Direct End-to-Middle Authentication in Cooperative Networks

Size: px
Start display at page:

Download "Direct End-to-Middle Authentication in Cooperative Networks"

Transcription

1 Direct End-to-Middle Authentication in Cooperative Networks Von der Fakultät für Mathematik, Informatik und Naturwissenschaften der RWTH Aachen University zur Erlangung des akademischen Grades eines Doktors der Naturwissenschaften genehmigte Dissertation vorgelegt von Dipl.-Inform. Tobias Martin Heer aus Mutlangen, Schwäbisch Gmünd Berichter: Prof. Dr.-Ing. Klaus Wehrle Prof., PhD Sasu Tarkoma Tag der mündlichen Prüfung Diese Dissertation ist auf den Internetseiten der Hochschulbibliothek digital verfügbar.

2

3 WICHTIG: D 82 überprüfen!!! Reports on Communications and Distributed Systems edited by Prof. Dr.-Ing. Klaus Wehrle Communication and Distributed Systems, RWTH Aachen University Volume 3 Tobias Martin Heer Direct End-to-Middle Authentication in Cooperative Networks Shaker Verlag Aachen 2012

4 Bibliographic information published by the Deutsche Nationalbibliothek The Deutsche Nationalbibliothek lists this publication in the Deutsche Nationalbibliografie; detailed bibliographic data are available in the Internet at Zugl.: D 82 (Diss. RWTH Aachen University, 2011) Copyright Shaker Verlag 2012 All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior permission of the publishers. Printed in Germany. ISBN ISSN Shaker Verlag GmbH P.O. BOX D Aachen Phone: 0049/2407/ Telefax: 0049/2407/ Internet:

5 Abstract Cooperative networks rely on user cooperation at the network layer to provide services, such as packet forwarding or shared access to other network resources like storage or Internet access. Examples of cooperative networks that build upon user contribution are ad-hoc networks, decentralized wireless mesh networks, micro-operator networks, wireless Internet access sharing networks or hybrids between these network types. However, while it enables new types of networks and services, the concept of cooperative network service provisioning also creates new attack possibilities for malicious and selfish users. For example, wireless multi-hop networks are particularly susceptible to attacks based on flooding and the interception of, tampering with, and forging of packets. Thus, reliable communication in such networks quintessentially depends on mechanisms to allow on-path devices, such as middleboxes, to verify the authenticity of network traffic and the identity of the communicating peers. Efficient standard authentication techniques for end-to-middle authentication typically assume the presence of shared keys within the network or rely on trusted third parties, such as on-line authentication servers. However, in cooperative scenarios, these approaches suffer from significant drawbacks in respect to functionality and efficiency. Moreover, the tight resource constraints of wireless routers and access points in cooperative scenarios make the use of more flexible but less efficient authentication techniques challenging. Hence, a careful selection of cryptographic components and the creation of new and flexible and efficient mechanisms is required to enable end-to-middle authentication in cooperative multi-hop networks. In this thesis, we address the problem of end-to-middle authentication on different levels of granularity, ranging from infrequent signaling events to rapid verification of high-bandwidth payload streams. The different security and performance requirements of signaling and payload traffic prevent the creation of a one-size-fits-all solution but requires the use of specialized approaches. We designed and analyzed three solutions that cover low-frequency signaling events as well as high-frequency payload protection. We first analyze and extend the Host Identity Protocol to enable secure publickey based end-to-middle authentication for signaling traffic. However, the use of CPU-intensive public-key verification prevents the use of this solution for verifying high-bandwidth payload streams. Consequently, our second solution focuses on more lightweight cryptographic components to provide end-to-middle authentication for payload. The Adaptive and Lightweight Protocol for Hop-By-hop Authentication, ALPHA, uses efficient hash functions and hash chains to enable rapid verification of the source and integrity of a payload packet. Finally, our third solution sacrifices end-to-middle integrity protection of the packet to further improve the verification performance. The family of Stream-based Per-packet One-time Token Schemes, SPOTS enables middleboxes to rapidly authenticate the source of a packet when the middlebox is agnostic to the contents of the forwarded packet. In combination, the three solution provide a flexible set of mechanisms that enables efficient end-tomiddle authentication for a wide range of scenarios within and beyond the setting of cooperative multi-hop networks.

6

7 Kurzfassung Kooperative Netze beruhen auf dem Prinzip der Zusammenarbeit von Benutzern auf Netzwerkebene, um Dienste wie z.b. das Weiterleiten von Paketen oder den gemeinsamen Zugriff auf andere Netzwerkressourcen wie Speicherplatz und Internetzugang gemeinschaftlich zu erbringen. Beispiele für kooperative Netzwerke sind Ad-Hoc-Netze, dezentrale drahtlose Mesh-Netzwerke, Micro-Operator-Netzwerke, WLAN-Communities oder hybride Formen dieser Netzwerk-Typen. Jedoch schafft das Konzept der gemeinschaftlichen Schaffung eines Netzes auch neue Angriffsmöglichkeiten für egoistische und bösartige Benutzer. Zum Beispiel sind drahtlose Multi-Hop-Netzwerke besonders anfällig gegenüber Angriffen, die auf dem Fluten des Netzwerks mit Schadpaketen oder der Manipulation und Fälschung von Paketen beruhen. Um eine zuverlässige Kommunikation in solchen Netzwerken zu erreichen sind daher Mechanismen notwendig, welche es weiterleitenden Geräten, sogenannten Middleboxen, erlauben, die Herkunft und Authentizität von Paketen vor der Weiterleitung zu überprüfen. Effiziente Standardlösungen, um eine solche Ende-zu-Mitte-Authentifizierung zu erreichen, setzen typischerweise geteilte symmetrische Schlüssel zwischen Endgeräten und Middleboxen voraus oder beruhen auf einer stets verfügbaren Verbindung zu einem Authentifizierungsserver. Diese Einschränkungen führen jedoch in kooperativen Netzen zu deutlichen Nachteilen bezüglich der Flexibilität und Effizienz. Darüber hinaus erschweren die knappen Ressourcen von drahtlosen Geräten wie WLAN-Routern und Access Points den Einsatz flexiblerer aber weniger effizienter kryptographischer Methoden. Diese Arbeit beschäftigt sich mit dem Problem der effizienten Ende-zu-Mitte Authentifizierung in verschiedenen Granularitäten, beginnend mit der Authentifizierung sporadischer Signalisierungsnachrichten bis hin zur rapiden Bearbeitung von hochfrequenten Authentifikationsereignissen, wie sie für breitbandige Nutzdatenströme nötig sind. Dabei verhindern die verschiedenen Sicherheits- und Performanzanforderungen von Signalisierungsnachrichten und Nutzdatenströmen die Schaffung einer allumfassenden Lösung. Daher stellt diese Arbeit drei sich ergänzende Lösungen vor, deren Kombination ein breites Spektrum an Authentifikationsgranularitäten abdecken. Diese Arbeit widmet sich zuerst der Public-Key-basierten Ende-zu-Mitte-Authentifizierung. Dabei wird das Host Identity Protocol (HIP) analysiert und erweitert, um den Schutz von sporadischem Signalisierungsverkehr zu erreichen. Jedoch verhindert die Nutzung von rechenintensiven Public-Key-Verifikationen in HIP den Einsatz dieser Lösung für die Authentisierung von breitbandigen Nutzdatenströmen. Daher verwendet die zweite vorgestellte Lösung ausschließlich leichtgewichtige kryptographische Komponenten, um die effiziente Ende-zu-Mitte-Authentifizierung von Nutzdatenströmen zu ermöglichen. Das Adaptive and Lightweight Protocol for Hop-by-Hop Authentication, ALPHA, verwendet effiziente Hash-Funktionen und Hash-Ketten, um eine schnelle Überprüfung der Quelle und Integrität eines Netzwerkpakets zu erreichen. Die dritte vorgestellte Lösung, SPOTS, verzichtet auf

8 Ende-zu-Mitte Integritätsschutz um die kryptographische Komplexität der Authentifizierung weiter zu senken. SPOTS basiert ausschließlich auf effizienten Einwegfunktionen und ermöglicht es Middleboxen ausschließlich die Quellinformation eines Paketes zu überprüfen. Diese alleinige Quellprüfung eignet sich besonders für die Anwendung in Fällen, in denen eine Überprüfung des Paketinhalts durch die Middleboxen nicht notwendig oder nicht möglich ist, zum Beispiel bei Ende-zu-Ende verschlüsselten Daten. In Kombination bieten die drei Lösungen einen flexiblen Satz von Mechanismen, welcher effiziente Ende-zu-Mitte-Authentifizierung für ein breites Spektrum von Szenarien innerhalb und außerhalb von kooperativen Multi-Hop- Netzen ermöglicht.

9 Acknowledgments I would like to thank a number of people who have influenced, guided, and encouraged me in my research that eventually resulted in this thesis. The beginning of the story of this thesis dates back to a stay in Finland in 2005 and Back then, when searching for a topic for my Diploma thesis, I first stumbled across lightweight authentication. Pekka Nikander left just enough breadcrumbs to get me interested in the general topic. Miika Komu and Sasu Tarkoma helped me to define the topic of my Diploma thesis, which eventually evolved into Lightweight HIP and later into ALPHA. Without the encouragement of these two determined and helpful researchers, this thesis would not have had a beginning. I would like to thank Andrei Gurtov for inviting me to Finland and for supporting this work in the early stages. I would further like to thank Yukka Ylitalo for his inspiration and feedback while I was in Finland. These people created the spark that later turned into this thesis. I can t possibly thank my advisor Klaus Wehrle enough. He accepted me as a Ph.D. student and allowed me to further pursue my research interests. He always helped me in all personal and professional questions. I am deeply grateful for his encouragement in the early days and his continuous support and advice throughout my time as a Ph.D student. Over the years I had the chance to work with many brilliant students who taught me much of what I know today. I am especially proud that some of these students became colleagues and that I had the great pleasure of working with them since then. Thank you, René Hummen and Hanno Wirtz. I want to express my special thanks to Thomas Jansen, Dongsu Park, and Shaohui Li, who helped to implement large parts of HIP-MA during their time as student workers and thesis students. I want to thank Johannes Gilger and Florian Weingarten for putting so much effort into creating the first basic implementation of ALPHA. Christian Dernehl, Hossein Shafagh, and Christoph Rackwitz took up the implementation baton later and carried on the work on ALPHA and SPOTS. Without these five students, such a complete implementation of both protocols would not exist. I would also like to thank all other students that contributed to aspects of my work that are not part of this thesis: Thank you, Sebastian Jansen, Jens Otten, Robert Backhaus, Wolfram Fischer, Diego Biurrun, Lars Hermerschmidt, Dongsu Park, and Jahn Bertsch. I am grateful for all the help and advice I received from my colleagues at RWTH Aachen University. For a long time, Stefan Götz was an excellent mentor to me, helping me with all troubles that a Ph.D. student has to face. Moreover, I had the privilege to work with many more wonderful colleagues who supported me during this thesis. Jó Agila Bitsch, Elias Weingärtner, Nicolai Viol, Raimondas Sasnauskas, Georg Kunz, Dirk Thißen, Olaf Landsiedel, Arne Schmitz, and Simon Rieche deserve special thanks. Moreover, I truly appreciated and enjoyed working with all other Ph.D. students of the COMSYS group. It was great to be part of such a wonderful bunch of people. In addition I would like to thank our technical staff and secretaries for their practical help and patience. Therefore, I wish to thank Ulrike May, Petra Zeidler, Rainer Krogull, and Helen Bolke-Hermanns. I also had the pleasure to work with some inspiring researchers outside the RWTH Aachen. I would like to thank Oscar Garcia Morchon for the interesting insights into

10 security on tightly constrained devices. You have been a great research companion. I really enjoyed the joint work with Samu Varjonen within and outside the IETF and I appreciate his patience even when things took longer than expected. Working with Ari Keranen was always a great pleasure and I am grateful for his sharp eyes that helped to spot even tiny inconsistencies in masses of IETF draft text. Finally, I wish to thank Robert Moskowitz for the interesting and fruitful discussions on security, networking, science, and life in general. I would also like to thank Andreas Weber, my mentor at the teacher training college in Schwäbisch Gmünd. He showed me how fascinating computer science can be. Without him I would probably be teaching in an elementary school now not the worst choice, I guess. Last but most importantly, I am most grateful for all the support that I received from my friends and family. Without their love and patience, this thesis would have not been possible. Without the encouragement of my wonderful wife Melanie and my children Jana and Jannik, I would not have been able to complete this work.

11 Contents 1 Introduction Contributions ScopeandGenesisofthisThesis ScopeofourSolutions Outline Scenario and Problem Statement CooperativeNetworks Community Internet Sharing Networks CooperativeWirelessMulti-hopNetworks Middleboxes History and Terminology Middleboxes in Cooperative Networks ProblemStatement Challenges Three End-to-middle Authentication Solutions Authentication and Network Security Authentication AuthenticationandIntegrity GranularityofAuthentication AuthenticationGoals AuthenticationinthisThesis Identity Security Goals and their Dependency on Authentication Security Model and Terminology... 27

12 3.2.1 Extended Threat Model and Terminology ThreatsinNetworkSecurity Eavesdropping Impersonation Man-In-The-Middle Attacks DelayandReplayAttacks DenialofServiceAttacks ExhaustiveKeySpaceSearchandCryptoanalysis SecurityMechanismsforAuthentication Public-key Based Authentication Authentication Based on Cryptographic Hash Functions Other Building Blocks for Security Protocols SecurityProtocols SecurityContextsandSecurityAssociations TheIPSecurityArchitecture TheHostIdentityProtocol SignaturesBasedonDelayedSecretDisclosure PLA:PacketLevelAuthentication Summary HIP-MA: Authenticated End-to-Middle Signaling with HIP The Host Identity Protocol and Middleboxes HostIdentityNamespace Replay Attack against HIP Middleboxes End-hostImpersonation PayloadChannelHijacking Non-Solutions HIP Middlebox Authentication Extension Phase One: Initial End-to-Middle Authentication Phase Two: Subsequent End-to-Middle Authentication DoS Protection for Middleboxes Summary Security Benefits and Limitations... 74

13 4.5.1 BenefitsofHIP-MA AttackScenarios Compatibility and Incremental Deployment Application Scenarios and Use cases Use Case 1: Distributed Identity-based Access Control Use Case 2: Secure End-to-Middle Signaling Implementation Details PerformanceEvaluation EvaluationSetup PerformanceEvaluation RelatedWork PLAforHIP AuthenticationServers,802.1XandEAP OtherRelatedWork Conclusions ALPHA: Lightweight End-to-middle Authentication for Payload Overview IntroductiontoALPHA RelatedWork AuthenticationBasedonDelayedSecretDisclosure Interaction-based Approaches Hop-by-hopAuthentication DesignofBasicALPHA ALPHA s Interactive Hash Chain Signature Scheme StatesandStateTransitions Path Binding for ALPHA UnreliableandReliableDataTransmission BandwidthAdaptation ALPHA-C:CumulativeTransmissions ALPHA-M:Pre-signedMerkleTrees Hash Chain Bootstrapping and Renewal HashChainRenewal...123

14 5.7 Implementation ArchitectureOverview Implementation Details UseofParallelAssociationsinALPHAforIP AnalysisofALPHA ALPHAStrengths ALPHA Limitations AttackScenarios Evaluation Scenario-independent Evaluation Scenario-specificEvaluation EvaluationofALPHAforIP PerformanceComparisonofALPHA,PLA,andWPLA Conclusions SPOTS: A Family of Lightweight Source-Only Authentication Tokens IntroductiontoToken-basedAuthentication End-to-Middle Source-only Authentication Basic End-to-middle Source Authentication Scheme Resiliency of the Basic Scheme Loss-TolerantSource-onlyAuthentication ParallelHashChains Residual Cost of Hash Chain Based Tokens Cross-authenticatedHashChainsandHashTrees Implementation PerformanceEvaluation TokenSchemeEvaluation Communication Performance Applications of Authentication Tokens Use Case A: Source-only authentication for HIP and IPsec UseCaseB:SecuringTESLAPacketBuffers SPOTS Strengths and Limitations RelatedWork Conclusions...201

15 7 Discussion and Conclusions Contributions ChallengesRevisited HIP Middlebox Authentication Extension Adaptive and Lightweight Protocol for Hop-by-hop Authentication Stream-basedPer-packetOne-timeTokenSchemes InterplayBetweentheProtocols ImpactofourWork FutureWork End-to-middle Fragmentation Support State Management at Middleboxes InteractionwithotherProtocolLayers Other Traffic and Communication Patterns Applications of End-to-Middle Authentication FinalRemarks A Additional HIP-MA Evaluation Graphs 211 B Additional ALPHA Evaluation Graphs 215 C Additional SPOTS Evaluation Graphs 221 Glossary 221 Index 227 Bibliography 229

16

17 1 Introduction Over the last decades, computer networks have become more and more dynamic, distributed, and cooperative. Beginning with the Internet as the most prominent example of a cooperative and distributed network, a development towards even more open and dynamic network concepts in the wired and wireless domain is evident. This development is driven by the need to reduce the deployment and operation costs and to increase the functionality and availability of networks. For example, peerto-peer networks promote network concepts where end-hosts supplement or even substitute core functions of the network (e.g., routing and addressing). Involving user devices enables these systems to cheaply and reliably serve use cases for which expensive server infrastructure would otherwise be required. At the same time, the rapid development and proliferation of wireless communication technology, especially Wi-Fi, has led to an almost ubiquitous presence of affordable and available wireless client devices and infrastructure. This availability of cheap wireless stations and access points in combination with an open frequency band has fostered research and development in new wireless networks with small-scale operator structures, in which, similar to the peer-to-peer concept, users create wireless networks based on individual contribution. Like for peer-to-peer-networks, user contribution can enable a larger wireless coverage and can reduce the deployment and operation costs because the effort for creating and running the cooperative network is shared among all users. A second reason for the success of such user-operated networks is the high flexibility regarding the provisioning of the network, its services, and its business models. Such flexibility is highly valued in a domain mostly dominated by large mobile communication companies. However, with the advent of such cooperatively operated networks, new security threats, such as selfish misuse of shared network resources, arise because central control and authentication infrastructures are often missing. Examples of networks that embrace user contribution are ad-hoc networks, decentralized wireless mesh networks, micro-operator networks, wireless Internet access sharing networks or hybrids between these network types [BH08]. A common trait

18 2 1. Introduction of these networks is the contribution of users to the network infrastructure by providing services like network access control and routing, that, in other networks, are exclusively provided by a dedicated network operator. The absence of such trusted network structures requires new decentralized solutions for essential security services, such as authentication, authorization, and accounting. Furthermore, since core network services are provided by untrusted users, the distinction between trust worthy managed network infrastructure and untrusted user devices is fading. Most notably, a simple distinction between benign insiders (the provider) and potentially malicious outsiders (the user) is not possible anymore. As a result, in addition to general security threats of wireless networks, cooperative networks are highly vulnerable to selfish misuse of the network, as well as to resource-targeted Denial of Service (DoS) attacks. In recent years, two complementary developments have gained importance in the area of network security to counter the threats in distributed networks. For one, end-systems implement an increasing number of security features because networks especially in the wireless domain have become inherently insecure. For another, middleboxes realize more and more security-related services within the network to prevent intrusion, DoS attacks, and misuse of resources. However, the disconnect between these two developments created end-to-end protocols that are primarily concerned with the end-to-end security properties and middleboxes that are left to scavenge the sparse and mostly non-verifiable information from forwarded packets. With an increasing trend for general traffic encryption [KKG + 10, AN04], middleboxes are often left with no other option but to merely observe the information in few unencrypted packet headers, further impairing the ability of these devices to detect malicious attacks and selfish behavior. The need to close the gap between end-to-end security solutions and security services provided within the network has sparked interest in middlebox-aware security solutions in which end-to-end security protocols are designed to aid middleboxes in their security related tasks. Examples of such end-to-middle solutions are the Host Identity Protocol (HIP) [MNJH08, MHJH11] and the Packet-Level Authentication (PLA) [CLK05] protocol. These protocols support middleboxes explicitly in their authentication-related tasks, allowing them to better protect the network against unauthorized access and resource misuse. Technically, these protocols rely on CPU-intensive public-key signatures, which either results in serious performance limitations or the need for specialized cryptographic hardware acceleration, which, due to its complexity and price, is not available in commodity hardware devices today. The mismatch between the computational resources of middleboxes and the computational demands of the employed cryptographic primitives renders these protocols vulnerable to DoS attacks and limits their applicability to processing of low volumes of traffic. 1.1 Contributions One of the main causes for concern in cooperative networks is the general lack of trust that stems from the missing distinction between a trusted insider and a potentially malicious outsider. Without sensible classification of trustworthy and

19 1.2. Scope and Genesis of this Thesis 3 non-trustworthy groups of devices, the identity of a device becomes a key concept for detecting and preventing malicious actions. However, pure end-to-end authentication techniques are insufficient if malicious or selfish actions threaten the network itself rather than another end-host. Hence, our main focus is on end-to-middle authentication as a key building block for achieving a range of security goals, such as access control, availability, and non-repudiation. In particular, this thesis shows how end-to-end protocols can be extended with end-to-middle authentication features to counter authentication-related threats. Such end-to-middle authentication allows entities on the communication path to verify the origin and integrity of the data they process. In this thesis we analyze, design, and evaluate end-to-middle authentication protocols for multi-hop networks. Thereby, we address the fundamental tension between security and lack of central control in cooperative networks. To support the distributed and decentralized character of emerging cooperative networks, we discuss three novel approaches that enable direct end-to-middle authentication without reliance on trusted on-line third-party authentication servers. With such a capability, middleboxes can shelter against resource misuse and protect end-hosts against DoS attacks that leverage the middleboxes as a weak spot. Additional security measures typically come at a price because increased security often results in reduced performance or increased protocol or system complexity. Thus, we specifically consider these metrics in our work and provide a range of options that provide tradeoffs between security, performance, and protocol complexity. Apart from simple but heavy-weight public-key based authentication methods, we explore more lightweight alternatives based on cryptographic hashes and hash chains to provide adaptable end-to-middle authentication protocols to meet the performance and security needs of many application scenarios. As main contribution of this work, we design and analyze three protocols: 1. The HIP Middlebox Authentication extension (HIP-MA) for public-key based end-to-middle signaling. 2. The Adaptive and Lightweight Protocol for Hop-by-hop Authentication (ALPHA), a protocol that relies on a lightweight hash-chain authentication mechanism for higher traffic volumes. 3. Stream-based Per-packet One-time Token Schemes (SPOTS), a family of token schemes for lightweight token-based source authentication without integrity protection for payload. 1.2 Scope and Genesis of this Thesis The creation of the three proposed end-to-middle authentication protocols (HIP-MA, ALPHA, and SPOTS tokens) was an iterative process consisting of the analysis and subsequent improvement of our previous work. The order and structure of this work reflects the chronological order of these iterations. Thus, the shortcomings of each discussed protocol define the design goals for the next protocol. However, in order

20 4 1. Introduction to achieve these goals, tradeoffs between performance, simplicity, and security are necessary. In the following, we briefly summarize the relations and the rationale for creating each of the three protocols: HIP-MA End-to-middle Authentication for HIP Signaling Traffic: The first protocol presented in this work focuses on the protection of end-to-middle signaling traffic with low traffic volume. To this end, we analyzed the Host Identity Protocol (HIP), a security and key exchange protocol that acknowledged the presence of middleboxes in its design phase. During our analysis of the interaction between HIP end-hosts and middleboxes we discovered that HIP does not provide a proof of freshness to middleboxes, rendering on-path devices vulnerable to replay attacks performed by colluding attackers. We designed HIP-MA, which mitigates such attacks and allows on-path middleboxes to securely authenticate end-hosts. The performance of HIP-MA is limited by the computational cost of the public key signature algorithms employed by HIP, and hence, limits the use of HIP to the protection of low-frequency signaling events (i.e., low traffic volumes). ALPHA End-to-middle Authentication for High-Volume Traffic: Driven by the performance limitations of HIP-MA, we analyzed alternative and less resource demanding signature schemes with the goal of securing high-volume payload traffic. Hash chains, as inexpensive cryptographic components can be used to provide efficient end-to-end source authentication and integrity protection for unicast and multicast traffic. In our work on the Adaptive and Lightweight Protocol for Hop-by-hop Authentication, ALPHA, we design a hash-chain based approach to match the requirements of end-to-middle source authentication and integrity protection for signaling and payload traffic. However, ALPHA shows channel properties, such as delay and burstiness, that deviate from the behavior of an unprotected IP communication. This makes ALPHA applicable for network applications with high throughput requirements but limited end-to-end delay constraints. SPOTS Lightweight End-to-middle Source Authentication: The third proposed mechanism uses cryptographic tokens based on computationally inexpensive hash chains and hash graphs: Stream-based Per-packet One-time Token Schemes (SPOTS). SPOTS tokens are replay-proof tokens for source authentication without additional delays or the use of computationally expensive asymmetric cryptography. In scenarios where middleboxes only need to attribute packets to a sender (e.g., for per-sender resources allocation or per-sender access control), SPOTS can provide a simple and highly efficient defense mechanism against a malicious or selfish sender. In contrast to AL- PHA, SPOTS tokens are suited for delay-sensitive applications and achieve an even higher throughput. The common focus of HIP-MA, ALPHA, and SPOTS on end-to-middle authentication leads to a number of common properties. First, all of these protocols focus on IP networks and are conceptually located at or above the network layer and below the transport layer in the communication stack. This layering is in accordance with the function of the network and transport layer, with the network layer being the layer

Link Layer and Network Layer Security for Wireless Networks

Link Layer and Network Layer Security for Wireless Networks Link Layer and Network Layer Security for Wireless Networks Interlink Networks, Inc. May 15, 2003 1 LINK LAYER AND NETWORK LAYER SECURITY FOR WIRELESS NETWORKS... 3 Abstract... 3 1. INTRODUCTION... 3 2.

More information

Client Server Registration Protocol

Client Server Registration Protocol Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are

More information

ITL BULLETIN FOR JANUARY 2011

ITL BULLETIN FOR JANUARY 2011 ITL BULLETIN FOR JANUARY 2011 INTERNET PROTOCOL VERSION 6 (IPv6): NIST GUIDELINES HELP ORGANIZATIONS MANAGE THE SECURE DEPLOYMENT OF THE NEW NETWORK PROTOCOL Shirley Radack, Editor Computer Security Division

More information

CHAPTER 1 INTRODUCTION

CHAPTER 1 INTRODUCTION 21 CHAPTER 1 INTRODUCTION 1.1 PREAMBLE Wireless ad-hoc network is an autonomous system of wireless nodes connected by wireless links. Wireless ad-hoc network provides a communication over the shared wireless

More information

7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?

7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security? 7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk

More information

INTERNATIONAL JOURNAL OF PURE AND APPLIED RESEARCH IN ENGINEERING AND TECHNOLOGY

INTERNATIONAL JOURNAL OF PURE AND APPLIED RESEARCH IN ENGINEERING AND TECHNOLOGY INTERNATIONAL JOURNAL OF PURE AND APPLIED RESEARCH IN ENGINEERING AND TECHNOLOGY A PATH FOR HORIZING YOUR INNOVATIVE WORK AN OVERVIEW OF MOBILE ADHOC NETWORK: INTRUSION DETECTION, TYPES OF ATTACKS AND

More information

Mobile Security Wireless Mesh Network Security. Sascha Alexander Jopen

Mobile Security Wireless Mesh Network Security. Sascha Alexander Jopen Mobile Security Wireless Mesh Network Security Sascha Alexander Jopen Overview Introduction Wireless Ad-hoc Networks Wireless Mesh Networks Security in Wireless Networks Attacks on Wireless Mesh Networks

More information

SECURITY ASPECTS IN MOBILE AD HOC NETWORK (MANETS)

SECURITY ASPECTS IN MOBILE AD HOC NETWORK (MANETS) SECURITY ASPECTS IN MOBILE AD HOC NETWORK (MANETS) Neha Maurya, ASM S IBMR ABSTRACT: Mobile Ad hoc networks (MANETs) are a new paradigm of wireless network, offering unrestricted mobility without any underlying

More information

Wireless Sensor Networks Chapter 14: Security in WSNs

Wireless Sensor Networks Chapter 14: Security in WSNs Wireless Sensor Networks Chapter 14: Security in WSNs António Grilo Courtesy: see reading list Goals of this chapter To give an understanding of the security vulnerabilities of Wireless Sensor Networks

More information

Bit Chat: A Peer-to-Peer Instant Messenger

Bit Chat: A Peer-to-Peer Instant Messenger Bit Chat: A Peer-to-Peer Instant Messenger Shreyas Zare shreyas@technitium.com https://technitium.com December 20, 2015 Abstract. Bit Chat is a peer-to-peer instant messaging concept, allowing one-to-one

More information

Vulnerabilities of Intrusion Detection Systems in Mobile Ad-hoc Networks - The routing problem

Vulnerabilities of Intrusion Detection Systems in Mobile Ad-hoc Networks - The routing problem Vulnerabilities of Intrusion Detection Systems in Mobile Ad-hoc Networks - The routing problem Ernesto Jiménez Caballero Helsinki University of Technology erjica@gmail.com Abstract intrusion detection

More information

12/3/08. Security in Wireless LANs and Mobile Networks. Wireless Magnifies Exposure Vulnerability. Mobility Makes it Difficult to Establish Trust

12/3/08. Security in Wireless LANs and Mobile Networks. Wireless Magnifies Exposure Vulnerability. Mobility Makes it Difficult to Establish Trust Security in Wireless LANs and Mobile Networks Wireless Magnifies Exposure Vulnerability Information going across the wireless link is exposed to anyone within radio range RF may extend beyond a room or

More information

Packet Level Authentication Overview

Packet Level Authentication Overview Packet Level Authentication Overview Dmitrij Lagutin, Dmitrij.Lagutin@hiit.fi Helsinki Institute for Information Technology HIIT Aalto University School of Science and Technology Contents Introduction

More information

An Overview of ZigBee Networks

An Overview of ZigBee Networks An Overview of ZigBee Networks A guide for implementers and security testers Matt Hillman Contents 1. What is ZigBee?... 3 1.1 ZigBee Versions... 3 2. How Does ZigBee Operate?... 3 2.1 The ZigBee Stack...

More information

Security for Ad Hoc Networks. Hang Zhao

Security for Ad Hoc Networks. Hang Zhao Security for Ad Hoc Networks Hang Zhao 1 Ad Hoc Networks Ad hoc -- a Latin phrase which means "for this [purpose]". An autonomous system of mobile hosts connected by wireless links, often called Mobile

More information

Link Layer and Network Layer Security for Wireless Networks

Link Layer and Network Layer Security for Wireless Networks White Paper Link Layer and Network Layer Security for Wireless Networks Abstract Wireless networking presents a significant security challenge. There is an ongoing debate about where to address this challenge:

More information

Security vulnerabilities in the Internet and possible solutions

Security vulnerabilities in the Internet and possible solutions Security vulnerabilities in the Internet and possible solutions 1. Introduction The foundation of today's Internet is the TCP/IP protocol suite. Since the time when these specifications were finished in

More information

Network Security 網 路 安 全. Lecture 1 February 20, 2012 洪 國 寶

Network Security 網 路 安 全. Lecture 1 February 20, 2012 洪 國 寶 Network Security 網 路 安 全 Lecture 1 February 20, 2012 洪 國 寶 1 Outline Course information Motivation Introduction to security Basic network concepts Network security models Outline of the course 2 Course

More information

Lecture Objectives. Lecture 8 Mobile Networks: Security in Wireless LANs and Mobile Networks. Agenda. References

Lecture Objectives. Lecture 8 Mobile Networks: Security in Wireless LANs and Mobile Networks. Agenda. References Lecture Objectives Wireless Networks and Mobile Systems Lecture 8 Mobile Networks: Security in Wireless LANs and Mobile Networks Introduce security vulnerabilities and defenses Describe security functions

More information

Security and Privacy Issues in Wireless Ad Hoc, Mesh, and Sensor Networks

Security and Privacy Issues in Wireless Ad Hoc, Mesh, and Sensor Networks Advance in Electronic and Electric Engineering. ISSN 2231-1297, Volume 4, Number 4 (2014), pp. 381-388 Research India Publications http://www.ripublication.com/aeee.htm Security and Privacy Issues in Wireless

More information

Wireless Sensor Network Security. Seth A. Hellbusch CMPE 257

Wireless Sensor Network Security. Seth A. Hellbusch CMPE 257 Wireless Sensor Network Security Seth A. Hellbusch CMPE 257 Wireless Sensor Networks (WSN) 2 The main characteristics of a WSN include: Power consumption constrains for nodes using batteries or energy

More information

HANDBOOK 8 NETWORK SECURITY Version 1.0

HANDBOOK 8 NETWORK SECURITY Version 1.0 Australian Communications-Electronic Security Instruction 33 (ACSI 33) Point of Contact: Customer Services Team Phone: 02 6265 0197 Email: assist@dsd.gov.au HANDBOOK 8 NETWORK SECURITY Version 1.0 Objectives

More information

Adapting Distributed Hash Tables for Mobile Ad Hoc Networks

Adapting Distributed Hash Tables for Mobile Ad Hoc Networks University of Tübingen Chair for Computer Networks and Internet Adapting Distributed Hash Tables for Mobile Ad Hoc Networks Tobias Heer, Stefan Götz, Simon Rieche, Klaus Wehrle Protocol Engineering and

More information

Remote Access Security

Remote Access Security Glen Doss Towson University Center for Applied Information Technology Remote Access Security I. Introduction Providing remote access to a network over the Internet has added an entirely new dimension to

More information

IPv6 SECURITY. May 2011. The Government of the Hong Kong Special Administrative Region

IPv6 SECURITY. May 2011. The Government of the Hong Kong Special Administrative Region IPv6 SECURITY May 2011 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without the express

More information

Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution.

Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution. Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution. 1 Opening quote. 2 The topics of cryptographic key management

More information

Problems of Security in Ad Hoc Sensor Network

Problems of Security in Ad Hoc Sensor Network Problems of Security in Ad Hoc Sensor Network Petr Hanáček * hanacek@fit.vutbr.cz Abstract: The paper deals with a problem of secure communication between autonomous agents that form an ad hoc sensor wireless

More information

Security (II) ISO 7498-2: Security Architecture of OSI Reference Model. Outline. Course Outline: Fundamental Topics. EE5723/EE4723 Spring 2012

Security (II) ISO 7498-2: Security Architecture of OSI Reference Model. Outline. Course Outline: Fundamental Topics. EE5723/EE4723 Spring 2012 Course Outline: Fundamental Topics System View of Network Security Network Security Model Security Threat Model & Security Services Model Overview of Network Security Security Basis: Cryptography Secret

More information

Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs

Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks

More information

CS5008: Internet Computing

CS5008: Internet Computing CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is

More information

Definition. A Historical Example

Definition. A Historical Example Overlay Networks This lecture contains slides created by Ion Stoica (UC Berkeley). Slides used with permission from author. All rights remain with author. Definition Network defines addressing, routing,

More information

SANE: A Protection Architecture For Enterprise Networks

SANE: A Protection Architecture For Enterprise Networks Fakultät IV Elektrotechnik und Informatik Intelligent Networks and Management of Distributed Systems Research Group Prof. Anja Feldmann, Ph.D. SANE: A Protection Architecture For Enterprise Networks WS

More information

Study of Different Types of Attacks on Multicast in Mobile Ad Hoc Networks

Study of Different Types of Attacks on Multicast in Mobile Ad Hoc Networks Study of Different Types of Attacks on Multicast in Mobile Ad Hoc Networks Hoang Lan Nguyen and Uyen Trang Nguyen Department of Computer Science and Engineering, York University 47 Keele Street, Toronto,

More information

Internet Protocol: IP packet headers. vendredi 18 octobre 13

Internet Protocol: IP packet headers. vendredi 18 octobre 13 Internet Protocol: IP packet headers 1 IPv4 header V L TOS Total Length Identification F Frag TTL Proto Checksum Options Source address Destination address Data (payload) Padding V: Version (IPv4 ; IPv6)

More information

ssumathy@vit.ac.in upendra_mcs2@yahoo.com

ssumathy@vit.ac.in upendra_mcs2@yahoo.com S. Sumathy 1 and B.Upendra Kumar 2 1 School of Computing Sciences, VIT University, Vellore-632 014, Tamilnadu, India ssumathy@vit.ac.in 2 School of Computing Sciences, VIT University, Vellore-632 014,

More information

BSc (Hons.) Computer Science with Network Security. Examinations for 2011/2012 - Semester 2

BSc (Hons.) Computer Science with Network Security. Examinations for 2011/2012 - Semester 2 BSc (Hons.) Computer Science with Network Security BCNS/09/FT Examinations for 2011/2012 - Semester 2 MODULE: WIRELESS NETWORK SECURITY MODULE CODE: SECU 3105 Duration: 2 Hours 15 Minutes Reading time:

More information

Information Technology Career Cluster Introduction to Cybersecurity Course Number: 11.48100

Information Technology Career Cluster Introduction to Cybersecurity Course Number: 11.48100 Information Technology Career Cluster Introduction to Cybersecurity Course Number: 11.48100 Course Description: Introduction to Cybersecurity is designed to provide students the basic concepts and terminology

More information

Endpoint Based Policy Management: The Road Ahead

Endpoint Based Policy Management: The Road Ahead Endpoint Based Policy Management: The Road Ahead Introduction In a rapidly growing and crowded security solutions market, organizations need to deploy the most effective technologies taking into consideration

More information

TDM services over IP networks

TDM services over IP networks Keyur Parikh Junius Kim TDM services over IP networks 1. ABSTRACT Time Division Multiplexing (TDM) circuits have been the backbone of communications over the past several decades. These circuits which

More information

Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1

Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1 Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3

More information

Preventing Resource Exhaustion Attacks in Ad Hoc Networks

Preventing Resource Exhaustion Attacks in Ad Hoc Networks Preventing Resource Exhaustion Attacks in Ad Hoc Networks Masao Tanabe and Masaki Aida NTT Information Sharing Platform Laboratories, NTT Corporation, 3-9-11, Midori-cho, Musashino-shi, Tokyo 180-8585

More information

Chapter 9: Transport Layer and Security Protocols for Ad Hoc Wireless Networks

Chapter 9: Transport Layer and Security Protocols for Ad Hoc Wireless Networks Chapter 9: Transport Layer and Security Protocols for Ad Hoc Wireless Networks Introduction Issues Design Goals Classifications TCP Over Ad Hoc Wireless Networks Other Transport Layer Protocols Security

More information

Security in Ad Hoc Network

Security in Ad Hoc Network Security in Ad Hoc Network Bingwen He Joakim Hägglund Qing Gu Abstract Security in wireless network is becoming more and more important while the using of mobile equipments such as cellular phones or laptops

More information

All vulnerabilities that exist in conventional wired networks apply and likely easier Theft, tampering of devices

All vulnerabilities that exist in conventional wired networks apply and likely easier Theft, tampering of devices Wireless Security All vulnerabilities that exist in conventional wired networks apply and likely easier Theft, tampering of devices Portability Tamper-proof devices? Intrusion and interception of poorly

More information

NETWORK SECURITY (W/LAB) Course Syllabus

NETWORK SECURITY (W/LAB) Course Syllabus 6111 E. Skelly Drive P. O. Box 477200 Tulsa, OK 74147-7200 NETWORK SECURITY (W/LAB) Course Syllabus Course Number: NTWK-0008 OHLAP Credit: Yes OCAS Code: 8131 Course Length: 130 Hours Career Cluster: Information

More information

A very short history of networking

A very short history of networking A New vision for network architecture David Clark M.I.T. Laboratory for Computer Science September, 2002 V3.0 Abstract This is a proposal for a long-term program in network research, consistent with the

More information

Best Practices for SIP Security

Best Practices for SIP Security Best Practices for SIP Security IMTC SIP Parity Group Version 21 November 9, 2011 Table of Contents 1. Overview... 33 2. Security Profile... 33 3. Authentication & Identity Protection... 33 4. Protecting

More information

From Network Security To Content Filtering

From Network Security To Content Filtering Computer Fraud & Security, May 2007 page 1/10 From Network Security To Content Filtering Network security has evolved dramatically in the last few years not only for what concerns the tools at our disposals

More information

Threats and Security Analysis for Enhanced Secure Neighbor Discovery Protocol (SEND) of IPv6 NDP Security

Threats and Security Analysis for Enhanced Secure Neighbor Discovery Protocol (SEND) of IPv6 NDP Security Threats and Security Analysis for Enhanced Secure Neighbor Discovery Protocol (SEND) of IPv6 NDP Security Yvette E. Gelogo 1, Ronnie D. Caytiles 1 and Byungjoo Park 1 * 1Multimedia Engineering Department,

More information

State of New Mexico Statewide Architectural Configuration Requirements. Title: Network Security Standard S-STD005.001. Effective Date: April 7, 2005

State of New Mexico Statewide Architectural Configuration Requirements. Title: Network Security Standard S-STD005.001. Effective Date: April 7, 2005 State of New Mexico Statewide Architectural Configuration Requirements Title: Network Security Standard S-STD005.001 Effective Date: April 7, 2005 1. Authority The Department of Information Technology

More information

Securing VoIP Networks using graded Protection Levels

Securing VoIP Networks using graded Protection Levels Securing VoIP Networks using graded Protection Levels Andreas C. Schmidt Bundesamt für Sicherheit in der Informationstechnik, Godesberger Allee 185-189, D-53175 Bonn Andreas.Schmidt@bsi.bund.de Abstract

More information

SECURE DATA TRANSMISSION USING INDISCRIMINATE DATA PATHS FOR STAGNANT DESTINATION IN MANET

SECURE DATA TRANSMISSION USING INDISCRIMINATE DATA PATHS FOR STAGNANT DESTINATION IN MANET SECURE DATA TRANSMISSION USING INDISCRIMINATE DATA PATHS FOR STAGNANT DESTINATION IN MANET MR. ARVIND P. PANDE 1, PROF. UTTAM A. PATIL 2, PROF. B.S PATIL 3 Dept. Of Electronics Textile and Engineering

More information

Wireless Network Security

Wireless Network Security Wireless Network Security Bhavik Doshi Privacy and Security Winter 2008-09 Instructor: Prof. Warren R. Carithers Due on: February 5, 2009 Table of Contents Sr. No. Topic Page No. 1. Introduction 3 2. An

More information

Securing MANET Using Diffie Hellman Digital Signature Scheme

Securing MANET Using Diffie Hellman Digital Signature Scheme Securing MANET Using Diffie Hellman Digital Signature Scheme Karamvir Singh 1, Harmanjot Singh 2 1 Research Scholar, ECE Department, Punjabi University, Patiala, Punjab, India 1 Karanvirk09@gmail.com 2

More information

Security in IPv6. Basic Security Requirements and Techniques. Confidentiality. Integrity

Security in IPv6. Basic Security Requirements and Techniques. Confidentiality. Integrity Basic Security Requirements and Techniques Confidentiality The property that stored or transmitted information cannot be read or altered by an unauthorized party Integrity The property that any alteration

More information

High Performance VPN Solutions Over Satellite Networks

High Performance VPN Solutions Over Satellite Networks High Performance VPN Solutions Over Satellite Networks Enhanced Packet Handling Both Accelerates And Encrypts High-Delay Satellite Circuits Characteristics of Satellite Networks? Satellite Networks have

More information

CHAPTER 2. QoS ROUTING AND ITS ROLE IN QOS PARADIGM

CHAPTER 2. QoS ROUTING AND ITS ROLE IN QOS PARADIGM CHAPTER 2 QoS ROUTING AND ITS ROLE IN QOS PARADIGM 22 QoS ROUTING AND ITS ROLE IN QOS PARADIGM 2.1 INTRODUCTION As the main emphasis of the present research work is on achieving QoS in routing, hence this

More information

Final exam review, Fall 2005 FSU (CIS-5357) Network Security

Final exam review, Fall 2005 FSU (CIS-5357) Network Security Final exam review, Fall 2005 FSU (CIS-5357) Network Security Instructor: Breno de Medeiros 1. What is an insertion attack against a NIDS? Answer: An insertion attack against a network intrusion detection

More information

CS 665: Computer System Security. Network Security. Usage environment. Sources of vulnerabilities. Information Assurance Module

CS 665: Computer System Security. Network Security. Usage environment. Sources of vulnerabilities. Information Assurance Module CS 665: Computer System Security Network Security Bojan Cukic Lane Department of Computer Science and Electrical Engineering West Virginia University 1 Usage environment Anonymity Automation, minimal human

More information

Industrial Communication. Securing Industrial Wireless

Industrial Communication. Securing Industrial Wireless Industrial Communication Whitepaper Securing Industrial Wireless Contents Introduction... 3 Wireless Applications... 4 Potential Threats... 5 Denial of Service... 5 Eavesdropping... 5 Rogue Access Point...

More information

TS-3GB-S.R0103-0v1.0 Network Firewall Configuration and Control (NFCC) - Stage 1 Requirements

TS-3GB-S.R0103-0v1.0 Network Firewall Configuration and Control (NFCC) - Stage 1 Requirements TS-3GB-S.R0103-0v1.0 Network Firewall Configuration and Control (NFCC) - Stage 1 Requirements Mar 3,2005 THE TELECOMMUNICATION TECHNOLOGY COMMITTEE TS-3GB-S.R0103-0v1.0 Network Firewall Configuration and

More information

Object Identification for Ubiquitous Networking

Object Identification for Ubiquitous Networking Object Identification for Ubiquitous Networking Gyu Myoung Lee 1, Jun Kyun Choi 2, Noel Crespi 1 1 Institut TELECOM SudParis 9 rue Charles Fourier, 91011, Evry France {gm.lee, noel.crespi}@it-sudparis.eu

More information

Service Provider implementation of SIP regarding security

Service Provider implementation of SIP regarding security Service Provider implementation of SIP regarding security Vesselin Tzvetkov, Holger Zuleger {vesselin.tzvetkov, holger.zuleger}@arcor.net Arcor AG&Co KG, Alfred-Herrhausen-Allee 1, 65760 Eschborn, Germany

More information

Thingsquare Technology

Thingsquare Technology Thingsquare Technology Thingsquare connects smartphone apps with things such as thermostats, light bulbs, and street lights. The devices have a programmable wireless chip that runs the Thingsquare firmware.

More information

Outline. 15-744: Computer Networking. Narrow Waist of the Internet Key to its Success. NSF Future Internet Architecture

Outline. 15-744: Computer Networking. Narrow Waist of the Internet Key to its Success. NSF Future Internet Architecture Outline 15-744: Computer Networking L-15 Future Internet Architecture 2 Motivation and discussion Some proposals: CCN Nebula Mobility First XIA XIA overview AIP Scion 2 NSF Future Internet Architecture

More information

Basic Vulnerability Issues for SIP Security

Basic Vulnerability Issues for SIP Security Introduction Basic Vulnerability Issues for SIP Security By Mark Collier Chief Technology Officer SecureLogix Corporation mark.collier@securelogix.com The Session Initiation Protocol (SIP) is the future

More information

Fundamentals of Network Security - Theory and Practice-

Fundamentals of Network Security - Theory and Practice- Fundamentals of Network Security - Theory and Practice- Program: Day 1... 1 1. General Security Concepts... 1 2. Identifying Potential Risks... 1 Day 2... 2 3. Infrastructure and Connectivity... 2 4. Monitoring

More information

VoIP Security. Seminar: Cryptography and Security. 07.06.2006 Michael Muncan

VoIP Security. Seminar: Cryptography and Security. 07.06.2006 Michael Muncan VoIP Security Seminar: Cryptography and Security Michael Muncan Overview Introduction Secure SIP/RTP Zfone Skype Conclusion 1 Introduction (1) Internet changed to a mass media in the middle of the 1990s

More information

Measurement of the Usage of Several Secure Internet Protocols from Internet Traces

Measurement of the Usage of Several Secure Internet Protocols from Internet Traces Measurement of the Usage of Several Secure Internet Protocols from Internet Traces Yunfeng Fei, John Jones, Kyriakos Lakkas, Yuhong Zheng Abstract: In recent years many common applications have been modified

More information

Proxy Server, Network Address Translator, Firewall. Proxy Server

Proxy Server, Network Address Translator, Firewall. Proxy Server Proxy Server, Network Address Translator, Firewall 1 Proxy Server 2 1 Introduction What is a proxy server? Acts on behalf of other clients, and presents requests from other clients to a server. Acts as

More information

Request for Comments: 5207 Category: Informational L. Eggert Nokia April 2008

Request for Comments: 5207 Category: Informational L. Eggert Nokia April 2008 Network Working Group Request for Comments: 5207 Category: Informational M. Stiemerling J. Quittek NEC L. Eggert Nokia April 2008 NAT and Firewall Traversal Issues of Host Identity Protocol (HIP) Communication

More information

Wireless Sensor Network: Challenges, Issues and Research

Wireless Sensor Network: Challenges, Issues and Research ISBN 978-93-84468-20-0 Proceedings of 2015 International Conference on Future Computational Technologies (ICFCT'2015) Singapore, March 29-30, 2015, pp. 224-228 Wireless Sensor Network: Challenges, Issues

More information

E-Commerce Security. The Client-Side Vulnerabilities. Securing the Data Transaction LECTURE 7 (SECURITY)

E-Commerce Security. The Client-Side Vulnerabilities. Securing the Data Transaction LECTURE 7 (SECURITY) E-Commerce Security An e-commerce security system has four fronts: LECTURE 7 (SECURITY) Web Client Security Data Transport Security Web Server Security Operating System Security A safe e-commerce system

More information

Firewall Security. Presented by: Daminda Perera

Firewall Security. Presented by: Daminda Perera Firewall Security Presented by: Daminda Perera 1 Firewalls Improve network security Cannot completely eliminate threats and a=acks Responsible for screening traffic entering and/or leaving a computer network

More information

MOBILE AD HOC NETWORKS UNDER WORMHOLE ATTACK: A SIMULATION STUDY

MOBILE AD HOC NETWORKS UNDER WORMHOLE ATTACK: A SIMULATION STUDY MOBILE AD HOC NETWORKS UNDER WORMHOLE ATTACK: A SIMULATION STUDY Nadher M. A. Al_Safwani, Suhaidi Hassan, and Mohammed M. Kadhum Universiti Utara Malaysia, Malaysia, {suhaidi, khadum}@uum.edu.my, nadher@internetworks.com

More information

An Experimental Study on Wireless Security Protocols over Mobile IP Networks

An Experimental Study on Wireless Security Protocols over Mobile IP Networks An Experimental Study on Wireless Security Protocols over Mobile IP Networks Avesh K. Agarwal Department of Computer Science Email: akagarwa@unity.ncsu.edu Jorinjit S. Gill Department of Electrical and

More information

Firewalls, Tunnels, and Network Intrusion Detection

Firewalls, Tunnels, and Network Intrusion Detection Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls

More information

Chapter 10. Network Security

Chapter 10. Network Security Chapter 10 Network Security 10.1. Chapter 10: Outline 10.1 INTRODUCTION 10.2 CONFIDENTIALITY 10.3 OTHER ASPECTS OF SECURITY 10.4 INTERNET SECURITY 10.5 FIREWALLS 10.2 Chapter 10: Objective We introduce

More information

Module 8. Network Security. Version 2 CSE IIT, Kharagpur

Module 8. Network Security. Version 2 CSE IIT, Kharagpur Module 8 Network Security Lesson 3 Firewalls Specific Instructional Objectives On completion of this lesson, the students will be able to answer: What a firewall is? What are the design goals of Firewalls

More information

Virtual Private Networks Secured Connectivity for the Distributed Organization

Virtual Private Networks Secured Connectivity for the Distributed Organization Virtual Private Networks Secured Connectivity for the Distributed Organization FORTINET VIRTUAL PRIVATE NETWORKS PAGE 2 Introduction A Virtual Private Network (VPN) allows organizations to securely connect

More information

Security Considerations for Intrinsic Monitoring within IPv6 Networks: Work in Progress

Security Considerations for Intrinsic Monitoring within IPv6 Networks: Work in Progress Security Considerations for Intrinsic Monitoring within IPv6 Networks: Work in Progress Alan Davy and Lei Shi Telecommunication Software&Systems Group, Waterford Institute of Technology, Ireland adavy,lshi@tssg.org

More information

Wireless Threats To Corporate Security A Presentation for ISACA UK Northern Chapter

Wireless Threats To Corporate Security A Presentation for ISACA UK Northern Chapter Wireless Threats To Corporate Security A Presentation for ISACA UK Northern Chapter Introduction Who are we? Matt Moore, Senior Consultant @ PenTest Ltd. Mark Rowe, Technical Director @ PenTest Ltd. What

More information

A Catechistic Method for Traffic Pattern Discovery in MANET

A Catechistic Method for Traffic Pattern Discovery in MANET A Catechistic Method for Traffic Pattern Discovery in MANET R. Saranya 1, R. Santhosh 2 1 PG Scholar, Computer Science and Engineering, Karpagam University, Coimbatore. 2 Assistant Professor, Computer

More information

83-10-41 Types of Firewalls E. Eugene Schultz Payoff

83-10-41 Types of Firewalls E. Eugene Schultz Payoff 83-10-41 Types of Firewalls E. Eugene Schultz Payoff Firewalls are an excellent security mechanism to protect networks from intruders, and they can establish a relatively secure barrier between a system

More information

What is a Firewall? Computer Security. Firewalls. What is a Firewall? What is a Firewall?

What is a Firewall? Computer Security. Firewalls. What is a Firewall? What is a Firewall? What is a Firewall? Computer Security Firewalls fire wall 1 : a wall constructed to prevent the spread of fire 2 usually firewall : a computer or computer software that prevents unauthorized access to

More information

Thwarting Selective Insider Jamming Attacks in Wireless Network by Delaying Real Time Packet Classification

Thwarting Selective Insider Jamming Attacks in Wireless Network by Delaying Real Time Packet Classification Thwarting Selective Insider Jamming Attacks in Wireless Network by Delaying Real Time Packet Classification LEKSHMI.M.R Department of Computer Science and Engineering, KCG College of Technology Chennai,

More information

IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT

IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT Roopa K. Panduranga Rao MV Dept of CS and Engg., Dept of IS and Engg., J.N.N College of Engineering, J.N.N College of Engineering,

More information

Examining Proxies to Mitigate Pervasive Surveillance

Examining Proxies to Mitigate Pervasive Surveillance Examining Proxies to Mitigate Pervasive Surveillance Eliot Lear Barbara Fraser Abstract The notion of pervasive surveillance assumes that it is possible for an attacker to have access to all links and

More information

VoIP Security Threats and Vulnerabilities

VoIP Security Threats and Vulnerabilities Abstract VoIP Security Threats and Vulnerabilities S.M.A.Rizvi and P.S.Dowland Network Research Group, University of Plymouth, Plymouth, UK e-mail: info@network-research-group.org This paper presents the

More information

Session Initiation Protocol Deployment in Ad-Hoc Networks: a Decentralized Approach

Session Initiation Protocol Deployment in Ad-Hoc Networks: a Decentralized Approach Session Initiation Protocol Deployment in Ad-Hoc Networks: a Decentralized Approach Simone Leggio, Jukka Manner, Antti Hulkkonen, Kimmo Raatikainen Department of Computer Science University of Helsinki,

More information

REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB

REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB Conducted: 29 th March 5 th April 2007 Prepared By: Pankaj Kohli (200607011) Chandan Kumar (200607003) Aamil Farooq (200505001) Network Audit Table of

More information

SIMULATION STUDY OF BLACKHOLE ATTACK IN THE MOBILE AD HOC NETWORKS

SIMULATION STUDY OF BLACKHOLE ATTACK IN THE MOBILE AD HOC NETWORKS Journal of Engineering Science and Technology Vol. 4, No. 2 (2009) 243-250 School of Engineering, Taylor s University College SIMULATION STUDY OF BLACKHOLE ATTACK IN THE MOBILE AD HOC NETWORKS SHEENU SHARMA

More information

Computer Networking Networks

Computer Networking Networks Page 1 of 8 Computer Networking Networks 9.1 Local area network A local area network (LAN) is a network that connects computers and devices in a limited geographical area such as a home, school, office

More information

Prediction of DDoS Attack Scheme

Prediction of DDoS Attack Scheme Chapter 5 Prediction of DDoS Attack Scheme Distributed denial of service attack can be launched by malicious nodes participating in the attack, exploit the lack of entry point in a wireless network, and

More information

An Oracle White Paper December 2013. The Value of Diameter Signaling in Security and Interworking Between 3G and LTE Networks

An Oracle White Paper December 2013. The Value of Diameter Signaling in Security and Interworking Between 3G and LTE Networks An Oracle White Paper December 2013 The Value of Diameter Signaling in Security and Interworking Between 3G and LTE Networks Introduction Today s mobile networks are no longer limited to voice calls. With

More information

SPINS: Security Protocols for Sensor Networks

SPINS: Security Protocols for Sensor Networks SPINS: Security Protocols for Sensor Networks Adrian Perrig, Robert Szewczyk, J.D. Tygar, Victor Wen, and David Culler Department of Electrical Engineering & Computer Sciences, University of California

More information

INTERNET SECURITY: FIREWALLS AND BEYOND. Mehernosh H. Amroli 4-25-2002

INTERNET SECURITY: FIREWALLS AND BEYOND. Mehernosh H. Amroli 4-25-2002 INTERNET SECURITY: FIREWALLS AND BEYOND Mehernosh H. Amroli 4-25-2002 Preview History of Internet Firewall Technology Internet Layer Security Transport Layer Security Application Layer Security Before

More information

Application Note. Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder )

Application Note. Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder ) Application Note Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder ) This document describes how to configure McAfee Firewall Enterprise to provide

More information

Key Hopping A Security Enhancement Scheme for IEEE 802.11 WEP Standards

Key Hopping A Security Enhancement Scheme for IEEE 802.11 WEP Standards White Paper Key Hopping A Security Enhancement Scheme for IEEE 802.11 WEP Standards By Dr. Wen-Ping Ying, Director of Software Development, February 2002 Introduction Wireless LAN networking allows the

More information

Security in Communication Networks

Security in Communication Networks Security in Communication Networks Lehrstuhl für Informatik 4 RWTH Aachen Prof. Dr. Otto Spaniol Dr. rer. nat. Dirk Thißen Page 1 Organization Lehrstuhl für Informatik 4 Lecture Lecture takes place on

More information