NetCamo Camouflaging network traffic at right time and right place Y. Guan, X. Fu, R. Bettati and W. Zhao Department of Computer Science Texas A&M University http://www.cs.tamu.edu/research/realtime June 6, 2000 Title: Efficient Traffic Camouflaging in Mission Critical QoS guaranteed Networks

Motivations It is often thought that communication may be secured by encrypting the traffic, but this has rarely been adequate in practice. Encryption makes crypto-analysis very difficult, if not impossible. E.g., IPsec makes content of the traffic inaccessible. 85% of the IP traffic will be encrypted in the near future. (VPN, SSL, etc.) An encrypted email message between a customer service center and its ordinary user is not under suspicion, however, the one between an employee of a defense contractor and the embassy of a hostile power has obvious implication. The changes of traffic pattern between the military command center and some military units under different alertness states often indicate some meaningful information to the observers. Traffic analysis can still be used to trace the user’s on-line/off-line periods, uncover the location of military command center, determine operation mode or alertness state of military units, and analyze the intentions of communications.

Mission Critical Environment Applications Flight Control System Supervisory Command and Control of defense system Hiper-D system (NSWC) ... Security Quality of Service

Objectives Keep network traffic pattern unobservable Provide QoS-guaranteed communication services Be upward and downward compatible with existing operating systems, applications, and network technologies Be scalable and evolutionary

Basic Model Features of IP-based network Header of the packet are readable by an observer. The underlying routing subsystem determines unique path between any pairs of hosts. Basic theorem: If the traffic entering into and exiting from each host is stable, all the traffic in the system are stable.

Example Stable Traffic Pattern Matrix Existing Traffic Pattern Matrix The Existing traffic pattern among the hosts are: Host1 Host2 Host3 Host4 Host 1 0 0 3MB/sec 3MB/sec Host 2 3MB/sec 0 3MB/sec 3MB/sec Host 3 2MB/sec 0MB/sec 0 2MB/sec Host 4 3MB/sec 3MB/sec 3MB/sec 0 Existing Traffic Pattern Matrix The stable traffic pattern among the hosts are: Host1 Host2 Host3 Host4 Host 1 0 3MB/sec 3MB/sec 3MB/sec Host 2 3MB/sec 0 3MB/sec 3MB/sec Host 3 3MB/sec 3MB/sec 0 3MB/sec Host 4 3MB/sec 3MB/sec 3MB/sec 0 Stable Traffic Pattern Matrix

Traffic Padding Flooding the network at right place and right time to make it appear to be constant rate network Challenge: How much? For link j, Si Fi,j( I ) + Sj( I ) = C(I) ?

Traffic Rerouting Indirect delivery of packets Challenge: How to reroute the traffic? Real Traffic: 5MB/sec from H3 to H2 H1 H2 H4 H3 3MB/sec 1MB/sec

QoS guarantee Traffic Padding and Rerouting Challenge: Can we still guarantee real-time delay bound? For for connection j, Si di,,j, < Dj

Approaches Traffic camouflaging: host-based rerouting and traffic padding based on real-time traffic modeling theory. Real-time communication: providing end-to-end delay guaranteed services to applications while having traffic camouflaged A middle-ware solution: achieving effectiveness, compatibility, and scalability

Traffic Planning: Correctness Constraints Stabilization Constraints Link Capacity Constraints

Traffic Planning: Correctness Constraints (cont.) Conservation Constraints Delay Constraints

Extensions Scalability Easy deployment Hierarchical Model: Intra-domain and Inter-domain Easy deployment Appliance-based method Domain 1 Domain 2 Domain 3

NetCamo System Architecture NetCamo Traffic Manager Host Host NetCamo Network Controller API API H323 NetCamo Traffic Manager H323 Applications Client Applications Client Router Agent Router Agent NetCamo Host Controller Host Agent Host Agent NetCamo Host Controller Host Manager Host Manager Network Traffic Controller Traffic Controller Router Router

NetCamo Traffic Planner

NetCamo Traffic Controller

Status April 2000: Pre-release version * Support both CBR and VBR traffic * Support a fixed cover mode * Support a fixed sensor period for traffic padding * Support real-time monitoring August 2000: b version: * Support multiple cover modes * Support an adaptive sensor period for traffic padding * Support a semi-automatic traffic modeling tool * Provide installation and maintenance services August 2000: Integration with HiPer-D system (NSWC)

Network Camouflaging & QoS-guaranteed Service Camouflage network elements and activity (wired and wireless) Host, router and switch Location Liveliness Movement traces Connectivity Connection VPN tunnel Topology Traffic pattern QoS guaranteed Deterministic QoS service Statistical QoS service

Camouflaging, Concealment, and Decoy in Cyber Space Means Packet Conn. Traffic Router Topology Op Mode Hide Blend Encryption Flooding Disguising ? Neutral mode Disrupting Re-routing ? Decoy Multiple cover modes

A new field! Much work to be done! Summary Current NetCamo system is the first step! We achieve our goal in a controlled way that traffic analysis prevention and QoS guaranteed service are obtained at the same time. We are working in this new research field, whose essence lies in hiding and camouflaging the information about the network in order to make it anonymous and unobservable. A new field! Much work to be done!