1. 9/22/20151 Network Research at College of Computing and Digital Media James Yu, Ph.D. Associate Professor DePaul University jyu@cdm.depaul.edu 08/31/09 DePaul University 1

2. Outline Wireless LAN Security Protection against DoS Attacks Wireless LAN Security Protection against DoS Attacks VoIP Traffic Engineering VoIP Traffic Engineering Netconf for Configuration Validation Netconf for Configuration Validation Hybrid Routing for MANET Hybrid Routing for MANET 08/31/09 DePaul University2

3. WLAN Security: Problem Statement   It is relatively easy for a hacker to send a faked deauthenitcaiton or disaasoication frame to a wireless client, and to terminate its connection to the Wireless Access Point (WAP).   Making it worse, a hacker could flood a wireless client with deauthentication or disassociatation frames.   During the attacks, communications to the client are dead.   802.11i provides an effective mechanism to address crypto attacks, but it does not prevent most DoS attacks. 08/31/09 DePaul University3

4. Research Approach   Building an empirical framework to study DoS attacks over WLANs.   Investigation of DoS attacks on wireless communication.   802.11w – a draft solution to the problem   Network simulation of WLAN DoS Attacks   Implementation and improvement of 802.11w to resolve DoS attacks.   Verification and Validation 08/31/09 DePaul University4

5. DeauthF and DisassF DoS attacks 1.Deauthentication Flooding (DeauthF): A hacker floods the WLAN with faked deauthentication frames to force authenticated wireless clients to drop their connections with the AP. 2.Disassociation Flooding (DisassF): The attacker floods disassociation frames to wireless clients to force them to disconnect from the AP. 08/31/09 DePaul University5

6. Test Environment for WLAN DoS Attacks 08/31/09 DePaul University6

7. Flow Analysis of Deauthentication attacks 08/31/09 DePaul University7

8. 802.11w (draft)   A new draft standard to enhance 802.11i capability   802.11w extends the security protection to 802.11 management frames   Deauthentication or disassociation frames are encrypted and sent to the client. The client check for the authenticity of the management frame and then accept (or reject) it. 08/31/09 DePaul University8

9. Implementation and Analyses of 802.11w  We implement and investigate the performance and effectiveness of 802.11w to protect the management frames of deauthentication and disassociation.  We use the ns-2 simulator to analyze 802.11w under four cases. They are the 1.normal WLAN, 2.the WLAN under DeauthF, 3.the WLAN under DeauthF-802.11w, and 4.the WLAN under DeauthF-802.11w w/ Traffic Shaping. 08/31/09 DePaul University9

10. WLAN under Deauthentication Attacks 08/31/09 DePaul University10

11. WLAN under 802.11w Protection 08/31/09 DePaul University11

12. Traffic Shaping   An enhancement implemented in the 802.1w solution.   Monitor the DoS attacking rate.   When the attacking rate is higher than a threshold value (which is configurable), the client will shape the traffic to no more than 10 fps.   When the attacking rate is below the threshold value, the standard 802.11w operation continues. 08/31/09 DePaul University12

13. WLAN under Protection of 802.11w and Traffic Shaping 08/31/09 DePaul University13

14. Contribution and Future Research   Empirical work   Implementation of 802.11w   To develop a queuing model to explain the attacking scenarios.   The queuing model is to be validated by the empirical results and also the ns-2 simulation model. 08/31/09 DePaul University14

15. Voice Traffic Engineering Goal: Design the network with sufficient capacity to meet the traffic demand with satisfactory performance Goal: Design the network with sufficient capacity to meet the traffic demand with satisfactory performance Demand (A) - Traffic Intensity Demand (A) - Traffic Intensity number of calls × duration of average calls Erlang Erlang Resources (N) – Number of Trunks Resources (N) – Number of Trunks Grade of Service (GoS) – blocking probability Grade of Service (GoS) – blocking probability Erlang B Model Erlang B Model 08/31/09 DePaul University15

16. VoIP Network PSTN Switch SS7 IP (public) Trunk MG SoftSwitch SS7 IP (private)IP (internal) PSTN Switch Access MG Call Manager (SIP Proxy) SoftSwitch Call Manager (Enterprise) Trunk MG Q.931 MG: Media Gateway Carrier VoIP Network 08/31/09 DePaul University16

17. Call Admission Control (CAC) The network (call manager or softswitch) accepts a call request only if it could guarantee the quality of service (QoS) of the call. The network (call manager or softswitch) accepts a call request only if it could guarantee the quality of service (QoS) of the call. In a network with dedicated bandwidth for VoIP, we can calculate the max number of simultaneous calls based on the allocated bandwidth. In a network with dedicated bandwidth for VoIP, we can calculate the max number of simultaneous calls based on the allocated bandwidth. This is the parameter N of the Erlang-B model This is the parameter N of the Erlang-B model Maximum Call Load Maximum Call Load When there are N calls in the network, any new call request will be rejected – When there are N calls in the network, any new call request will be rejected – Same as no trunks are available to route the call. Same as no trunks are available to route the call. 08/31/09 DePaul University17

18. Experimental Results (Bandwidth Utilization) Bandwidth Utilization = observed max call load ÷ expected max call load 08/31/09 DePaul University Problem! 18

19. Analysis – Limiting Resource Most studies consider the bandwidth (bps) as the limiting resource for the VoIP network. Most studies consider the bandwidth (bps) as the limiting resource for the VoIP network. In our experiment, the device (router) is the limiting resource. In our experiment, the device (router) is the limiting resource. Packet Throughput of Cisco 2600 router: 15,000 pps Packet Throughput of Cisco 2600 router: 15,000 pps 15,000 ÷ (1000 ÷ 20) ÷ 4 = 75 calls/sec Packet sampling rate: 20 ms 08/31/09 DePaul University19

20. Current Research Establish a research project with Neutral Tandem – a Telecommunications Service Provider which has an IP-code network for voice traffic. Establish a research project with Neutral Tandem – a Telecommunications Service Provider which has an IP-code network for voice traffic. Collect and analyze the real traffic data Collect and analyze the real traffic data Build a traffic engineering model Build a traffic engineering model Model development Model development Model validation Model validation 08/31/09 DePaul University20

21. Netconf for Network Management 08/31/09 DePaul University21

22. Network Management Requirements Easy to use Easy to use Ability to manipulate complete device configuration rather than individual entities Ability to manipulate complete device configuration rather than individual entities Support multiple configurations Support multiple configurations Configuration transactions across multiple devices simultaneously Configuration transactions across multiple devices simultaneously Human-readable format Human-readable format Integration with existing security infrastructure Integration with existing security infrastructure 08/31/09 DePaul University22

23. Evolution of Network Management Command- Oriented Object-Oriented Document- Oriented Variable-Oriented Transaction- Oriented Vendor specif ic SNMP/MIB CORBA XML-Based NETCONF 08/31/09 DePaul University23

24. NETCONF Transport Secure Shell (SSH) Secure Shell (SSH) Mandatory for NETCONF implementation Mandatory for NETCONF implementation Secured Secured Simple Object Access Protocol (SOAP) Simple Object Access Protocol (SOAP) SOAP over HTTP(s) SOAP over HTTP(s) Web Services support Web Services support Blocks Extensible Exchange Protocol (BEEP) Blocks Extensible Exchange Protocol (BEEP) peers on the transport level peers on the transport level NETCONF Agent NETCONF Manager SSH SOAP BEEP 08/31/09 DePaul University24

25. Netconf-based Validation System 08/31/09 DePaul University25

26. Data Model for Netconf Validation 08/31/09 DePaul University26

27. Current Research Joint Research work with Tail-f which provides the Netconf manager and Netconf agent. Developing a formal language (based on Yang) to specify the data requirements. Software Modules Parsers (requirements) Data aggregator (device configuration data) Validation 2 nd phase: automation of configuration. 08/31/09 DePaul University27

28. Position-based Routing Background The cost of collecting and maintaining routing information in MANET is high. On demand routing solves the problem partially, but still costly when mobility is involved. Location Based Routing (using geographical information) became feasible with the spread of location-aware devices MANET: Mobile Ad Hoc Network 08/31/09 DePaul University28

29. Location-Based Routing Greedy Forwarding: move the packet to the node closer to destination. Pros: No topology information is required No routing loops  used by many location-based routing protocols Cons: Cannot recover dead ends (when the node holding the packet is closer to the destination than its neighbors) Difficult to get the destination location 08/31/09 DePaul University29

30. HMRP Approach Integration of both location-based routing and on demand routing Two forwarding modes Default is Greedy Forwarding Location information is required for first hop only Obtained by exchanging a periodic hello message On Demand shortest-path Used to recover greedy dead-ends Controlled broadcast mechanism to obtain route and geographical information in one request/reply pair Shortest path will be cached and served as a backup route 08/31/09 DePaul University30

31. HMRP Approach (cont’d) HMRP optionally utilizes a Minimum Connected Dominating Set (MCDS) Limit location and route requests to MCDS HMRP can automatically detect and adopt to MCDS if exist HMRP adopts the concept of clustering in a loose manner where a child node can accept replies from any neighboring Dominating nodes if they provide better route information When a child node needs to send information requests, it forwards the request to its dominator which invokes the broadcast mechanism  Improved scalability and less overhead 08/31/09 DePaul University31

32. Performance Evaluation Packet loss End-to-End Latency Performance results are from the ns2 simulator. 08/31/09 DePaul University32

33. Performance Evaluation Path LengthOverhead 08/31/09 DePaul University33

34. HMRP Summary A new approach that combines on demand and location based routing: HMRP has the benefits of both approaches Performance improvement over both Location-Based and On-Demand Provide a new metric (routing capability) which is exchanged in the hello message. This metric is used to improve routing decisions. It is calculated based on several factors such as available node power, and number of packets forwarded 08/31/09 DePaul University34