CS 678 P. T. Chung1 Network Management Security CS 678 Network Security, Dept. of Computer Science,...

transcript

CS 678 P. T. Chung 1

Network Management Security

CS 678 Network Security, Dept. of Computer Science, Long Island University,Brooklyn, NY

Outline

Basic Concepts of SNMP SNMPv1 Community Facility SNMPv3 Recommended Reading and WEB

Basic Concepts of SNMP An integrated collection of tools for network

monitoring and control. Single operator interface Minimal amount of separate equipment. Software

and network communications capability built into the existing equipment

SNMP key elements: Management station Managament agent Management information base Network Management protocol

Get, Set and Notify

PRINCIPLE OPERATIONMANAGER

AGENTS

SNMP STRUCTUREMANAGER AGENT

CONNECTIONLESS TRANSPORT SERVICE PROVIDER

SNMP PDUs

Management ApplicationMIB

Protocol context of SNMP

Proxy Configuration

SNMP v1 and v2 Trap – an unsolicited message

(reporting an alarm condition) SNMPv1 is ”connectionless” since

it utilizes UDP (rather than TCP) as the transport layer protocol.

SNMPv2 allows the use of TCP for ”reliable, connection-oriented” service.

SNMP PROTOCOL

MANAGER

SNMP MESSAGESMIB

OVERVIEW OF PDUs

getNext

response

manager agent

response

manager agent

response

manager agent

TO REQUEST THE VALUE OF 1 OR MORE VARIABLES

POSSIBLE ERRORS: • noSuchName Object does not exist / Object is

not a leaf

• tooBig Result does not fit in response PDU

• genErr All other causes

manager agentget

response

EXAMPLE MIB1

address (1) info (2) route-table (3)

route-entry (1)name (1) uptime (2)

130.89.16.2

printer-1 123456

dest(1) next(3)

policy(2)

GET EXAMPLESget(1.1.0) response(1.1.0 => 130.89.16.2)

get(1.2.0) response(error-status = noSuchName)

get(1.1) response(error-status = noSuchName)

get(1.1.0; 1.2.2.0) response(1.1.0 => 130.89.16.2; 1.2.2.0 => 123456)

get(1.3.1.3.5.1) response(1.3.1.3.5.1 => 2)

get(1.3.1.1.5.1) response(1.3.1.1.5.1 => 5)

get(1.3.1.1.5.1, 1.3.1.2.5.1, 1.3.1.3.5.1) response(1.3.1.1.5.1 => 5, 1.3.1.2.5.1 => 1, 1.3.1.3.5.1 =>

MESSAGE & PDU STRUCTURE

NAME 1 VALUE 1 NAME 2 VALUE 2 ••• ••• NAME n VALUE n

PDU TYPE* ERROR

VARIABLE BINDINGSSTATUSREQUEST

IDERRORINDEX

VERSION COMMUNITY SNMP PDU

variable bindings:

SNMP PDU:

SNMP message:

Comparison of SNMPv1 and SNMPv2SNMPv1 PDU SNMPv2 PDU Direction DescriptionGetRequest GetRequest Manager to agent Request value for

each listed object

GetRequest GetRequest Manager to agent Request next value for each listed object

------ GetBulkRequest Manager to agent Request multiple values

SetRequest SetRequest Manager to agent Set value for each listed object

------ InformRequest Manager to manager

Transmit unsolicited information

GetResponse Response Agent to manager or Manage to manager(SNMPv2)

Respond to manager request

Trap SNMPv2-Trap Agent to manager Transmit unsolicited information

SNMPv1 Community Facility

SNMP Community – Relationship between an SNMP agent and SNMP managers.

Three aspect of agent control: Authentication service Access policy Proxy service

SNMPv1 Administrative Concepts

SNMPv2 PROTOCOL OPERATIONS

getNext

response

manager agent

response

manager agent

response

manager agent

getBulk

response

manager agent

response

inform

manager "agent"

GET-BULK

NEW COMMAND getBulk IN SNMPv2 TO RETRIEVE A LARGE NUMBER OF

VARBINDS IMPROVES PERFORMANCE!

manager agentgetBulk

response

GETBULK PERFORMANCESource: Steve Waldbusser, Carnegie-Mellon University

NO SECURITY

WITH AUTHENTICATION WITH ENCRYPTION

Figures based on original (party based) SNMPv2

GET-BULK EXAMPLE

getBulk(max-repetitions = 4; 1.1)

response(1.1.0 => 130.89.16.2 1.2.1.0 => printer-11.2.2.0 => 1234561.3.1.1.2.1 => 2 )

GET-BULK EXAMPLE

getBulk(max-repetitions = 3; 1.3.1.1; 1.3.1.2; 1.3.1.3)

response(1.3.1.1.2.1 => 2; 1.3.1.2.2.1 => 1; 1.3.1.3.2.1 => 2

1.3.1.1.3.1 => 3; 1.3.1.2.3.1 => 1; 1.3.1.3.3.1 => 3

1.3.1.1.5.1 => 5; 1.3.1.2.5.1 => 1; 1.3.1.3.5.1 => 2 )

SNMPv3 SNMPv3 defines a security capability

to be used in conjunction with SNMPv1 or v2

SNMP v3 DESIGN DECISIONS

ADDRESS THE NEED FOR SECURY SET SUPPORT

DEFINE AN ARCHITECTURE THAT ALLOWS FOR LONGEVITY OF SNMP

ALLOW THAT DIFFERENT PORTIONS OF THE ARCHITECTURE

MOVE AT DIFFERENT SPEEDS TOWARDS STANDARD STATUS

SNMP v3 DESIGN DECISIONS

ALLOW FOR FUTURE EXTENSIONS KEEP SNMP AS SIMPLE AS POSSIBLE ALLOW FOR MINIMAL IMPLEMENTATIONS SUPPORT ALSO THE MORE COMPLEX

FEATURES, WHICH ARE REQUIRED IN LARGE

NETWORKS RE-USE EXISTING SPECIFICATIONS,

WHENEVER POSSIBLE

SNMPv3 Flow

SNMPv3 ARCHITECTURE

OTHERNOTIFICATIONORIGINATOR

COMMANDRESPONDER

COMMANDGENERATOR

NOTIFICATIONRECEIVER

PROXYFORWARDER

SNMP APPLICATIONS

SNMP ENGINE

MESSAGE PROCESSINGSUBSYSTEM

DISPATCHERSECURITY

SUBSYSTEMACCESS CONTROL

SUBSYSTEM

SNMP ENTITY

Traditional SNMP Manager

Traditional SNMP Agent

SNMPv3 MESSAGE STRUCTURE

msgVersionmsgID

msgMaxSizemsgFlags

msgSecurityModel

msgSecurityParameters

contextEngineIDcontextName

USED BY MESSAGE PROCESSING SUBSYSTEM

USED BY SNMPv3 PROCESSING MODULE

USED BY SECURITY SUBSYSTEM

USED BY ACCESS CONTROL SUBSYSTEMAND APPLICATIONS

SNMP3 Message Format with USM

User Security Model (USM) Designed to secure against:

Modification of information Masquerade Message stream modification Disclosure

Not intended to secure against: Denial of Service (DoS attack) Traffic analysis

Key Localization Process

View-Based Access Control Model (VACM)

VACM has two characteristics: Determines wheter access to a

managed object should be allowed. Make use of an MIB that:

Defines the access control policy for this agent.

Makes it possible for remote configuration to be used.

Access control decision

SECURE COMMUNICATION VERSUS ACCESS CONTROL

MANAGER

APPLICATION PROCESSES

TRANSPORT SERVICE

MANAGER AGENT

GET / GET-NEXT / GETBULKSET / TRAP / INFORM

SECURE COMMUNICATION

ACCESS CONTROL

USM: SECURITY THREATSTHREAT ADDRESSED? MECHANISM

REPLAY YES TIME STAMP

MASQUERADE YES MD5 / SHA-1

INTEGRITY YES (MD5 / SHA-1)

DISCLOSURE YES DES

DENIAL OF SERVICE YES

TRAFFIC ANALYSIS YES

USM MESSAGE STRUCTUREmsgVersion

msgIDmsgMaxSize

msgFlagsmsgSecurityModel

msgAuthoritativeEngineIDmsgAuthoritativeEngineBootsmsgAuthoritativeEngineTime

msgUserNamemsgAuthenticationParameters

msgPrivacyParameterscontextEngineID

contextName

REPLAY

MASQUERADE/INTEGRITY/DISCLOSURE

DISCLOSURE

MASQUERADE/INTEGRITY

IDEA BEHIND REPLAY PROTECTION

LOCAL NOTION OFREMOTE CLOCK

ALLOWEDLIFETIME

LOCALCLOCK

ID BOOTS TIME DATA ID BOOTS TIME DATA

Authoritative EngineNonauthoritative Engine

IDEA BEHIND DATA INTEGRITY AND AUTHENTICATION

HASH FUNCTION

DATAKEY

ADD THE MESSAGE AUTHENTICATION CODE (MAC) TO THE DATAAND SEND THE RESULT

IDEA BEHIND AUTHENTICATION

HASH FUNCTION

DATAUSER MAC

HASH FUNCTION

DATAUSER MAC

IDEA BEHIND THE DATA CONFIDENTIALITY (DES)

DES ALGORITHM

DATADES-KEY

ENCRYPTED DATA

IDEA BEHIND ENCRYPTION

DES ALGORITHM

DATADES-KEY

ENCRYPTED DATA

ENCRYPTED DATAUSER

DES ALGORITHM

DATADES-KEY

ENCRYPTED DATA

ENCRYPTED DATAUSER

VIEW BASED ACCESS CONTROL MODEL

ACCESS CONTROL TABLE

MIB VIEWS

ACCESS CONTROL TABLES

GET / GETNEXTInterface Table John, Paul Authentication

•••••• ••• •••

SETInterface Table JohnAuthentication

GET / GETNEXTSystems Group George None

•••••• ••• •••

Encryption

MIB VIEWALLOWED

MANAGERSREQUIRED LEVEL

OF SECURITYALLOWED

OPERATIONS

MIB VIEWS

SNMPv3 RFCs

SNMP APPLICATIONS

SNMP ENGINE

MESSAGE PROCESSINGSUBSYSTEM

DISPATCHERSECURITY

SUBSYSTEMACCESS CONTROL

SUBSYSTEM

SNMP ENTITY

RFC 2573

RFC 2571

RFC 2572 RFC 2572 USM: RFC 2574 VACM: RFC 2575

Recommended Reading and WEB Sites Subramanian, Mani. Network

Management. Addison-Wesley, 2000 Stallings, W. SNMP, SNMPv1,

SNMPv3 and RMON 1 and 2. Addison-Wesley, 1999

IETF SNMPv3 working group (Web sites)

SNMPv3 Web sites

CS 678 P. T. Chung1 Network Management Security CS 678 Network Security, Dept. of Computer Science,...

Documents