How To Create A Virtual Network With A Router And Network Operating System (Ip) For A Network (Ipv) (Ip V2) (Netv) And A Virtualization) (Network) (Wired) (Virtual) (Wire)

Transcription

1 Post-IP technologies virtualization and security Guy Pujolle 1

2 Virtualization for a post-ip network 2

3 Geni Intel would like to propose a generic router Intel proposes to have a generic hardware with virtual network operating system A router can support simultaneously CISCO IOS and dj Juniper Junos and dal Alcatel los and dn Nortel los OS, etc. Cisco reaction was to virtualize the different releases of IOS. 3

4 Virtual router Network A Network D Network B Network C 4

5 Virtualization of the Control Plane Control algorithms NOS NOS NOS NOS NOS Control Control Control Control Control Hypervisor 5

6 Why virtualization? A better use of the resources Sharing of the resources for the routing schemes Security of the machines against attacks Isolation of the traffic in the virtual machines Management and control Need an hypervisor How to move et the virtual entities ttes(oute,etc) (router, etc.) 6

7 Virtualization of the Management Plane NM NM NM NM NM System System System System System Hypervisor 7

8 Protocol virtualization A B C D = E A = IP stack is mandatory in the core network within the virtual protocol 8

9 Virtualization of the Data Plane 9

10 Virtualization of the Data Plane 10

11 Virtualization of the protocols A D E A B C D E A B D E A A E A B C D E A C D E 11

12 Post-IP security through a strong authentication and closed traceability

13 Why two-factor authentication is needed Password issues Attackers can sniff out what's typed on keyboards, simply by recording keystroke sounds Recommendation to enhance security with two-factor authentication that combines passwords with one-time- password tokens or smartcards,, or with biometric recognition, like fingerprint readers A well known two-factor authentication device is the RSA SecurID token This token works with a proprietary authentication infrastructure called ACE.

14 Two-factor authentication Our proposal Tokens are based on the Java Card technology They execute Java applications supported by the open code project OpenEapSmartcard. The authentication platform is fully based on IETF standards (mainly the Extensible Authentication Protocol,, EAP), no proprietary features Our authentication scenario deals with the classical SSL/TLS protocol (more precisely EAP TLS), which is widely deployed through the WEB, and which relies on Public Key Infrastructure (PKI)

15 What is EAP? EAP is an IETF standard d The Extensible Authentication Protocol (EAP) was introduced in 1999, in order to define a flexible authentication framework. EAP,, RFC 3748, "Extensible Authentication Protocol, (EAP)" EAP TLS,, RFC 2716, "PPP EAP TLS Authentication Protocol EAP SIM,, RFC 4186, " Extensible Authentication Protocol Methodfor Global Systemfor Mobile Communications (GSM) Subscriber Identity Modules (EAP SIM) EAP AKA,, RFC 4187, " Extensible Authentication Protocol Method for 3 rd Generation Authentication and Key Agreement (EAP AKA) AKA)

16 What is EAP? 1 Request 2 Response 3 Success 4 Failure 1 Identity 2 Notification 3 NAK 4 MD5 challenge 13 EAP-TLS 18 EAP-SIM Packet Identifier Packet Length Code Identifier Length Type Type-Data EAP Message Format.

17 What is EAP? An Esperanto for Access Control in IP infrastructures. Wireless LAN Wi Fi, IEEE 802.1x WiMAX mobile, IEEE e, PKM EAP Wired LANs ETHERNET, IEEE PPP, RFC 1661, The Point to Point Protocol (PPP) VPN (Virtual Private Network) technologies PPTP, RFC 2637, " Point to Point Tunnelling Protocol " L2TP, RFC 2661, " Layer Two Tunnelling Protocol " IKEv2, RFC 4306, "Internet Key Exchange Protocol Authentication Server RADIUS, RFC 3559, RADIUS (Remote Authentication Dial In User Service) Support For Extensible Authentication Protocol (EAP) DIAMETER, RFC 4072, "Diameter Extensible Authentication Protocol Application Voice Over IP UMA, Unlicensed Mobile Access, org

18 What is EAP? EAP components According to RFC 3748, EAP implementations conceptually consist of the four following components: 1 The lower layer is responsible for transmitting and receiving EAP frames between the peer and authenticator. 2 The EAP layer receives and transmits EAP packets via the lower layer, implements duplicate detection and retransmission, and delivers and receives EAP messages to and from EAP methods. 3 EAP peer and authenticator layers. Based on the Code field, the EAP layer de multiplexes incoming EAP packets to the EAP peer and authenticator layers. 4 EAP methods implement the authentication algorithms, and receive and transmit EAP messages. EAP methods can be implemented in Java Card systems.

19 Ordinateurcentral What is EAP? EAP Java Card gy Full Software 4 EAP method EAP method EAP method EAP method Technology 3 EAP-Peer Peer Layer EAP-Auth. Auth. Layer Implementations 2 1 EAP-Layer Lower-Layer EAP-Layer RADIUS Server Peer Authentication Server Partial Software Implementations + EAP JavaCard Technology Peer EAP JavaCard Client EAP-Peer Peer Layer EAP-Layer Lower-Layer 4 EAP Methods Wi-Fi Network EAP JavaCard Server EAP-Auth. Auth Layer EAP-Layer Java Card Enabled RADIUS Server Authentication Server Mainframe

20 The open platform, Why open Java Card technology code? Internet and WEB technologies are based on open code. No proprietary features. Good security principle that enables code reviewing. Fair choice among multiple Java Card systems

21 OpenEapSmartcard. Architecture t Overview

22 Authentication platform Overview

23 The platform

24 Summary We have presented two-factor authentication tokens, based on the Java Card technology We have introduced the open code project OpenEapSmartcard,, which is used by these token We have built an authentication architecture fully based on IETF standards. We have shown a real Wi-Fi platform that deals with these technologies.