1 Pfleeger Visit 4/13/2004 UCCS Network/System Security C. Edward Chow Xiaobo Joe Zhou Yu Cai Ganesh Godavari Department of Computer Science University of Colorado at Colorado Springs UCCS Network/System Security Research Some of the research projects are sponsored by the Air Force Research Laboratory, under agreement number F49620-03-1-0207. It was sponsored by NISSC Summer/Fall2003 grants. Part of these results are supported by a generous gift from Fujitsu for Internet research.
UCCS Network/System Research LabUCCS Network/System Research Lab Director: Dr. C. Edward Chow (Network/Protocol) Assistant Professor: Dr. Xiaobo Zhou (Distributed Systems; QoS) Graduate students:
John Bicknell/Steve McCaughey/Anders Hansmat: Distributed Network Restoration/Network Survivability
Hekki Julkunen: Dynamic Packet Filter Chandra Prakash: High Available Linux kernel-based Content Switch Ganesh Godavari: Linux based Secure Web Switch Angela Cearns: Autonomous Anti-DDoS (A2D2) Testbed Longhua Li: IXP-based Content Switch David Wikinson: Secure DNS (update/query) with multiple indirect routing entries Nirmala Bulusu: Secure Wireless Access; PEAP vs. TTLS; enhance freeRadius server
with PEAP module (the above graduated) Yu Cai (Ph.D. research assistant): Proxy Server Based Multipath Routing; Secure
Collective Internet Defense; Information Fusion; Ganesh Godavari: (Ph.D. research assistant): Content Switching Rule Conflict Detection;
Secure Groupware; First Responder Sensor Network; Secure Information Sharing Frank Watson: enhanced TCP with multiple routes (User Mode Linux) Paul Fong: Wireless AODV Routing for sensor networks Murthy Andukuri/Jing Wu: iSCSI/VPN/MPLS Secure QoS Storage Network. Patricia Ferrao/Merlin Vincent: Web-based Collaborative System Sarah Jelinek: Enterprise Intrusion Detection and Response System (A2D2V2).
Performance of SCOLD v0.1Performance of SCOLD v0.1
Table 1: Ping Response Time (on 3 hop route)
Table 2: SCOLD FTP/HTTP download Test (from client to target)
Table 1: Ping Response Time (on 3 hop route)
Table 2: SCOLD FTP/HTTP download Test (from client to target)
No DDoS attack, direct route
DDoS attack, direct route
No DDoS attack, indirect route
with DDoS attack indirect route Doc
Size
FTP HTTP FTP HTTP FTP HTTP FTP HTTP 100k 0.11 s 3.8 s 8.6 s 9.1 s 0.14 s 4.6 s 0.14 s 4.6 s 250k 0.28 s 11.3 s 19.5 s 13.3 s 0.31 s 11.6 s 0.31 s 11.6 s 500k 0.65 s 30.8 s 39 s 59 s 0.66 s 31.1 s 0.67 s 31.1 s 1000k 1.16 s 62.5 s 86 s 106 s 1.15 s 59 s 1.15 s 59 s 2000k 2.34 s 121 s 167 s 232 s 2.34 s 122 s 2.34 s 123 s
Secure Collective DefenseSecure Collective Defense Main IdeaExplore secure alternate paths for clients to come in; Utilize geographically
separated proxy servers. Goal:
Provide secure alternate routes Hide IP addresses of alternate gateways
Techniques: Multiple Path (Indirect) Routing Enhanced Secure DNS extension: how to inform client DNS servers to add new DNS
entries with alternate routes (Not your normal DNS name/IP address mapping entry). Utilize a consortium of Proxy servers with IDS that hides the IP address of alternate
gateways. Partition clients to come in at different proxy servers.
can help identify the origin of spoofed attacks! How clients use the new multiple path indirect DNS entries and route traffic through
proxy servers? Use Sock protocol, modify resolver library
Current SCOLD Project ResultsCurrent SCOLD Project Results
Proposed new DNS entries for intrusion tolerance, containing multiple proxy servers info for establishing indirect routes.
Modified Bind9 DNS server to accept secure DNS updates and to serve queries with new indirect DNS entries.
Developed new secure DNS update utility to securely update target zone file in the new enhanced Bind9 DNS server.
Implemented new secure indirect routing protocol to allow client DNS to query target DNS during DDoS attack. to allow client to communicate with target server through proxy
server and alternate gateway.
Proposed new DNS entries for intrusion tolerance, containing multiple proxy servers info for establishing indirect routes.
Modified Bind9 DNS server to accept secure DNS updates and to serve queries with new indirect DNS entries.
Developed new secure DNS update utility to securely update target zone file in the new enhanced Bind9 DNS server.
Implemented new secure indirect routing protocol to allow client DNS to query target DNS during DDoS attack. to allow client to communicate with target server through proxy
Benefits of Secure Collective DefenseBenefits of Secure Collective Defense
Security When attacked, users switch to different routes dynamically Urgent/critical packets sent over multiple routes simultaneously Encrypted content sent over multiple routes Information on DDoS attacks used to isolate source of attacks
Reliability: Users can choose most reliable route dynamically Packet content spread over multiple routes Use redundant transmission or error correction to reduce PLR
Performance: Multiple indirect routes provide additional bandwidth Can be used for dynamic bandwidth provisioning
Security When attacked, users switch to different routes dynamically Urgent/critical packets sent over multiple routes simultaneously Encrypted content sent over multiple routes Information on DDoS attacks used to isolate source of attacks
Reliability: Users can choose most reliable route dynamically Packet content spread over multiple routes Use redundant transmission or error correction to reduce PLR
Performance: Multiple indirect routes provide additional bandwidth Can be used for dynamic bandwidth provisioning
Main Idea design a framework for enhancing security of groupware packages such as instant messenger and video monitoring/conferencing tool.
Goal: Investigate proper interface between group rekeying system and
groupware. Develop secure instant messaging system with remote group file download
and remote display. Experiment the prototype software on PDA with mobile ad hoc network. Integrate with stress level and tool usage effectiveness evaluation
This is a joint project with Dr. Chip Benight of psychology department at UCCS.
Techniques:
Scalable group key management (Keystone from UT Austin)
ConclusionConclusion A secure group communication software package SGFR v.0 was
developed. Use Digital Certificate to authenticate client access. Group keys are distributed when members join/leave or based
on some time period. Group key is used to encrypted the messages. Enhanced Jabber-based text chat with remote file download
and remote display. Lesson1: Fire fighters do not like stylus input and they carry
heavy load!! Lesson2: Fire fighter don’t care security; Police do!!
Ported the SGFR v.0 to run on handheld devices include iPAQ PDA running Linux and Sony PalmTop with 802.11b mobile ad hoc network.
A secure group communication software package SGFR v.0 was developed. Use Digital Certificate to authenticate client access. Group keys are distributed when members join/leave or based
on some time period. Group key is used to encrypted the messages. Enhanced Jabber-based text chat with remote file download
and remote display. Lesson1: Fire fighters do not like stylus input and they carry
heavy load!! Lesson2: Fire fighter don’t care security; Police do!!
Ported the SGFR v.0 to run on handheld devices include iPAQ PDA running Linux and Sony PalmTop with 802.11b mobile ad hoc network.
Developed a Radius Server on Linux that supports both PEAP and TTLS.
PEAP is relatively more influenced by Client’s processor speeds, distance range and network transient nature as compared to TTLS.
Although the higher performance shown by TTLS over PEAP is negligible, it is worth noting that TTLS was outperforming PEAP on an average by 10% in all the tests.
The enhanced Radius Server can serve both Windows and Linux clients.
Developed a Radius Server on Linux that supports both PEAP and TTLS.
PEAP is relatively more influenced by Client’s processor speeds, distance range and network transient nature as compared to TTLS.
Although the higher performance shown by TTLS over PEAP is negligible, it is worth noting that TTLS was outperforming PEAP on an average by 10% in all the tests.
The enhanced Radius Server can serve both Windows and Linux clients.
Building is surveyed and deployed with wireless sensors and include floor plan info in the gateway device.
When there is fire, first responders can tap into the secure wireless sensor network to find the condition of the building and over with the floor plan picture.
Building is surveyed and deployed with wireless sensors and include floor plan info in the gateway device.
When there is fire, first responders can tap into the secure wireless sensor network to find the condition of the building and over with the floor plan picture.
Data Sharing Operations Access control mechanism for sharing information Mandatory, Discretionary, and Role Based Access Control
Mechanisms Specific test cases: File Distribution, Directory Access
Control, secure instant messaging for group communications
Attribute Certificate profile for Authorization Provide non repudiation and Role Based Access Control Easy to Manage than certificates -- Short life span than
certificates Provide resource access for short duration; tighter control,
misuse avoidance, and increased responsibility Comment? Other important research topics/directions?
Data Sharing Operations Access control mechanism for sharing information Mandatory, Discretionary, and Role Based Access Control
Mechanisms Specific test cases: File Distribution, Directory Access
Control, secure instant messaging for group communications
Attribute Certificate profile for Authorization Provide non repudiation and Role Based Access Control Easy to Manage than certificates -- Short life span than
certificates Provide resource access for short duration; tighter control,
misuse avoidance, and increased responsibility Comment? Other important research topics/directions?
