MPTCP Proxies & Anchors Georg Hampel & Thierry Klein Bell Labs – Alcatel-Lucent draft_hampel_mptcp_proxies_anchors_00.

Slides:

Advertisements

Similar presentations

MPTCP Enhancements to Improve Applicability to Wireless Access Networks draft_hampel_mptcp_applicability_wireless_networks_00 Georg Hampel, Thierry Klein.

Advertisements

mptcp proxies Mark Handley

WELCOME! Multipath TCP Implementors Workshop Saturday 24 th July Maastricht Philip Eardley MPTCP WG Co-chair.

Opportunistic Mobility with Multipath TCP

Project by: Palak Baid (pb2358) Gaurav Pandey (gip2103) Guided by: Jong Yul Kim.

Ye Wang, Xuan Li, Dongtao Liu, Maoke Chen ICCT2006 Guilin, China Optimizing Cost and Performance for Concurrent Multipath Transferring using extended shim6.

TRUE Blind ip spoofed portscanning Thomas Olofsson C.T.O Defcom.

Jennifer Rexford Fall 2014 (TTh 3:00-4:20 in CS 105) COS 561: Advanced Computer Networks Multipath.

Computer Security and Penetration Testing

BASIC CRYPTOGRAPHY CONCEPT. Secure Socket Layer (SSL)  SSL was first used by Netscape.  To ensure security of data sent through HTTP, LDAP or POP3.

TDTS21 Advanced Networking

Overview of the Mobile IPv6 Bootstrapping Problem James Kempf DoCoMo Labs USA Thursday March 10, 2005.

15-441: Computer Networking Lecture 26: Networking Future.

TCP/IP Network and Firewall. IP Packet Protocol  1 ICMP packet  6 TCP packet  17 UDP packet.

Circuit & Application Level Gateways CS-431 Dick Steflik.

Routing of Outgoing Packets with MP-TCP draft-handley-mptcp-routing-00 Mark Handley Costin Raiciu Marcelo Bagnulo.

MPTCP Proxy Support Costin Raiciu. Explicit Proxies The MPTCP host knows about the proxy (e.g. via DHCP) All connections are made to the proxy – Signaling.

Host Identity Protocol

Stateless user-plane for vEPC draft-matsushima-stateless-uplane-vepc-03 Satoru Matsushima Ryuji Wakikawa.

Middleboxes & Network Appliances EE122 TAs Past and Present.

OSI Model Routing Connection-oriented/Connectionless Network Services.

Host Mobility for IP Networks CSCI 6704 Group Presentation presented by Ye Liang, ChongZhi Wang, XueHai Wang March 13, 2004.

8: Network Security8-1 Security in the layers. 8: Network Security8-2 Secure sockets layer (SSL) r Transport layer security to any TCP- based app using.

1 Network Security Revisited ITEC 370 George Vaughan Franklin University.

Mobile IP, PMIP, FMC, and a little bit more

© 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod9_L8 1 Network Security 2 Module 6 – Configure Remote Access VPN.

I-D: draft-rahman-mipshop-mih-transport-01.txt Transport of Media Independent Handover Messages Over IP 67 th IETF Annual Meeting MIPSHOP Working Group.

Network Layer4-1 DHCP: Dynamic Host Configuration Protocol Goal: allow host to dynamically obtain its IP address from network server when it joins network.

CHAPTER 10 Session Hijacking. INTRODUCTION The act of taking over a connection of some sort, for examples, network connection, a modem connection or other.

Authentication Mechanism for Port Control Protocol (PCP) draft-wasserman-pcp-authentication-01.txt Margaret Wasserman Sam Hartman Painless Security Dacheng.

Multipath TCP Update Philip Eardley, MPTCP WG Co-Chair tsvarea 1 st August, IETF-87, Berlin 1.

CISC856 University of Delaware

1 Firewalls Types of Firewalls Inspection Methods  Static Packet Inspection  Stateful Packet Inspection  NAT  Application Firewalls Firewall Architecture.

MultiPath TCP Proxy Presented by: Yongzhi Zhuang, Wei Zeng, Jianlei Zhang.

INTRODUCTION TO NETWORKS 8/2/2015 SSIG SOUTHERN METHODIST UNIVERSITY.

Multipath TCP Security Issues: A Request for Assistance Alan Ford (MPTCP WG)

Deploying IPv6, Now Christian Huitema Architect Windows Networking & Communications Microsoft Corporation.

CMSC Presentation An End-to-End Approach to Host Mobility An End-to-End Approach to Host Mobility Alex C. Snoeren and Hari Balakrishnan Alex C. Snoeren.

Multipath TCP ACM Queue, Volume 12 Issue 2, pp. 1-12, February 2014 Christoph Paasch and Olivier Bonaventure University College London 1.

MPTCP Protocol draft-ietf-mptcp-multiaddressed-02 Update and Open Issues Alan Ford IETF79 – Beijing 1.

IPv6 - The Way Ahead Christian Huitema Architect Windows Networking & Communications

Telecommunications Networking II Lecture 41d Denial-of-Service Attacks.

An Analysis of Using Reflectors for Distributed Denial-of- Service Attacks Paper by Vern Paxson.

PAGE 1 A Firewall Control Protocol (FCON) draft-soliman-firewall-control-00 Hesham Soliman Greg Daley Suresh Krishnan

MPTCP Threat analysis draft-bagnulo-mptcp-threat-00 marcelo bagnulo IETF76 – MPTCP WG.

Lect 8 Tahani al jehain. Types of attack Remote code execution: occurs when an attacker exploits a software and runs a program that the user does not.

Mptcp proxies Mark Handley. MPTCP Mobility Mobile client 3G celltower Server.

MPTCP proxy mechanisms (draft-wei-mptcp-proxy-mechanism-00)

Transport Layer1 TCP Connection Management Recall: TCP sender, receiver establish “connection” before exchanging data segments r initialize TCP variables:

RO without HA Georg Hampel, Thierry Klein draft-hampel-mext-ro-without-ha-00.txt.

An End-to-End Approach to Host Mobility By, Alex C. Snoeren and Prof. Hari Balakrishnan MIT Laboratory for Computer Science Presented by, Parag Namjoshi.

Multi-addressed Multipath TCP draft-ford-mptcp-multiaddressed-02 Alan Ford Costin Raiciu, Mark Handley.

1 Three ways to (ab)use Multipath Congestion Control Costin Raiciu University Politehnica of Bucharest.

MPTCP Proxy MPTCP Client MPTCP Proxy Server.

TPOT Translucent Proxying of TCP Pablo Rodriguez, Sandeep Sibal, Oliver Spatscheck AT&T Labs - Research.

H.323 NAT Traversal Problem particular to H.323(RAS->Q.931->H.245):  RAS from private network to public network can pass NAT  Q931 、 H.245 adopts the.

1 NSIS: A New Extensible IP Signaling Protocol Suite Myungchul Kim Tel:

Could SP-NAT Save the Internet?

BANANA BOF Scope & Problem Description

CS 4700 / CS 5700 Network Fundamentals

By, Nirnimesh Ghose, Master of Science,

MPTCP Lower Layer Implementation & Measurements

General Classes of TCP/IP Problems

Multi-addressed Multipath TCP

BANANA BOF Scope & Problem Description

COS 561: Advanced Computer Networks

Session 20 INST 346 Technologies, Infrastructure and Architecture

0-RTT Converter PoC over Real 5G

TCP Connection Management

Presentation transcript:

MPTCP Proxies & Anchors Georg Hampel & Thierry Klein Bell Labs – Alcatel-Lucent draft_hampel_mptcp_proxies_anchors_00

Host Proxy Anchor Incremental deployment Protocol NAT Some BBM mobility scenarios MPTCP Network Functions on MPTCP Network Nodes Host MPTCP TCP MPTCP Host MPTCP

Host MPTCP Host Anchor MPTCP Host MPTCP Host Anchor MPTCP Examples for MPTCP Anchor Simultaneous MobilityMobility + Firewall

MPTCP NN Femto Where will MPTCP NNs reside? Carrier AP ISP eNodeB LTE Wi-Fi In 3G/4G carrier networks for traffic offload Multiple MPTCP NNs may lie in a chain

Issues: MPTCP-related signaling with Proxies/Anchors Authentication between hosts and Proxies/Anchors Security Implementation

Implicit vs. Explicit Proxy/Anchor Implicit ProxyImplicit Anchor Host Explicit ProxyExplicit Anchor Deployment: Proxy/Anchor resides on 3G/4G access network Authentication: Implicit with access authentication Deployment: Anywhere Authentication: Explicitly needed TCPMPTCP TCP MPTCP

MPTCP  PROXY  TCP MPTCP Host SYN + MP_CAP SYN-ACK + MP_CAP + PROXY = 1 ACK + MP_CAP MPTCP NN SEEK_ADDR ADD_ADDR +JOIN = 0 SYN + MP_JOIN SYN-ACK + MP_JOIN ACK + MP_JOIN Implicit Proxy MPTCP-capable Session Initiator

MPTCP  ANCHOR  MPTCP MPTCP Host SYN + MP_CAP SYN-ACK + MP_CAP ACK + MP_CAP MPTCP NN SEEK_ADDR ADD_ADDR +JOIN = 0 + Addr_ID = 255 SYN + MP_JOIN, Addr_ID=X SYN-ACK+MP_JOIN, Addr_ID=Y ACK + MP_JOIN Implicit Anchor MPTCP-capable Session Initiator SEEK_ADDR ADD_ADDR +JOIN = 0 + Addr_ID = 255 SYN + MP_JOIN, Addr_ID=X + ANCHOR = 1 SYN-ACK+MP_JOIN, Addr_ID=Y ACK + MP_JOIN

ANCHOR ? PROXY ? PROXY MPTCP Host SYN + MP_CAP SYN-ACK +MP_CAP +PROXY=1 ACK + MP_CAP MPTCP NN Implicit Proxy Chains MPTCP NN PROXY MPTCP Host SYN SYN-ACK + MP_CAP ACK MPTCP NN + MP_CAP + PROXY=1 + MP_CAP PROXY ? MPTCP Host SYN SYN-ACK ACK MPTCP NN + MP_CAP + PROXY=1 +MP_CAP +PROXY=1

Explicit signaling: Authentication + Peer’s IP address/PortNo 1.In-band MPTCP signaling: No extensible authentication possible  dismissed 2. Out-of-band MPTCP signaling: HTTPS? IPsec? Beyond scope of MPTCP?  not considered 3. Authentication via pre-shared keys: 32-bit host ID + + MPTCP key derived from pre-shared keys + + Peer’s IP/Port = ~40B (IPv6) 4. External signaling protocol: Host + NN establish MPTCP key, host sends peer’s IP/port 5. External protocol for signaling & traffic: Transparent to MPTCP  not considered Explicit Proxy/Anchor

MPTCP  PROXY  TCP MPTCP Host SYN + MP_CAP (keyA) ACK + FWD_ADDR(IP, Prt) MPTCP NN SYN + MP_JOIN SYN-ACK + MP_JOIN ACK + MP_JOIN Explicit Proxy Authentication via Pre-Shared Keys SYN-ACK + MP_CAP (keyN) SYN + MP_CAP(keyA) + ANCHOR = 1 SYN-ACK ACK + MP_CAP() + PROXY = 1 ACK 4-way handshake 3-way handshake

MPTCP  ANCHOR  MPTCP MPTCP Host SYN + MP_CAP (keyA) ACK + FWD_ADDR(IP, Prt) MPTCP NN Explicit Anchor Authentication via Pre-Shared Keys SYN-ACK + MP_CAP (keyN) SYN + MP_CAP(keyA) + ANCHOR = 1 SYN-ACK + MP_CAP(keyB) ACK + MP_CAP(keyB) + ANCHOR = 1 ACK + MP_CAP(keyA, keyB) SYN + MP_JOIN, Addr_ID=X SYN-ACK+MP_JOIN, Addr_ID=Y ACK + MP_JOIN SYN + MP_JOIN, Addr_ID=X + ANCHOR = 1 SYN-ACK+MP_JOIN, Addr_ID=Y ACK + MP_JOIN 4-way handshake 3-way handshake

PROXY Chain of Explicit Anchor/Proxy + Implicit Proxy Authentication via Pre-Shared Keys ANCHOR MPTCP Host SYN + MP_CAP (keyA) ACK + FWD_ADDR(IP, Prt) Explicit MPTCP NN SYN-ACK + MP_CAP (keyEN) SYN + MP_CAP(keyA) + ANCHOR = 1 + MP_CAP(keyIN) + PROXY = 1 ACK + MP_CAP(keyIN) + PROXY = 1 + ANCHOR = 1 ACK + MP_CAP(keyA, keyIN) Implicit MPTCP NN SYN-ACK SEEK_ADDR ADD_ADDR, Addr_ID = X +JOIN = 0 ADD_ADDR, Addr_ID = 255 +JOIN = 0 4-way hand shake 3-way hand shake

Security - Explicit Proxy/Anchor Security problem in absence of proper authentication: Distributed-DoS attacker uses proxy to hide its IP address Attacker Victim IP_SRC = ATTACK IP_DST = Proxy IP_SRC = Proxy IP_DST = VICTIM MPTCP NN

MPTCP Host MPTCP Anchor Simultaneous Mobility with (Implicit) Anchor Traffic SYN + MP_JOIN TCP RST SYN + MP_JOIN TCP RST SYN + MP_JOIN Caches SRC IP TCP RST Caches SRC IP TCP RST SYN + MP_JOIN SYN-ACK + MP_JOIN

Proxy Realization Proxy creates logical MPTCP – TCP split connection Large number of connections: Minimize cost-per-connection Minimize cost if only one path  Design implications ! Minimize buffer for multipath  Design implications ! Cost-vs-Feature Tradeoff Mobility only  Simple, low-cost implementation Multipath  Higher performance at higher price

MPTCP Re-Charter Proposal 1. Proxies & Anchors 2. Mobility