IPv6/IPv4 Automatic Dual Authentication Technique for Campus Network S. CHITPINITYON, S. SANGUANPONG, K. KOHT-ARSA, W. PITTAYAPITAK, S. ERJONGMANEE AND P. WATANAPONGSE
Agenda Introduction Design And Implementation Result and Measurement Conclusion 2
Introduction Transition from IPv4 to IPv6 is inevitable Not a sudden replacement Will coexist for a long period of time IPv4 and IPv6 are incompatible protocol Need NATs in order to communicate Or running both protocols in parallel 3
Introduction (con t) Today s OS can handle both IPv4 and IPv6 simultaneously (dualstack) A dual-stack client has two identity IPv4 address when connects to IPv4 server and IPv6 address when connects to IPv6 server The OS or the client s software decides which IP family it will use It might use IPv4 for some particular servers and vise versa 4
Current Obstacles Requirement of double authentication for dual-stack users Once for IPv4 and again for IPv6 Lack of complete platform to support lawful and accounting, and security Dual-stack aware system and infrastructure is needed management 5
Goals Provide a dual-stack network infrastructure Authentication mechanism Web captive portal with automatic IPv4 and IPv6 addresses binding WPA based (No web authentication) Dual-stack traffic logging Systematic integration Dual-stack: firewall, login, traffic log and quota management Accelerate the adoption of IPv6 for enterprise networks 6
Agenda Introduction Design And Implementation Result and Measurement Conclusion 7
Design and Implementation Implementation of software modules as the following components Login Servers Parallel Firewalls with Lightweight Stateless HTTP Redirector (LSHR) Session Manager Traffic Logger Quota Manager Deployment of the system using Commercial-off-the-shelf (COTS) hardware 8
Design & Implementation System components 3. Session Manager 1. Login servers Login servers Internal network Core Router 2. Parallel Firewall Gateway Router Internet 5. Quota Manager 4. Traffic Logger 9
Design & Implementation: System Components 1) Login Server The authenticator 3. Session Manager 1. Login servers Login servers Display a login page and asking for user s credential Core Router 2. Parallel Firewall Gateway Router Address discoveries and bindings are also performed by the login server 5. Quota Manager 4. Traffic Logger 10
Design & Implementation: System Components 2) Parallel Firewalls High-availability, highly scalable and stateful IPv4/IPv6 parallel firewalls 3. Session Manager Core Router 1. Login servers Login servers 2. Parallel Firewall Gateway Router Acting as redirector for unauthenticated clients Lightweight Stateless HTTP Redirector (LSHR) 5. Quota Manager 4. Traffic Logger 11
Design & Implementation: System Components: Parallel Firewalls Parallel Firewalls Load Balancer Load Balancer Switch COTS Ethernet switch Distribute/aggregate packets by modifying packet s VLAN tag Hash based packet distributions FW1 FW2 FW3 Switch Load Balancer 12
Design & Implementation: System Components: Parallel Firewalls Lightweight Stateless HTTP Redirector (LSHR) Robust, low-latency, small footprint Immune to SYN-flood Incoming packet Corresponding reply packet Application HTTP Application HTTP SYN SYN + ACK TCP/IP OS Stack Transport Internet Data Link TCP IP Frame Transport Internet Data Link TCP IP Frame ACK no payload ACK HTTP request ACK unknown payload (None) ACK+ FIN + HTTP redirect payload (None) (a) Standard HTTP Server (b) Lightweight Stateless HTTP Redirector ACK + FIN ACK 13
Design & Implementation: System Components 3) Session Manager 3. Session Manager Core Router 1. Login servers Login servers 2. Parallel Firewall Gateway Router Keeps track of all active users sessions IPv4 and IPv6 addresses from the same session are bundled together as a single entry Automatic time-out for inactive session 5. Quota Manager 4. Traffic Logger 14
Design & Implementation: System Components Session Manager: In Action Parallel Firewall LSHR 7. Firewall control Session Manager 1. HTTP Request 2. Redirected message 6. Session's login Information Login Server 3. Request Login Page 4. Login Page 5. User s Credential Client 15
Design & Implementation: System Components 4) Traffic Logger 3. Session Manager Core Router 5. Quota Manager 1. Login servers Login servers 2. Parallel Firewall 4. Traffic Logger Gateway Router Record user s activity for security and legal purposes Web-log: request date/time, client IP addr., server IP addr., client port, server port, URL requested, and URL referrer. Per-packet Log: date/time, src IP, dst IP, pkt size (byte), protocol version (4 or 6), protocol type (TCP, UDP, etc.), src port (for TCP/UDP), dst port (for TCP/UDP), and flags (for TCP). 16
Design & Implementation: System Components 5) Quota Manager Individual user s bandwidth accounting 3. Session Manager Core Router 1. Login servers Login servers 2. Parallel Firewall Gateway Router Adopts token bucket algorithm Filling rate and bucket size are adjustable individually or per group Rate limit per user (all current sessions) 5. Quota Manager 4. Traffic Logger 17
Design & Implementation: Address discoveries and binding technique Address Discoveries and Binding Embedded Image in the Login Page : <td> <img src= https://login9-v4.ku.ac.th/v4.php?hash=f1f2464d5532 > <img src= https://login9-v6.ku.ac.th/v6.php?hash=f1f2464d5532 > </td> : 18
Design & Implementation: Address discoveries and binding technique Addresses Binding Client Addresses binding using hash code f1f2464d5532 loginx loginx-v4 IPv4 Stack An IPv4-request to loginx-v4 with f1f2464d5532 IPv4 Stack loginx-v6 IPv6 Stack An IPv6-request to loginx-v6 with f1f2464d5532 IPv6 Stack 19
Agenda Introduction Design And Implementation Result and Measurement Conclusion 20
Result and Measurement Testbed Kasetsart University campus network Commercial-grade, dual-stack routers and switches in the campus backbone Parallel firewall 8 nodes 2.4 GHz dual-cores Xeon X5270 CPUs, 4 GB RAM 4 Gigabit Ethernet Interfaces Linux 2.6.29.1, Netfilter, iptables 21
Result and Measurement Test Environments Data collected from November 1, 2014 to January 31, 2015 88,000 authentication sessions per day 100,000+ user accounts 66,000+ students 34,000+ faculties and staffs from 4 campuses and 20 research centers) 25,650 unique user per day, on average 22
Result and Measurement Login statistics Login statistics Quantity Number of IPv4/IPv6 login requests 6,218,911 Number of IPv6 login requests 1,053,019 (~16.9%) Number of unique usernames 77,498 Number of unique IPv4 addresses 33,862 Number of unique IPv6 addresses 898,295 Number of unique IPv4 NAT 45,906 23
Result and Measurement IPv6 HTTP request statistics IPv6 HTTP request statistics Quantity Number of URL requests 12,7531,311 Number of unique host names 216,122 Number of unique domain names 18,488 Number of unique Thai host names 1,310 (~0.06%) Number of unique Thai domain names 119 (~0.64%) 24
Result and Measurement Top 10 domains Rank Domain # Requests % 1 youtube.com 15,026,017 11.78% 2 googlevideo.com 14,108,829 11.06% 3 google-analytics.com 9,179,113 7.20% 4 google.com 9,167,368 7.19% 5 googlesyndication.com 8,450,931 6.63% 6 windowsupdate.com 7,744,331 6.07% 7 ytimg.com 7,194,367 5.64% 8 doubleclick.net 6,445,956 5.05% 9 instagram.com 6,433,370 5.04% 10 gstatic.com 4,440,211 3.48% 25
Result and Measurement Unique users login with IPv6 41% of users never login with IPv6 57% of users occasionally login with IPv6 2% of users always use IPv6 26
Result and Measurement Unique IPv4 addresses with IPv6 binding 38% of IPv4 addresses are never bound with IPv6 55% of IPv4 addresses are occasionally bound with IPv6 7% of IPv4 addresses are always bound with IPv6 address 27
Next Plan Dual-Stack service on Eduroam On testing Software Release for Community to promote IPv6 in Thailand Transparent auto address discovery system Firewall Integration Module Current support Linux IPtable Development of middleware plugin for other firewall such as IPFW IPv4/IPv6 Logging 28
Agenda Introduction Design And Implementation Result and Measurement Conclusion 29
Conclusion We proposed a dual-stack network infrastructure that fully supports both IPv4 and IPv6 The system supports dual-stack authentication, traffic logging, and quota based usage control We implemented and deployed the system in the large-scale campus network with 25,000+ concurrent user login 30
Q&A 31