks University of Illinois at Urbana-Champaign

Motivation Active Network is a radical approach to provide programmability in the network Dynamic nature of Active Network needs dynamic security architecture as one of the crucial requirements 9/21/2018

Seraphim Threat Model Malicious attacks against the active packets? Unauthorized access to NodeOS resources Attacks against the privacy and integrity of communication Denial of Service 9/21/2018

Seraphim Features Access Control for the NodeOS resources using Security Guardian with Dynamic Policy and Active Capability Security API for secure communication DDoS Prevention Pluggable Architecture 9/21/2018

Access Control All accesses to NodeOS resources go through the Security Guardian Access control policies are written in the context of Policy Framework Active Capability is used as the carrier of the access control policy 9/21/2018

OS Primitives, Interfaces Dynamic Policy Supports several security policies and provides dynamic transition between them DDAC DAC MAC RBAC OS Primitives, Interfaces 9/21/2018

NodeOS Security API EE NodeOS Authentication Authorization Security Services PAM API GAA API GSS API X.509, Password-based, Kerberos, SESAME, Etc. Active Capability, PolicyMaker, ACL Etc. JCE, Kerberos, SESAME, Etc. Public Key API Security Guardian X.509 PKI NodeOS Dynamic Policy Framework RFC 2510 9/21/2018

DDoS Prevention - BARMAN 9/21/2018

DDOS Prevention BARMAN – Bandwidth Authorization and Resource Management in Active Networks Dynamic protocol solution – triggered by bandwidth flooding Threshold value based on processor and link characteristics Bandwidth Certification for Attack Detection Hierarchical traceback with dynamic accounting state Co-operative dynamic recovery using active filtering 9/21/2018

Threshold Computation Static Phase of Protocol Threshold Value Computed by trusted entity e.g., administrator Packet rate that can be safely processed by receiver (server or active router) without getting DOSed Accommodate for emergency control channel Secure Session Establishment 9/21/2018

Bandwidth Certification Dynamic Phase of Protocol Triggered by Threshold violation Sender certifies hop-to-hop bandwidth Certificate for Authorization of Bandwidth : Small fixed length certificate, fixed options, cryptographic protection using fast encryption or hardware. Prevents link spoofing, man-in-the-middle and replay attacks Layered authentication technique 9/21/2018

Traceback Flow Classification and Aggregation based on eventual destination of capsule Direct host, same subnet, foreign subnet Flow characterization – real-time statistics collection vs. attack-triggered Characterization used to implement hierarchical traceback with dynamic state 9/21/2018

Dynamic Traceback (0,0,X) AS 3 AS 2 (0,X,-) (0,X,0) (X,0,-) AS 4 (0,0,-) 9/21/2018

Dynamic Recovery Traceback as far back as possible using secure control messages Reconstruct attack based on collected statistics Dynamically filter on sender for misbehaving flows simultaneously 9/21/2018

Pluggable Architecture 9/21/2018

Pluggable Architecture Seraphim is designed as a pluggable architecture Originally developed for restructured version of ANTS Currently, Seraphim is integrated with Bowman 9/21/2018

Security Guardian (JNI, JVM) Integration Overview CANEs API I2 I1 U CANEs EE User A-Flow Policy Administrator GUI CANEs Signaling A-Flow Security Guardian (JNI, JVM) Policy Server System Thread Bowman NodeOS Host OS 9/21/2018

Integration Features Provides access control for signaling messages Dynamic flow control at active routers by dynamic policy framework Use JNI to plug Java-based Seraphim architecture into C-based CANEs/Bowman 9/21/2018

Demo Contributions Access control for the CANES signaling mechanism Dynamic control of AER flows Prevention of bandwidth clogging DDoS attacks 9/21/2018

Demo Details - CANES Signaling 9/21/2018

Demo Details – AER flows 9/21/2018

Demo Details - BARMAN 9/21/2018

Conclusion Seraphim is dynamic, extensible, flexible, and reconfigurable security architecture which meets the requirements for Active Networks 9/21/2018

Future Research Possibilities Interoperability between different security domains using role translation Risk model for Active Networks Automated response against intrusions 9/21/2018