Outline : Computer Networking. Narrow Waist of the Internet Key to its Success. NSF Future Internet Architecture

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Outline. 15-744: Computer Networking. Narrow Waist of the Internet Key to its Success. NSF Future Internet Architecture"

Transcription

1 Outline : Computer Networking L-15 Future Internet Architecture 2 Motivation and discussion Some proposals: CCN Nebula Mobility First XIA XIA overview AIP Scion 2 NSF Future Internet Architecture Narrow Waist of the Internet Key to its Success Program focuses on new architectural Internet features - address challenges in fundamental way Want to keep the good features of today s network Four teams were selected in the second phase: Named Data Networking: content centric networking - data is a (the) first class entity Mobility First: mobility as the norm rather than the exception generalizes delay tolerant networking Nebula: Internet centered around cloud computing data centers that are well connected expressive Internet Architecture: focus on trustworthiness, evolvability 3 Has allowed Internet to evolve dramatically But now an obstacle to addressing challenges: No built-in security New usage models a challenge Limited interactions edge-core Applications Internet Protocol Link Technologies XIA exploring three concepts to address issues: Diverse types of end-points Intrinsic security Flexible addressing 1

2 Today s Internet expressive Internet Architecture Src: Client IP Dest: Server IP Src: Client ID Dest: ID TCP Client IP Server IP Client retrieves document from a specific web server But client mostly cares about correctness of content, timeliness Specific server, file name, etc. are not of interest Transfer is between wrong principals What if the server fails? Optimizing transfer using local caches is hard Need to use application-specific overlay or transparent proxy bad! 5 PDA Client expresses communication intent for content explicitly Network uses content identifier to retrieve content from appropriate location How does client know the content is correct? Intrinsic security! Verify content using self-certifying id: hash(content) = content id How does source know it is talking to the right client? Intrinsic security! Self-certifying host identifiers 6 Three Key Principles An set of principals allows direct identification of the intended communicating entities Not having to force communication at a lower level (hosts in today s Internet) reduces complexity and overhead Set up principals can evolve over time Adapt to changes in usage models Support custom requirements of specific deployments Intrinsic security guarantees security properties as a direct result of the design of the system Do not rely on external configurations, actions, data bases 7 Other XIA Principles Narrow waist for all principals Defines the API between the principals and the network protocol mechanisms Narrow waist for trust management Ensure that the inputs to the intrinsically secure system match the trust assumptions and intensions of the user Narrow waist allows leveraging diverse mechanisms for trust management: CAs, reputation, personal, All other network functions are explicit services Keeps the architecture simple, easy to reason about XIA provides a principal type for services (visible) 8 2

3 XIA: expressive Internet Architecture Each communication operation expresses the intent of the operation Also: explicit trust management, APIs among actors XIA is a single inter-network in which all principals are connected Not a collection of architectures implemented through, e.g., virtualization or overlays Not based on a preferred principal (host or content), that has to support all communication 9 Multiple Principal Types Associated with different forwarding semantics Support heterogeneity in usage and deployment models Set of principal types can evolve over time Host XIDs support host-based communication who? Service XIDs allow the network to route to possibly replicated services what does it do? LAN services access, WAN replication, XIDs allow network to retrieve content from anywhere what is it? Opportunistic caches, CDNs, Autonomous domains allow scoping, hierarchy 10 Multiple Principal Types -centric Optimizations Choice involves tradeoffs: Control Trust Efficiency Privacy Service Host HID Service Host HID HTML Cached Service 11 Service HID 12 3

4 What Do We Mean by Evolvability? Narrow waist of the Internet has allowed the network to evolve significantly But need to evolve the waist as well! Can make the waist smarter IP: Evolvability of: Applications Link technologies XIA adds evolvability at the waist: Applications Evolving set of principals Link technologies Supporting Evolvability Introduction of a new principal type will be incremental no flag day! Not all routers and ISPs will have support from day one Creates chicken and egg problem - what comes first: network support or use in applications Solution is to provide an intent and fallback address Intent address allows innetwork optimizations based on user intent Fallback address is guaranteed to be reachable. AD:HID AD:HID. Payload Dest Src 14 Addressing Requirements Our Solution: DAG-Based Addressing Fallback: intent that may not be globally understood must include a backwards compatible address Incremental introduction of new XID types Scoping: support reachability for non-globally routable XID types or XIDs Needed for scalability Generalize scoping based on network identifiers But we do not want to give up leveraging intent Iterative refinement: give each XID in the hierarchy option of using intent 15 Uses direct acyclic graph (DAG) Nodes: typed IDs (XID; expressive identifier) Outgoing edges: possible routing choices Simple example: Sending a packet to HID S Dummy source: special node indicating packet sender HID S Intent: final destination of packet with no outgoing edges 16 4

5 Support for Fallbacks with DAG DAGs Support Scoping and Iterative Refinement A node can have multiple outgoing edges Fallback edge HID S Primary edges A Client side Server-side domain hierarchy S Outgoing edges have priority among them Forwarding to HID S is attempted if forwarding to A is not possible Realization of fallbacks AD 0 HID S Intrinsic Security in XIA Example: Secure Mobile Service Access XIA uses self-certifying identifiers that guarantee security properties for communication operation Host ID is a hash of its public key accountability (AIP) ID is a hash of the content correctness Does not rely on external configurations Intrinsic security is specific to the principal type Example: retrieve content using XID: content is correct Service XID: the right service provided content Host XID: content was delivered from right host 19 X AD BoF BOF S2 Server S: HID S BoF AD BoF : BoF Client C: HID C C AD C Server S2: HID S2 BoF Register bof.com -> AD BOF : BOF XIA Internet AD C2 Client C: HID C C AD BoF :HID S : BoF AD C :HID C : C AD BoF :HID S2 : BoF AD C :HID C : C AD BoF :HID S2 : BoF AD C2 :HID C : C Resolv bof.com AD BOF : BOF Name Resolution Service 20 5

6 XIA Dataplane Concepts Also in the Paper Directly support diverse network usage models Evolution of principal types Customization Multiple Communicating Principal Types Principal-specific security properties How to build an XIA forwarding engine XIA forwarding performance and comparison with IP Flexible Addressing Deal with routing failures DAG security Intrinsic Security Built in security forms basis for system level security Discussion on scalability of content caching 22 Outline Motivation and discussion Some proposals: CCN Nebula Mobility First XIA XIA overview AIP Scion AIP Motivation Many security challenges are a result of not being able to unambiguously determine who is responsible for a specific action Source spoofing, denial-of-service attacks, untraceable spam,.. Add accountability to the Internet architecture Key idea is to use self-certifying addresses for both hosts and domains Avoid dependence on external configurations E.g. global trust authority

7 Addressing and Routing Self-Certifying Identifiers ADe ADe:EID9 ADx ADy Addresses are hierarchical, similar to today s Internet But each level has a flat address, i.e. no R ADa ADb Until packet reaches destination AD, intermediate routers use only destination AD to forward packet Effectively uses a pointer in a stack of domain identifiers Upon reaching destination AD, forward based on EID ADa:ADb:EID1 Identifier of object is public key of object Convenient to use hash of key (e.g. fixed size) Need way of securely mapping user readable name into the identifier AD is hash of public key of domain EID is hash of public key of host Provides a means of verifying the correctness of the source identifiers in a packet Effectively by sending a challenge to the source that it must sign with its private key Example: AD verification Verification Packet Receive packet source AD:X Forward packet Drop packet Send V to source In accept cache? Trust neighboring AD? Pass urpf? Router sends a packet V to Source containing: Source and destination identifier Hash of the packet P Interface of the router A secret signed by R Source signs V with its private key and send it back to R But only if it recognizes the hash R verifies that it was signed correctly using the public key from the source field If they match, R add S to its cache

8 AIP Discussion AIP adds complexity to routers Crypto support, caches, larger forwarding tables,.. but accountability helps address number of security challenges Reduces complexity and cost in rest of networks Research question Fast look up in large tables of flat identifiers Managing keys (revocation, minting, ) Evolving of the crypto Outline Motivation and discussion Some proposals: CCN Nebula Mobility First XIA XIA overview AIP Scion SCION Architectural Goals Wish List (1): Isolation Scalability, Control, and Isolation on Next-generation networks (SCION) High availability, even for networks with malicious parties Explicit trust for network operations Minimal TCB: limit number of entities that need to be trusted for any operation Strong isolation from untrusted parties Operate with mutually distrusting entities No single root of trust Enable route control for ISPs, receivers, senders Simplicity, efficiency, flexibility, and scalability Localization of attacks Scalable and reliable routing updates Operate with mutually distrusting entities without a global single root of trust A B D C Attacks (e.g., bad routes) M L3 PSC CMU I

9 Wish List (2): Balanced Control Wish List (3): Explicit Trust Source: select paths to send packets Destination: select paths to receive packets Transit ISPs: select paths to support Support rich policies and DDoS defenses A B D C Please reach me via A or B Hide the peering link from CMU Use Level 3 by default L3 I2 PSC CMU 33 Know who needs to be trusted Select whom to trust Confidence in selected paths Enforceable accountability Level 3 Who Go through will forward X and Z, Packets but not Y on the path? X Y Z Internet I2 PSC CMU 34 SCION Architectural Goals SCION Architecture Overview High availability, even for networks with malicious parties Explicit trust for network operations Minimal TCB: limit number of entities that need to be trusted for any operation Strong isolation from untrusted parties Operate with mutually distrusting entities No single root of trust Enable route control for ISPs, receivers, senders Simplicity, efficiency, flexibility, and scalability Trust domain (TD)s Isolation and scalability Path construction Path construction beacons (PCBs) Path resolution Control Explicit trust Route joining (shortcuts) Efficiency, flexibility PCB PCB PCB Source TD TD Core path srv S: blue paths D: red paths Destination

10 Hierarchical Decomposition Path Construction Split the network into a set of trust domains (TD) : interface : Opaque field : expiration time : signature TD: isolation of route computation core TD cores: interconnected large ISPs core = MAC( ) = SIG( ) = MAC( ) TD Core PCB PCB A Down paths Up paths = SIG( ) AD: atomic failure unit Destination Source 37 = MAC( ) = SIG( ) Embed into pkts PCB PCB B C 38 SCION Security Benefits Isolation Scalability, freshness Path replay attack Collusion attack Single root of trust Trusted Computing Base Path Control S-BGP etc Whole Internet SCION TD Core and on-path ADs Source End-to-end control Only up-path Destination No control Inbound paths DDoS Open attacks Enable defenses Choice Points in XIA Customers have choices: Choice of XID type, i.e. how is communication operation performed; different tradeoffs DAGs add flexibility: fallback, services, Scion offers some control over path selection Flexible trust management Distributed XID assignment (no single point of control) Service providers have choices as well Use of XID types to optimize new services Scion allows new path optimization options Use DAGs for binding, scoping, mobility,

Packet Level Authentication Overview

Packet Level Authentication Overview Packet Level Authentication Overview Dmitrij Lagutin, Dmitrij.Lagutin@hiit.fi Helsinki Institute for Information Technology HIIT Aalto University School of Science and Technology Contents Introduction

More information

SCION: Scalability, Control, and Isolation On Next-Generation Networks

SCION: Scalability, Control, and Isolation On Next-Generation Networks 1 SCION: Scalability, Control, and Isolation On Next-Generation Networks Xin Zhang, Hsu-Chun Hsiao, Geoffrey Hasker, Haowen Chan, Adrian Perrig and David G. Andersen CyLab / Carnegie Mellon University

More information

Distributed Systems. 23. Content Delivery Networks (CDN) Paul Krzyzanowski. Rutgers University. Fall 2015

Distributed Systems. 23. Content Delivery Networks (CDN) Paul Krzyzanowski. Rutgers University. Fall 2015 Distributed Systems 23. Content Delivery Networks (CDN) Paul Krzyzanowski Rutgers University Fall 2015 November 17, 2015 2014-2015 Paul Krzyzanowski 1 Motivation Serving web content from one location presents

More information

Active ISP Involvement in Content-Centric Future Internet. 2013.01.23 Eugene Kim

Active ISP Involvement in Content-Centric Future Internet. 2013.01.23 Eugene Kim Active ISP Involvement in Content-Centric Future Internet 2013.01.23 Eugene Kim 1 4th IFIP International Conference on New Technologies, Mobility and Security, NTMS 2011 Paris, France, February 7-10, 2011.

More information

draft-forwarding-label-ccn- 01.txt

draft-forwarding-label-ccn- 01.txt draft-forwarding-label-ccn- 01.txt Ravi Ravindran and Asit Chakraborti Huawei (IETF/ICNRG, Yokohama, 94) [ravi.ravindran@huawei.com] [asit.chakraborti@huawei.com] Agenda Draft Objectives Terminology Why

More information

Distributed Systems. 25. Content Delivery Networks (CDN) 2014 Paul Krzyzanowski. Rutgers University. Fall 2014

Distributed Systems. 25. Content Delivery Networks (CDN) 2014 Paul Krzyzanowski. Rutgers University. Fall 2014 Distributed Systems 25. Content Delivery Networks (CDN) Paul Krzyzanowski Rutgers University Fall 2014 November 16, 2014 2014 Paul Krzyzanowski 1 Motivation Serving web content from one location presents

More information

Security in Structured P2P Systems

Security in Structured P2P Systems P2P Systems, Security and Overlays Presented by Vishal thanks to Dan Rubenstein Columbia University 1 Security in Structured P2P Systems Structured Systems assume all nodes behave Position themselves in

More information

Firewalls and Intrusion Detection

Firewalls and Intrusion Detection Firewalls and Intrusion Detection What is a Firewall? A computer system between the internal network and the rest of the Internet A single computer or a set of computers that cooperate to perform the firewall

More information

LAN TCP/IP and DHCP Setup

LAN TCP/IP and DHCP Setup CHAPTER 2 LAN TCP/IP and DHCP Setup 2.1 Introduction In this chapter, we will explain in more detail the LAN TCP/IP and DHCP Setup. 2.2 LAN IP Network Configuration In the Vigor 2900 router, there are

More information

Extending the Internet of Things to IPv6 with Software Defined Networking

Extending the Internet of Things to IPv6 with Software Defined Networking Extending the Internet of Things to IPv6 with Software Defined Networking Abstract [WHITE PAPER] Pedro Martinez-Julia, Antonio F. Skarmeta {pedromj,skarmeta}@um.es The flexibility and general programmability

More information

Internet Ideal: Simple Network Model

Internet Ideal: Simple Network Model Middleboxes Reading: Ch. 8.4 Internet Ideal: Simple Network Model Globally unique identifiers Each node has a unique, fixed IP address reachable from everyone and everywhere Simple packet forwarding Network

More information

JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA

JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA To purchase Full version of Practice exam click below; http://www.certshome.com/jk0-022-practice-test.html FOR CompTIA JK0-022 Exam Candidates

More information

Bit Chat: A Peer-to-Peer Instant Messenger

Bit Chat: A Peer-to-Peer Instant Messenger Bit Chat: A Peer-to-Peer Instant Messenger Shreyas Zare shreyas@technitium.com https://technitium.com December 20, 2015 Abstract. Bit Chat is a peer-to-peer instant messaging concept, allowing one-to-one

More information

Lecture 17 - Network Security

Lecture 17 - Network Security Lecture 17 - Network Security CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ Idea Why donʼt we just integrate some of these neat

More information

Multihoming and Multi-path Routing. CS 7260 Nick Feamster January 29. 2007

Multihoming and Multi-path Routing. CS 7260 Nick Feamster January 29. 2007 Multihoming and Multi-path Routing CS 7260 Nick Feamster January 29. 2007 Today s Topic IP-Based Multihoming What is it? What problem is it solving? (Why multihome?) How is it implemented today (in IP)?

More information

Agenda. Distributed System Structures. Why Distributed Systems? Motivation

Agenda. Distributed System Structures. Why Distributed Systems? Motivation Agenda Distributed System Structures CSCI 444/544 Operating Systems Fall 2008 Motivation Network structure Fundamental network services Sockets and ports Client/server model Remote Procedure Call (RPC)

More information

Internetworking. Problem: There is more than one network (heterogeneity & scale)

Internetworking. Problem: There is more than one network (heterogeneity & scale) Internetworking Problem: There is more than one network (heterogeneity & scale) Hongwei Zhang http://www.cs.wayne.edu/~hzhang Internetworking: Internet Protocol (IP) Routing and scalability Group Communication

More information

Florian Liers, Thomas Volkert, Andreas Mitschele-Thiel

Florian Liers, Thomas Volkert, Andreas Mitschele-Thiel Florian Liers, Thomas Volkert, Andreas Mitschele-Thiel The Forwarding on Gates architecture: Flexible placement of QoS functions and states in internetworks Original published in: International Journal

More information

SANE: A Protection Architecture For Enterprise Networks

SANE: A Protection Architecture For Enterprise Networks Fakultät IV Elektrotechnik und Informatik Intelligent Networks and Management of Distributed Systems Research Group Prof. Anja Feldmann, Ph.D. SANE: A Protection Architecture For Enterprise Networks WS

More information

This Lecture. The Internet and Sockets. The Start 1969. If everyone just sends a small packet of data, they can all use the line at the same.

This Lecture. The Internet and Sockets. The Start 1969. If everyone just sends a small packet of data, they can all use the line at the same. This Lecture The Internet and Sockets Computer Security Tom Chothia How the Internet works. Some History TCP/IP Some useful network tools: Nmap, WireShark Some common attacks: The attacker controls the

More information

A Coordinated. Enterprise Networks Software Defined. and Application Fluent Programmable Networks

A Coordinated. Enterprise Networks Software Defined. and Application Fluent Programmable Networks A Coordinated Virtual Infrastructure for SDN in Enterprise Networks Software Defined Networking (SDN), OpenFlow and Application Fluent Programmable Networks Strategic White Paper Increasing agility and

More information

From the previous lecture

From the previous lecture CS 640: Introduction to Computer Networks Aditya Akella Lecture 7 - IP: Addressing and Forwarding From the previous lecture We will cover spanning tree from the last lecture 2 Spanning Tree Bridges More

More information

Hosting more than one FortiOS instance on. VLANs. 1. Network topology

Hosting more than one FortiOS instance on. VLANs. 1. Network topology Hosting more than one FortiOS instance on a single FortiGate unit using VDOMs and VLANs 1. Network topology Use Virtual domains (VDOMs) to divide the FortiGate unit into two or more virtual instances of

More information

Internet Firewall CSIS 4222. Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS 4222. net15 1. Routers can implement packet filtering

Internet Firewall CSIS 4222. Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS 4222. net15 1. Routers can implement packet filtering Internet Firewall CSIS 4222 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 27: Internet Routing Ch 30: Packet filtering & firewalls

More information

Chapter 9 Firewalls and Intrusion Prevention Systems

Chapter 9 Firewalls and Intrusion Prevention Systems Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish

More information

Internet Privacy Options

Internet Privacy Options 2 Privacy Internet Privacy Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 19 June 2014 Common/Reports/internet-privacy-options.tex, r892 1 Privacy Acronyms

More information

CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013

CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013 CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access

More information

Security Considerations for Intrinsic Monitoring within IPv6 Networks: Work in Progress

Security Considerations for Intrinsic Monitoring within IPv6 Networks: Work in Progress Security Considerations for Intrinsic Monitoring within IPv6 Networks: Work in Progress Alan Davy and Lei Shi Telecommunication Software&Systems Group, Waterford Institute of Technology, Ireland adavy,lshi@tssg.org

More information

Secure Networks for Process Control

Secure Networks for Process Control Secure Networks for Process Control Leveraging a Simple Yet Effective Policy Framework to Secure the Modern Process Control Network An Enterasys Networks White Paper There is nothing more important than

More information

Inter-provider Coordination for Real-Time Tracebacks

Inter-provider Coordination for Real-Time Tracebacks Inter-provider Coordination for Real-Time Tracebacks Kathleen M. Moriarty 2 June 2003 This work was sponsored by the Air Force Contract number F19628-00-C-002. Opinions, interpretations, conclusions, and

More information

IP address format: Dotted decimal notation: 10000000 00001011 00000011 00011111 128.11.3.31

IP address format: Dotted decimal notation: 10000000 00001011 00000011 00011111 128.11.3.31 IP address format: 7 24 Class A 0 Network ID Host ID 14 16 Class B 1 0 Network ID Host ID 21 8 Class C 1 1 0 Network ID Host ID 28 Class D 1 1 1 0 Multicast Address Dotted decimal notation: 10000000 00001011

More information

SiteCelerate white paper

SiteCelerate white paper SiteCelerate white paper Arahe Solutions SITECELERATE OVERVIEW As enterprises increases their investment in Web applications, Portal and websites and as usage of these applications increase, performance

More information

Integrating Security, Mobility, and Multi-Homing in a HIP way

Integrating Security, Mobility, and Multi-Homing in a HIP way Integrating Security, Mobility, and Multi-Homing in a way Pekka Nikander Ericsson Research Nomadiclab & Helsinki Institute for Information Technology Outline The problem: TCP/IP is getting old Locators

More information

RID-DoS: Real-time Inter-network Defense Against Denial of Service Attacks. Kathleen M. Moriarty. MIT Lincoln Laboratory.

RID-DoS: Real-time Inter-network Defense Against Denial of Service Attacks. Kathleen M. Moriarty. MIT Lincoln Laboratory. : Real-time Inter-network Defense Against Denial of Service Attacks Kathleen M. Moriarty 22 October 2002 This work was sponsored by the Air Force Contract number F19628-00-C-002. Opinions, interpretations,

More information

A REPORT ON ANALYSIS OF OSPF ROUTING PROTOCOL NORTH CAROLINA STATE UNIVERSITY

A REPORT ON ANALYSIS OF OSPF ROUTING PROTOCOL NORTH CAROLINA STATE UNIVERSITY A REPORT ON ANALYSIS OF OSPF ROUTING PROTOCOL Using OPNET 14.5 Modeler NORTH CAROLINA STATE UNIVERSITY SUBMITTED BY: SHOBHANK SHARMA ssharma5@ncsu.edu Page 1 ANALYSIS OF OSPF ROUTING PROTOCOL A. Introduction

More information

The Network Level in Local Area Networks. Fulvio Risso Politecnico di Torino

The Network Level in Local Area Networks. Fulvio Risso Politecnico di Torino The Network Level in Local Area Networks Fulvio Risso Politecnico di Torino 1 LANs and Routers Routers are a fundamental part of a LAN We cannot imagine a network without access to the Internet and/or

More information

Kick starting science...

Kick starting science... Computer ing (TDDD63): Part 1 Kick starting science... Niklas Carlsson, Associate Professor http://www.ida.liu.se/~nikca/ What do you have in the future? What do you have in the future? How does it keep

More information

Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security

Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 6 Network Security Objectives List the different types of network security devices and explain how they can be used Define network

More information

Naming and Addressing

Naming and Addressing Naming and Addressing Protocol Design S-38.3157 2008 Jörg Ott & Carsten Bormann 1 Identifying Communication Partners Names Human readable identifiers that can be remembered! (e.g., DNS name, URI, URN)

More information

Protocol Rollback and Network Security

Protocol Rollback and Network Security CSE 484 / CSE M 584 (Spring 2012) Protocol Rollback and Network Security Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee,

More information

The OSI Model and the TCP/IP Protocol Suite

The OSI Model and the TCP/IP Protocol Suite The OSI Model and the TCP/IP Protocol Suite 1 Example 1 Assume Maria and Ann are neighbors with a lot of common ideas. However, Maria speaks only Spanish, and Ann speaks only English. Since both have learned

More information

How Network Transparency Affects Application Acceleration Deployment

How Network Transparency Affects Application Acceleration Deployment How Network Transparency Affects Application Acceleration Deployment By John Bartlett and Peter Sevcik July 2007 Acceleration deployments should be simple. Vendors have worked hard to make the acceleration

More information

Internetworking II: MPLS, Security, and Traffic Engineering

Internetworking II: MPLS, Security, and Traffic Engineering Internetworking II: MPLS, Security, and Traffic Engineering 3035/GZ01 Networked Systems Kyle Jamieson Department of Computer Science University College London Last Fme: Internetworking IP interconnects

More information

Monitoring WAAS Using Cisco Network Analysis Module. Information About NAM CHAPTER

Monitoring WAAS Using Cisco Network Analysis Module. Information About NAM CHAPTER CHAPTER 5 Monitoring WAAS Using Cisco Network Analysis Module This chapter describes Cisco Network Analysis Module (NAM), which you can use to monitor your WAAS devices. This chapter contains the following

More information

Chapter 7. Address Translation

Chapter 7. Address Translation Chapter 7. Address Translation This chapter describes NetDefendOS address translation capabilities. Dynamic Network Address Translation, page 204 NAT Pools, page 207 Static Address Translation, page 210

More information

Proxy Server, Network Address Translator, Firewall. Proxy Server

Proxy Server, Network Address Translator, Firewall. Proxy Server Proxy Server, Network Address Translator, Firewall 1 Proxy Server 2 1 Introduction What is a proxy server? Acts on behalf of other clients, and presents requests from other clients to a server. Acts as

More information

Introduction to Network Operating Systems

Introduction to Network Operating Systems As mentioned earlier, different layers of the protocol stack use different kinds of addresses. We can now see that the Transport Layer (TCP) uses port addresses to route data to the correct process, the

More information

Wireless Sensor Networks Chapter 3: Network architecture

Wireless Sensor Networks Chapter 3: Network architecture Wireless Sensor Networks Chapter 3: Network architecture António Grilo Courtesy: Holger Karl, UPB Goals of this chapter Having looked at the individual nodes in the previous chapter, we look at general

More information

Network Security. Chapter 3. Cornelius Diekmann. Version: October 21, 2015. Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik

Network Security. Chapter 3. Cornelius Diekmann. Version: October 21, 2015. Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik Network Security Chapter 3 Cornelius Diekmann Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik Version: October 21, 2015 IN2101, WS 15/16, Network Security 1 Security Policies and

More information

Content Delivery Networks

Content Delivery Networks Content Delivery Networks Terena 2000 ftp://ftpeng.cisco.com/sgai/t2000cdn.pdf Silvano Gai Cisco Systems, USA Politecnico di Torino, IT sgai@cisco.com Terena 2000 1 Agenda What are Content Delivery Networks?

More information

IP Phone Presence Setup

IP Phone Presence Setup Static Route Configuration on IM and Presence Service, page 1 Presence Gateway Configuration on IM and Presence Service, page 6 Configure SIP Publish Trunk on IM and Presence Service, page 7 Configure

More information

VIEWABILL. Cloud Security and Operational Architecture. featuring RUBY ON RAILS

VIEWABILL. Cloud Security and Operational Architecture. featuring RUBY ON RAILS VIEWABILL Cloud Security and Operational Architecture featuring RUBY ON RAILS VAB_CloudSecurity V1 : May 2014 Overview The Viewabill.com cloud is a highly-secure, scalable and redundant solution that enables

More information

BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note

BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise

More information

Information-Centric Networking: Introduction and Key Issues

Information-Centric Networking: Introduction and Key Issues UCL DEPARTMENT OF ELECTRONIC AND ELECTRICAL ENGINEERING COMMUNICATIONS AND INFORMATION SYSTEMS GROUP ICN Session FIA Budapest Information-Centric Networking: Introduction and Key Issues Prof. George Pavlou

More information

Firewalls. Mahalingam Ramkumar

Firewalls. Mahalingam Ramkumar Firewalls Mahalingam Ramkumar Evolution of Networks Centralized data processing LANs Premises network interconnection of LANs and mainframes Enterprise-wide network interconnection of LANs in a private

More information

A Building Block for Best Effort Communications

A Building Block for Best Effort Communications A Building Block for Best Effort Communications Raimo Kantola Raimo.Kantola@aalto.fi Aalto University/Comnet 20.3.2012 1 What kind of Communication IDs Globally unique deterministic IDs high OPEX in case

More information

COMPUTER NETWORKS LECTURES. DR.PETER G. GYARMATI Research professor. Lectures of P. G. Gyarmati 1. page 1999.-2006.

COMPUTER NETWORKS LECTURES. DR.PETER G. GYARMATI Research professor. Lectures of P. G. Gyarmati 1. page 1999.-2006. COMPUTER NETWORKS LECTURES DR.PETER G. GYARMATI Research professor Lectures of P. G. Gyarmati 1. page 1999.-2006. 1999.-2006. This page is intentionally left blank Lectures of P. G. Gyarmati 2. page 1999.-2006.

More information

Scalable Internet Services and Load Balancing

Scalable Internet Services and Load Balancing Scalable Services and Load Balancing Kai Shen Services brings ubiquitous connection based applications/services accessible to online users through Applications can be designed and launched quickly and

More information

Internetworking and Internet-1. Global Addresses

Internetworking and Internet-1. Global Addresses Internetworking and Internet Global Addresses IP servcie model has two parts Datagram (connectionless) packet delivery model Global addressing scheme awaytoidentifyall H in the internetwork Properties

More information

Transform Your Business and Protect Your Cisco Nexus Investment While Adopting Cisco Application Centric Infrastructure

Transform Your Business and Protect Your Cisco Nexus Investment While Adopting Cisco Application Centric Infrastructure White Paper Transform Your Business and Protect Your Cisco Nexus Investment While Adopting Cisco Application Centric Infrastructure What You Will Learn The new Cisco Application Centric Infrastructure

More information

Case Study for Layer 3 Authentication and Encryption

Case Study for Layer 3 Authentication and Encryption CHAPTER 2 Case Study for Layer 3 Authentication and Encryption This chapter explains the basic tasks for configuring a multi-service, extranet Virtual Private Network (VPN) between a Cisco Secure VPN Client

More information

Defenses against Distributed Denial of Service Attacks. Internet Threat: DDoS Attacks

Defenses against Distributed Denial of Service Attacks. Internet Threat: DDoS Attacks Defenses against Distributed Denial of Service Attacks Adrian Perrig, Dawn Song, Avi Yaar CMU Internet Threat: DDoS Attacks Denial of Service (DoS) attack: consumption (exhaustion) of resources to deny

More information

Internet Services & Protocols

Internet Services & Protocols Department of Computer Science Institute for System Architecture, Chair for Computer Networks Internet Services & Protocols Internet (In)Security Dr.-Ing. Stephan Groß Room: INF 3099 E-Mail: stephan.gross@tu-dresden.de

More information

Distributed Systems 19. Content Delivery Networks (CDN) Paul Krzyzanowski pxk@cs.rutgers.edu

Distributed Systems 19. Content Delivery Networks (CDN) Paul Krzyzanowski pxk@cs.rutgers.edu Distributed Systems 19. Content Delivery Networks (CDN) Paul Krzyzanowski pxk@cs.rutgers.edu 1 Motivation Serving web content from one location presents problems Scalability Reliability Performance Flash

More information

CSE331: Introduction to Networks and Security. Lecture 12 Fall 2006

CSE331: Introduction to Networks and Security. Lecture 12 Fall 2006 CSE331: Introduction to Networks and Security Lecture 12 Fall 2006 Announcements Midterm I will be held Friday, Oct. 6th. True/False Multiple Choice Calculation Short answer Short essay Project 2 is on

More information

DEMYSTIFYING ROUTING SERVICES IN SOFTWAREDEFINED NETWORKING

DEMYSTIFYING ROUTING SERVICES IN SOFTWAREDEFINED NETWORKING DEMYSTIFYING ROUTING SERVICES IN STWAREDEFINED NETWORKING GAUTAM KHETRAPAL Engineering Project Manager, Aricent SAURABH KUMAR SHARMA Principal Systems Engineer, Technology, Aricent DEMYSTIFYING ROUTING

More information

Firewalls P+S Linux Router & Firewall 2013

Firewalls P+S Linux Router & Firewall 2013 Firewalls P+S Linux Router & Firewall 2013 Firewall Techniques What is a firewall? A firewall is a hardware or software device which is configured to permit, deny, or proxy data through a computer network

More information

Interconnection of Heterogeneous Networks. Internetworking. Service model. Addressing Address mapping Automatic host configuration

Interconnection of Heterogeneous Networks. Internetworking. Service model. Addressing Address mapping Automatic host configuration Interconnection of Heterogeneous Networks Internetworking Service model Addressing Address mapping Automatic host configuration Wireless LAN network@home outer Ethernet PPS Internet-Praktikum Internetworking

More information

MPLS over IP-Tunnels. Mark Townsley Distinguished Engineer. 21 February 2005

MPLS over IP-Tunnels. Mark Townsley Distinguished Engineer. 21 February 2005 MPLS over IP-Tunnels Mark Townsley Distinguished Engineer 21 February 2005 1 MPLS over IP The Basic Idea MPLS Tunnel Label Exp S TTL MPLS VPN Label Exp S TTL MPLS Payload (L3VPN, PWE3, etc) MPLS Tunnel

More information

Definition. A Historical Example

Definition. A Historical Example Overlay Networks This lecture contains slides created by Ion Stoica (UC Berkeley). Slides used with permission from author. All rights remain with author. Definition Network defines addressing, routing,

More information

Lecture 02b Cloud Computing II

Lecture 02b Cloud Computing II Mobile Cloud Computing Lecture 02b Cloud Computing II 吳 秀 陽 Shiow-yang Wu T. Sridhar. Cloud Computing A Primer, Part 2: Infrastructure and Implementation Topics. The Internet Protocol Journal, Volume 12,

More information

Network Address Translation (NAT) Adapted from Tannenbaum s Computer Network Ch.5.6; computer.howstuffworks.com/nat1.htm; Comer s TCP/IP vol.1 Ch.

Network Address Translation (NAT) Adapted from Tannenbaum s Computer Network Ch.5.6; computer.howstuffworks.com/nat1.htm; Comer s TCP/IP vol.1 Ch. Network Address Translation (NAT) Adapted from Tannenbaum s Computer Network Ch.5.6; computer.howstuffworks.com/nat1.htm; Comer s TCP/IP vol.1 Ch.20 Long term and short term solutions to Internet scalability

More information

Edges = communication links Vertices = computers, switches, routers, etc. For packet inbound at a particular vertex, determine what output edge to use

Edges = communication links Vertices = computers, switches, routers, etc. For packet inbound at a particular vertex, determine what output edge to use IP Routing Networks as Graphs Networks are graphs Edges = communication links Vertices = computers, switches, routers, etc For packet inbound at a particular vertex, determine what output edge to use Routers

More information

Cisco IOS Flexible NetFlow Technology

Cisco IOS Flexible NetFlow Technology Cisco IOS Flexible NetFlow Technology Last Updated: December 2008 The Challenge: The ability to characterize IP traffic and understand the origin, the traffic destination, the time of day, the application

More information

A P2P SIP Architecture - Two Layer Approach - draft-sipping-shim-p2p-arch-00.txt

A P2P SIP Architecture - Two Layer Approach - draft-sipping-shim-p2p-arch-00.txt A SIP Architecture - Two Layer Approach - draft-sipping-shim-p2p-arch-00.txt IETF65, Dallas March 25, 2006 Eunsoo Shim Sathya Narayanan Greg Daley Panasonic Digital Networking Laboratory Two Layer Approach

More information

Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University

Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University October 2015 1 List of Figures Contents 1 Introduction 1 2 History 2 3 Public Key Infrastructure (PKI) 3 3.1 Certificate

More information

DATA COMMUNICATOIN NETWORKING

DATA COMMUNICATOIN NETWORKING DATA COMMUNICATOIN NETWORKING Instructor: Ouldooz Baghban Karimi Course Book: Computer Networking, A Top-Down Approach, Kurose, Ross Slides: - Course book Slides - Slides from Princeton University COS461

More information

Views on Wireless Network Convergence

Views on Wireless Network Convergence Views on Wireless Network Convergence Yan PENG, Bin XIA, Meng LIANG Version 1.0 Agenda Motivations for Wireless Network Convergence Convergence Categories Issues on IP based Convergence A Possible Evolution

More information

LISP Functional Overview

LISP Functional Overview CHAPTER 2 This document assumes that the reader has prior knowledge of LISP and its network components. For detailed information on LISP components, their roles, operation and configuration, refer to http://www.cisco.com/go/lisp

More information

Virtual PortChannels: Building Networks without Spanning Tree Protocol

Virtual PortChannels: Building Networks without Spanning Tree Protocol . White Paper Virtual PortChannels: Building Networks without Spanning Tree Protocol What You Will Learn This document provides an in-depth look at Cisco's virtual PortChannel (vpc) technology, as developed

More information

Cisco EXAM - 300-207. Implementing Cisco Threat Control Solutions (SITCS) Buy Full Product. http://www.examskey.com/300-207.html

Cisco EXAM - 300-207. Implementing Cisco Threat Control Solutions (SITCS) Buy Full Product. http://www.examskey.com/300-207.html Cisco EXAM - 300-207 Implementing Cisco Threat Control Solutions (SITCS) Buy Full Product http://www.examskey.com/300-207.html Examskey Cisco 300-207 exam demo product is here for you to test the quality

More information

ITL BULLETIN FOR JANUARY 2011

ITL BULLETIN FOR JANUARY 2011 ITL BULLETIN FOR JANUARY 2011 INTERNET PROTOCOL VERSION 6 (IPv6): NIST GUIDELINES HELP ORGANIZATIONS MANAGE THE SECURE DEPLOYMENT OF THE NEW NETWORK PROTOCOL Shirley Radack, Editor Computer Security Division

More information

IPv6 First Hop Security Protecting Your IPv6 Access Network

IPv6 First Hop Security Protecting Your IPv6 Access Network IPv6 First Hop Security Protecting Your IPv6 Access Network What You Will Learn This paper provides a brief introduction to common security threats on IPv6 campus access networks and will explain the value

More information

Content Distribution Networks (CDNs)

Content Distribution Networks (CDNs) 229 Content Distribution Networks (CDNs) A content distribution network can be viewed as a global web replication. main idea: each replica is located in a different geographic area, rather then in the

More information

OVERLAYING VIRTUALIZED LAYER 2 NETWORKS OVER LAYER 3 NETWORKS

OVERLAYING VIRTUALIZED LAYER 2 NETWORKS OVER LAYER 3 NETWORKS OVERLAYING VIRTUALIZED LAYER 2 NETWORKS OVER LAYER 3 NETWORKS Matt Eclavea (meclavea@brocade.com) Senior Solutions Architect, Brocade Communications Inc. Jim Allen (jallen@llnw.com) Senior Architect, Limelight

More information

Authentication Application

Authentication Application Authentication Application KERBEROS In an open distributed environment servers to be able to restrict access to authorized users to be able to authenticate requests for service a workstation cannot be

More information

Cisco Network Foundation Protection Overview

Cisco Network Foundation Protection Overview Cisco Network Foundation Protection Overview June 2005 1 Security is about the ability to control the risk incurred from an interconnected global network. Cisco NFP provides the tools, technologies, and

More information

Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1

Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1 Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton

More information

A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.

A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection. A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based

More information

Facility Usage Scenarios

Facility Usage Scenarios Facility Usage Scenarios GDD-06-41 GENI: Global Environment for Network Innovations December 22, 2006 Status: Draft (Version 0.1) Note to the reader: this document is a work in progress and continues to

More information

IP addressing. Interface: Connection between host, router and physical link. IP address: 32-bit identifier for host, router interface

IP addressing. Interface: Connection between host, router and physical link. IP address: 32-bit identifier for host, router interface IP addressing IP address: 32-bit identifier for host, router interface Interface: Connection between host, router and physical link routers typically have multiple interfaces host may have multiple interfaces

More information

Firewalls. Ahmad Almulhem March 10, 2012

Firewalls. Ahmad Almulhem March 10, 2012 Firewalls Ahmad Almulhem March 10, 2012 1 Outline Firewalls The Need for Firewalls Firewall Characteristics Types of Firewalls Firewall Basing Firewall Configurations Firewall Policies and Anomalies 2

More information

Distributed Authentication Mechanism for Mobile IP Route Optimization

Distributed Authentication Mechanism for Mobile IP Route Optimization Distributed Authentication Mechanism for Mobile IP Route Optimization Neeraj Jaggi Department of ECSE Rensselaer Polytechnic Institute jaggin@rpi.edu Koushik Kar Department of ECSE Rensselaer Polytechnic

More information

architecture: what the pieces are and how they fit together names and addresses: what's your name and number?

architecture: what the pieces are and how they fit together names and addresses: what's your name and number? Communications and networking history and background telephone system local area networks Internet architecture: what the pieces are and how they fit together names and addresses: what's your name and

More information

Names & Addresses. Names & Addresses. Names vs. Addresses. Identity. Names vs. Addresses. CS 194: Distributed Systems: Naming

Names & Addresses. Names & Addresses. Names vs. Addresses. Identity. Names vs. Addresses. CS 194: Distributed Systems: Naming Names & Addresses CS 9: Distributed Systems: Naming Computer Science Division Department of Electrical Engineering and Computer Sciences University of California, Berkeley Berkeley, CA 970-77 What is a?

More information

Chapter 8 Security Pt 2

Chapter 8 Security Pt 2 Chapter 8 Security Pt 2 IC322 Fall 2014 Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 All material copyright 1996-2012 J.F Kurose and K.W. Ross,

More information

Introduction to MPLS-based VPNs

Introduction to MPLS-based VPNs Introduction to MPLS-based VPNs Ferit Yegenoglu, Ph.D. ISOCORE ferit@isocore.com Outline Introduction BGP/MPLS VPNs Network Architecture Overview Main Features of BGP/MPLS VPNs Required Protocol Extensions

More information

The Impact of DNSSEC. Matthäus Wander. on the Internet Landscape. <matthaeus.wander@uni-due.de> Duisburg, June 19, 2015

The Impact of DNSSEC. Matthäus Wander. on the Internet Landscape. <matthaeus.wander@uni-due.de> Duisburg, June 19, 2015 The Impact of DNSSEC on the Internet Landscape Matthäus Wander Duisburg, June 19, 2015 Outline Domain Name System Security problems Attacks in practice DNS Security Extensions

More information

Architectural Principles for Secure Multi-Tenancy

Architectural Principles for Secure Multi-Tenancy Architectural Principles for Secure Multi-Tenancy John Linn, Office of the CTO, RSA, The Security Division of EMC John Field, Office of the CTO, EMC Also adapting prior content by Burt Kaliski DIMACS Workshop

More information

Operating Systems Group Distributed Operating Systems Firewalls

Operating Systems Group Distributed Operating Systems Firewalls Operating Systems Group Distributed Operating Systems Firewalls Dresden, 2007-06-13 Agenda Introduction What to protect? Where to intercept? Firewalls: Packet filters Application firewalls Firewall practices

More information