AdSec: A System for Adaptive Network Security

Size: px

Start display at page:

Download "AdSec: A System for Adaptive Network Security"

Warren Kelly
8 years ago
Views:

1 AdSec: A System for Adaptive Network Security Kihong Park Network Systems Lab & CERIAS Dept. of Computer Sciences Purdue University park@cs.purdue.edu Joint: E. Spafford (co-pi), M. Tripunitara, G. Nalawade

2 Motivation Network environment Secure QoS

3 Motivation (cont.) Goal Facilitate Secure QoS User plane protection Control plane protection Minimal footprint

4 Technical Challenges Integrate QoS & security architectures Minimize security footprint Fault-tolerance Programmability Interoperability

5 Approach User plane protection: end-to-end Security services: confidentiality, integrity, authentication, access control Property of cryptographic protocols well-understood

6 Approach (cont.) Control plane protection Proactive: authentication/integrity of certain signalling Reactive: too costly to make 100% proactive (e.g., Gbps switching) security-qos trade-off selective, controlled introduction of security holes reactive management

certain signalling Reactive: too costly to make 100% proactive (e.

7 Approach (cont.) Adaptive security Combination of proactive/reactive rendering of security services Multiple levels of service Monitoring, control, and actuation Active resource management: control/scheduling Deterrent effect

8 Adaptive Security Architecture Short-term Long-term Monitoring Traffic monitoring Control input Logging and Access Control Control Filtering and data reduction On-line/off-line control Hierarchy management Switch/Router/ Network Element Actuation Information forwarding Control messaging

and data reduction On-line/off-line control Hierarchy management

9 Security Middleware Layer Application Layer Transport Layer SML SML Application Layer Transport Layer Network Layer Network Layer Data Link Physical Layers Data Link Physical Layers Network

10 Monitoring & Control Hierarchy Level 2 Level 1 Level 0 Level 2 Level 1 Level 0 Hierarchical structure for resiliency and scalablity Byzantine agreement protocols (2/3 majority) for isolating compromised nodes

11 Overview of AdSec Function Programmable network management system for adaptive network security Implementation of any logical hierarchy Monitoring, control, and actuation SNMP based User programmable

12 AdSec: Components MIB Dependency Relation (MDR) Managers Agents Monitor function Control function System libraries config. snmpd wrapper wrapper

13 MIB Dependency Relation a b c d SNMP SET SNMP GET e f

14 Monitor & Control Functions Monitor function F : SNMP GET Control function G : SNMP SET user programmable Function wrappers Transparent read/write local vs. remote MIB OID (IP, Port) physical mapping

15 AdSec: Implementation Details Prototype system SNMP version 1 UC Davis snmpd implementation Others (e.g., Sun Microsystems) possible CMU SNMP library Functions: Intrusion detection Anomaly detection Automatic control

, Sun Microsystems) possible CMU SNMP library

16 Benchmark: Set-up A Server (Manager) Legitimate Client (Manager) Ethernet Ethernet Internet Attacker Server (Manager) Router (Manager)

17 Benchmark: Set-up B Manager Manager Manager Victims (Agents) Internet Attacker Manager

18 On-going & Future Work Asynchronous extension: SNMP Trap Extensive monitor/control function libraries Integration with network management Active resource scheduling Integration with QoS management

Top-Down Network Design

Top-Down Network Design Chapter Nine Developing Network Management Strategies Copyright 2010 Cisco Press & Priscilla Oppenheimer 29 Network Management Design A good design can help an organization achieve