1. 1 CS 144r: Networks Design Projects CS 244r: Advanced Networks Design Projects HBS 4560: The Future of Business Networks Anonymizing Infrastructure February 22, 2002 Professor Marco Iansiti, HBS Professor H. T. Kung, FAS Harvard University

2. 2 Topics for Today Overview of an IP-layer anonymizing infrastructure Project on attacking the anonymizing infrastructure

3. 3 Problem To Solve An authentication server, by definition, needs to process requests from unknown users; thus, it can be subject to DOS attacks Authentication Server Clients The Internet

4. 4 A Solution Approach Based on an Anonymizing Infrastructure Provide an IP-layer anonymizing infrastructure that can hide IP addresses of authentication servers from clients Provide an IP-layer anonymizing infrastructure that can hide IP addresses of authentication servers from clients This anonymizing infrastructure can be useful for current and future authentication servers and other servers This anonymizing infrastructure can be useful for current and future authentication servers and other servers

5. 5 The Traditional Internet: Packet Reveals Server Address in the Clear Server 140.247.60.30 Client Packet The Internet 140.247.60.30 D

6. 6 The Anonymizing Infrastructure: Use Forwarders to Hide Servers’ Addresses Server Client Addresses encrypted in Fs’ keys Bay Networks D Bay Networks D Bay Networks D Bay Networks D F1 F2 The infrastructure is an overlay network of forwarders, Fs The infrastructure is an overlay network of forwarders, Fs Forwarders are stateless and use anycast addresses for improved availability Forwarders are stateless and use anycast addresses for improved availability

7. 7 Use of Gateways To Allow Existing Clients and Servers Without Modification Server Client Bay Networks D Bay Networks D Bay Networks D Bay Networks D F1 F2 GWc GWs Gateways, GWc and GWs, allow existing clients and servers to use the anonymous forwarding infrastructure without modification Gateways, GWc and GWs, allow existing clients and servers to use the anonymous forwarding infrastructure without modification Initialization Server

8. 8 Three Usage Steps for the Anonymizing Infrastructure 1.: Given a server, select a sequence of forwarders, compute the encrypted IP address for the server, and register the results 1.Server Registration: Given a server, select a sequence of forwarders, compute the encrypted IP address for the server, and register the results The sequence of forwarders can be selected m or automatically The sequence of forwarders can be selected manually or automatically 2. 2.Client Initialization: Given a server, obtain the encrypted address for the server, the address of the first decrypting forwarder, and other information required for forwarding 3.: forward packets over the selected sequence of forwarders 3.Packet Forwarding: forward packets over the selected sequence of forwarders

9. 9 Internet Drafts and Mailing List Internet Drafts: Internet Drafts: Bradner, S., and Kung, H. T., "Requirements for an Anonymizing Packet Forwarder,", November 2001 Bradner, S., and Kung, H. T., "Requirements for an Anonymizing Packet Forwarder,", November 2001 Kung, H. T. and Bradner, S., "A Framework for an Anonymizing Packet Forwarder,", November 2001. Kung, H. T. and Bradner, S., "A Framework for an Anonymizing Packet Forwarder,", November 2001. Mailing list: Mailing list: http://wireless.eecs.harvard.edu/anon Comments would be appreciated

10. 10 Experimental System for an Anonymizing Infrastructure nonymizing infrastructureWe have implemented the three usage steps for an anonymizing infrastructure A FreeBSD-based experimental system is working in our lab at HarvardA FreeBSD-based experimental system is working in our lab at Harvard In the following we use our experimental system to illustrate the three stepsIn the following we use our experimental system to illustrate the three steps

11. 11 Step 1: Server Registration Server alias: Server IP address: 1st forwarder: Server port numbers: 2nd forwarder: Kerberos Server in CS at Harvard 140.247.60.105 88

12. 12 Step 2: Client Initialization Server Client Bay Networks D Bay Networks D Bay Networks D Bay Networks D F1 F2 Initialization Server Client obtains information, such as server ’ s address encrypted in Fs ’ keys and F1 ’ s address, from an initialization server Client obtains information, such as server ’ s address encrypted in Fs ’ keys and F1 ’ s address, from an initialization server

13. 13 Step 3: Packet Forwarding Server Client Bay Networks D Bay Networks D Bay Networks D Bay Networks D F1 F2 Initialization Server Client ’ s packet is forwarded to F1. F1 decrypts the address and discovers the next hop is F2. Then packet is forwarded to F2, etc. Client ’ s packet is forwarded to F1. F1 decrypts the address and discovers the next hop is F2. Then packet is forwarded to F2, etc. The return path is from server to F2, F1 and client The return path is from server to F2, F1 and client

14. 14 Use of Client and Server Gateways in Our Experimental System Server Client Bay Networks D Bay Networks D Bay Networks D Bay Networks D F1 F2 GWc GWs Gateways, GWc and GWs, allow existing clients and servers to use the anonymous forwarding infrastructure without modification Gateways, GWc and GWs, allow existing clients and servers to use the anonymous forwarding infrastructure without modification Initialization Server

15. 15 Experimental System Platform Use divert socket on FreeBSD-4.4 machines (http://www.freebsd.org/) in implementing forwarders, GWc and GWs Use divert socket on FreeBSD-4.4 machines (http://www.freebsd.org/) in implementing forwarders, GWc and GWshttp://www.freebsd.org/ PPTP VPN: mpd (netgraph multi-link PPP daemon) PPTP VPN: mpd (netgraph multi-link PPP daemon) Crypto software Crypto software Public key: RSA from OpenSSL (http://www.openssl.org/) Public key: RSA from OpenSSL (http://www.openssl.org/)http://www.openssl.org/ Symmetric key: 128-bit AES (Rijndael) (http://www.nist.gov/aes/) Symmetric key: 128-bit AES (Rijndael) (http://www.nist.gov/aes/)http://www.nist.gov/aes/

16. 16 Two Threat Models 1)Monitoring a forwarder’s input & output, or compromising a forwarder Capture client and forwarder or server address Capture client and forwarder or server address 2)Using the anonymizing infrastructure to launch attacks Make tracking of attackers difficult Make tracking of attackers difficult

17. 17 Countermeasures (See the Next Three Slides) Multi-hop forwarding to make it hard to discover the exit forwarder before the server Multi-hop forwarding to make it hard to discover the exit forwarder before the server Uncorrelated, per-packet encryption for each of the hops (except the hop between the client to the first forwarder where encryption is not needed) to defend against unauthorized monitoring Uncorrelated, per-packet encryption for each of the hops (except the hop between the client to the first forwarder where encryption is not needed) to defend against unauthorized monitoring Protocol camouflaging Protocol camouflaging Spaghetti forwarding Spaghetti forwarding

18. 18 Multi-hop Forwarding Server Client Bay Networks D Bay Networks D F1 F2 Bay Networks D F3 Bay Networks D F4 To locate F4, the exit forwarder, the entire path (F1, F2, F3, F4) will need to be discovered To locate F4, the exit forwarder, the entire path (F1, F2, F3, F4) will need to be discovered

19. 19 Uncorrelated, Per-packet Encryption in Our Experimental System Server Client Bay Networks D Bay Networks D F1 F2 GWc GWs N submissions of the same packet When there is unauthorized monitoring, this feature makes it difficult for attackers to use traffic analysis to discover the forwarding path When there is unauthorized monitoring, this feature makes it difficult for attackers to use traffic analysis to discover the forwarding path N different encrypted packet payloads

20. 20 Camouflaged TCP over UDP IP header TCP header TCP payload IP header UDP header TCP payload TCP header IP header TCP header TCP payload UDP header TCP header Normal TCP TCP over UDP Camouflaged TCP over UDP

21. 21 Spaghetti Forwarding Bay Networks D Bay Networks D F1 F4 Bay Networks D F3 Bay Networks D F2 Server Client

22. 22 Additional Countermeasures Rate limiting forwarders Rate limiting forwarders Dynamic re-selection of forwarders Dynamic re-selection of forwarders Secure connection between GWc and Initialization Server to ensure the former receives trustworthy information from the latter Secure connection between GWc and Initialization Server to ensure the former receives trustworthy information from the latter

23. 23 Revisit the Project Definition: Attacking An Experimental Anonymizing Infrastructure Attacker’s objective Attacker’s objective Find the IP address that the anonymizing infrastructure tries to hide Find the IP address that the anonymizing infrastructure tries to hide Assumptions Assumptions Links in the infrastructure and those connected to it can be monitored Links in the infrastructure and those connected to it can be monitored Demonstration Demonstration Given an encrypted IP address of a server, find its true address Given an encrypted IP address of a server, find its true address Attacker’s score Attacker’s score An attacker’s score decreases exponentially in the number of false forwarders explored An attacker’s score decreases exponentially in the number of false forwarders explored

24. 24 The Testbed Initialization Sever Client GW c GW s F2F2 F1F1 Server SSL VPN