Dissemination of Security Updates Jun Li Dissertation Proposal

Dissemination of security updates 2 §Motivation, challenges, and thesis §Related work §Protection against attacks §Dissemination mechanism §One strategy in initial study §Dissertation plans §Summary §Motivation, challenges, and thesis §Related work §Protection against attacks §Dissemination mechanism §One strategy in initial study §Dissertation plans §Summary Outline

Dissemination of security updates 3 Motivation §Consider network security in general

Dissemination of security updates 4

5 Motivation l For instance, before taking action an attack may hide itself and penetrate into many machines §Wide-spread information sharing in a timely way is necessary l The information is called security update §Consider network security in general §Security attack on just a single machine in a network environment is usually not the case

Dissemination of security updates 6 Security Update Examples §Virus signature (and remedy) §Special events in distributed intrusion detection §Offending characteristics to be filtered by a firewall §Characteristics of a potential attack

Dissemination of security updates 7 Observation §They all share a common need of doing security update dissemination §But the need is addressed in various unsatisfactory ways (to be discussed later)

Dissemination of security updates 8 Solution to the problem §Provide a common facility for security update dissemination

Dissemination of security updates 9 Challenges §Scalability §Low latency §High assurance l some machines may be subverted l some machines may be disconnected §Topological adaptability §Heterogeneity §Low overhead §High security itself

Dissemination of security updates 10 Thesis Dissemination of security updates while simultaneously addressing each of the above challenges is feasible.  Design and build a system that does the work  Call the system Revere

Dissemination of security updates 11 Outline §Motivation, challenges, and thesis §Related work §Protection against attacks §Dissemination mechanism §One strategy in initial study §Dissertation plans §Summary

Dissemination of security updates 12 Related Work §Information dissemination l simple transmission techniques l mailing list l distribution of software, virus signature, or key l network time protocol l push technology §Element management l replicated data management l intrusion detection

Dissemination of security updates 13 Simple Transmission Techniques §Broadcasting network §Unicasting(one-to-one) §Flooding §Multicasting

Dissemination of security updates 14 Mailing List §Scalability §Single path to reach recipients §Hard to interface with other software... network

Dissemination of security updates 15 Distribution of Software, Virus Signature, or Key §Software distribution §Virus signature distribution §Key distribution

Dissemination of security updates 16 Network Time Protocol §Disseminating clock time to synchronize machines on network l manually configured l no retransmission

Dissemination of security updates 17 Push Technology §Some commercial products: BackWeb, Ifusion, InCommon, Intermind, Marimba, NETdelivery, Wayfarer l poll the server periodically, fetch if needed §Salamander l build a substrate l push data from suppliers to clients through the substrate l only single path from a supplier to a client l no handling for disconnected machines

Dissemination of security updates 18 Element Management §Replicated data management l each machine in Revere has a replica of security update §Intrusion detection l if we know which machines are subverted...

Dissemination of security updates 19 Outline §Motivation, challenges, and thesis §Related work §Protection against attacks §Dissemination mechanism §One strategy in initial study §Dissertation plans §Summary

Dissemination of security updates 20 Protecting Revere §Revere must protect itself against attacks l otherwise, security update won’t be disseminated successfully l corrupted Revere is more dangerous if used by enemy for own purpose

Dissemination of security updates 21 Attacks on Revere §Corrupting a message l modification l fabrication or forgery §Corrupting the transmission path l blockage l misdirection l denial of service by replay overloading §Leakage of security update

Dissemination of security updates 22 Fight Against Attacks §Message corruption l digital signature §Transmission path corruption l redundancy by multiple paths l be ready for replay attacks by logging signatures of previous security updates §leakage of security update l no secrecy when many millions of machines are receivers to share same information

Dissemination of security updates 23 Outline §Motivation, challenges, and thesis §Related work §Protection against attacks §Dissemination mechanism §One strategy in initial study §Dissertation plans §Summary

Dissemination of security updates 24 Dissemination Mechanism §High assurance §Pulling by disconnected node §Receiver based policy §Opportunistic use of transmission options §Scalability  Dissemination structure

Dissemination of security updates 25 l implosion 1. High Assurance §Using acknowledgement l ack can be dropped l need to figure out what is missed by whom §Using negative ack l only avoid implosion, and l only feasible when knowing a security update is missed 4Using redundancy l retransmission probably follows same old path l to achieve best effort l harder to corrupt all l accompanied with additional techniques, such as pulling

Dissemination of security updates 26 network 2. Pulling By Disconnected Node §Pulling from  is not scalable and hard to handle §Repository nodes §High assurance pulling l find best repository nodes

Dissemination of security updates Receiver Based Policy §Heterogeneous Revere node in terms of l different resiliency request different environment (hostile or safe) different context itself l different transmission characteristics l different platform different ability of being aware of above

Dissemination of security updates Opportunistic Use of Transmission Options §When security update forwarded from machine to machine(s), choose best option of available transmission type §Tradeoff among l best performance l resource usage l delivery guarantee l simplicity of implementation network

Dissemination of security updates Scalability §Be ready for millions of receivers, or even more l resource usage l performance l security §Any machine can only have partial information of the whole system l distributed computing

Dissemination of security updates 30 Dissemination Structure §Automatic configuration l an easy-to-use user interface needed manual configuration hurts §Dynamic adjustment adaptively l when a new node joins l when an existing node quits l when transmission characteristics changes l when detecting security problems l and so on …..

Dissemination of security updates 31 Outline §Motivation, challenges, and thesis §Related work §Protection against attacks §Dissemination mechanism §One Strategy in initial study §Dissertation plans §Summary

Dissemination of security updates 32 Dissemination w/ Sending Table §Each Revere node has an associated sending table locally A unicast B,C multicast D …………. (empty) B floppy X broadcast (empty) C unicast w/ IP source routing

Dissemination of security updates 33 Building the Sending Table §Requirements l automatic l match dissemination mechanisms l dynamically adjustable §Some information about dissemination sources are common knowledge l addresses l type of security updates to disseminate l public keys §Maybe similar information of some existing Revere nodes

Dissemination of security updates 34 Join Request  Recommending Algorithm  Decision Making Algorithm A Newborn Machines listed in  ’s sending table Machines recommended to newborn Machines selected Detected info between newborn and recommendedRecommended machines listSelected machines list Recursive Enrollment of Newborn

Dissemination of security updates 35 Enrollment Flexibility §A new Revere machine can attach itself to Revere system by sending enroll request(s) to any existing Revere node(s) l based on trustfulness, or l contact more than one

Dissemination of security updates 36 Outline §Motivation, challenges, and thesis §Related work §Protection against attacks §Dissemination mechanism §One Strategy in initial study §Dissertation plans §Summary

Dissemination of security updates 37 A Prototype w/ Basic Functionality §Security update delivery analysis §Dissemination structure formation and management §Dissemination process l push l pull

Dissemination of security updates 38 Security Enforcement §Authentication of security update l signing and verification of security update l key management §Replay prevention l don’t be fooled to send lots of replays since Revere has big fan-out

Dissemination of security updates 39 Test the System §Build a testbed l composed of heterogeneous machines and transmission media l small scale §Simulate possible attacks

Dissemination of security updates 40 Simulation §Large scale §With some Revere nodes subverted l and actively thwarting the dissemination §Understand the effects when lots of machines pull missed information §……………...

Dissemination of security updates 41 Outline §Motivation, challenges, and thesis §Related work §Protection against attacks §Dissemination mechanism §One Strategy in initial study §Dissertation plans §Summary

Dissemination of security updates 42 Summary §The goal is to be able to disseminate security updates securely, quickly, adaptively, to large number of heterogeneous machines with high assurance and low overhead §The work includes design, prototype, test, simulation, evaluation

Dissemination of security updates 43 Questions?