Hardened Network Implementation & Simulation

Contents  HBGP  Implementation of HBGP  Simulation on SSFnet  Simulation Results  Future Work

HBGP  A Protocol used to propagate Hardened Network information An extension to BGP4 Hardened AS Path Keep the last and next Hardened Network information in the routing table

Implementation of HBGP  GateD Open-source routing protocol development platform Model the operations of a human-configurable routers

Implementation of HBGP  Modifications to GateD aspath_format aspath_attr BGP_send_update BGP_receive_update rt_add rt_change if_rtup bgp_syn_rt_change

Implementation of HBGP  Status: Hardened Network information has been propagated correctly Modification to Routing table has been finished and under testing and debugging

Simulation on SSFnet  SSFnet Open-source Java/C++ Internet model and simulation Protocols: IP, TCP, UDP, BGP4, OSPF, and others network elements: hosts, routers, links, LANs

Simulation on SSFnet  Modification on SSFnet BGP package Constructing Hardened AS Path information Parsing Hardened AS Path information Routing table package Inserting last and next Hardened ASes information IP package Retrieving last Hardened AS Encrypting/decrypting Gathering information

Simulation on SSFnet Controller Analysis information Setting up the normal pattern Detecting attack Responding to abnormal behavior Restoring the traffic

Simulation Configuration

Simulated Performance (RC4) TABLE 1. HARDEN-BACKBONE-ROUTER (RC4) Normal Transp. Time(S.) Hardened Transp. Time(S.) Overhead (S.) 2 routers routers routers routers routers routers routers routers routers TABLE 4. HARDEN-END-ROUTER (RC4) Normal Transp. Time(S.) Hardened Transp. Time(S.) Overhead (S.) 3 routers routers routers routers routers routers routers routers

Simulated Performance (BLOWFISH) TABLE 2. HARDEN-BACKBONE-ROUTER (BLOWFISH) Normal Transp. Time(S.) Hardened Transp. Time (S.) Overhead (S.) 2 routers routers routers routers routers routers routers routers routers TABLE 5. HARDEN-END-ROUTER (BLOWFISH) Normal Transp. Time(S.) Hardened Transp. Time(S.) Overhead (S.) 3 routers routers routers routers routers routers routers routers

Simulated Performance (DES) TABLE 3. HARDEN-BACKBONE-ROUTER (DES) Normal Transp. Time(S.) Hardened Transp. Time S.) Overhead (S.) 2 routers routers routers routers routers routers routers routers routers TABLE 6. HARDEN-END-ROUTER (DES) Normal Transp. Time(S.) Hardened Transp. Time(S.) Overhead (S.) 3 routers routers routers routers routers routers routers routers

Comparison of Performance Figure 7. Overhead Comparison of 8-router packets Figure 8. Overhead Comparison of 10-router packets

Simulated Detection & Response  Hardened all the end routers  ICMP attack targeting the host in AS12  Attackers are distributed over the three subnets

Simulated Detection & Response Fig. 6 Traffic Pattern at Router at AS12

Simulated Detection & Response  Hardened the core routers  ICMP attack targeting the host at AS12  Attacker also are distributed over the three subnets

Simulated Detection & Response Fig. 7 Traffic Pattern at Router 1 of AS1

Future Work  Implementation Hardened AS Controller Key exchange Encryption/Decryption in IP forwarding