Reducing the Cost of Security in Link-State Routing R. Hauser A. Przygienda G. Tsudik McKinsey Consulting Fore Systems USC-ISI Zurich, Switzerland Bet

Size: px

Start display at page:

Download "Reducing the Cost of Security in Link-State Routing R. Hauser A. Przygienda G. Tsudik McKinsey Consulting Fore Systems USC-ISI Zurich, Switzerland Bet"

Augusta Daniel
5 years ago
Views:

1 Reducing the Cost of Security in Link-State Routing R. Hauser A. Przygienda G. Tsudik McKinsey Consulting Fore Systems USC-ISI Zurich, Switzerland Bethesda, MD Marina Del Rey, CA ISOC Symposium on Network and Distributed System Security, Feb 10-11, 1996, San Diego, CA 1

2 Ford/Fulkerson's Max Flow,! Distance Vector,! How to minimize the cost of security in Link State Routing? Introduction Routing Protocols: e.g., OSPF, IDPR, ATM-PNNI Dijkstra's Shortest Path,! Link State, e.g., RIP, BGP, IDRP Focus of this work: 2

3 Link State Security Link State (LS) Security Requirements: 1. Origin Authentication 2. Non-repudiation 3. Data integrity 4. Timeliness and Ordering Building Blocks: Public key-based digital signatures (RSA, DSS, El Gamal, Schnorr, etc.) (Conjectured/alleged) one-way hash functions (MD5, 8-pass SNEFRU, SHA, etc.) Hash chain constructs (e.g., S/KEY one-time authentication, micro-payments, etc.) 3

4 H 1 (R),..., H i (R),... H n (R) Hash Chains Example: 1. Alice generates a secret R 2. Computes a hash chain of length n: where H 0 (R) =Rand H i (R) =H(H i,1 (R)) for 0 <i<n 3. Initially, Bob receives H n (R) 4. Alice releases H n,1 (R) 5. Bob checks that H(H n,1 (R)) matches H n (R). Last two steps can be repeated n, 1 times 4

5 2. Chained LSU { CLSU i Stable Link State { SLS Observation A large percentage (50%, by some estimates) of LSU-s are simply re-statements of previous LSU-s, i.e., an LSU often carries no new information other than its timing since links and nodes go up and down infrequently. LSU types: 1. Anchor LSU { ALSU generated whenever a link state change occurs or the current hash chain is depleted. Signed, sequenced, timestamped. Contains: H n (R); T 0 ; n; flinksg; SIG generated periodically or upon explicit request Unsigned, sequenced, timestamped. Contains: H n,i (R); T i ; i 5

6 SLS contd. Issues: Missing CLSU-s? Storage Requirements? Only eective in STABLE routing environments! 6

7 [nodeid; T n ; H n (R 1 ); G n (R 1 ); :::; H n (R j ); G n (R j ); :::; H n (R k ); G n (R k )] SK Fluctuating Link State { FLS Observation The state of a link is (typically) a binary value. Each node generates (n k s) hash chains n - chain length k - # of incident links s - # of possible link states (typically 2: UP and DOW N) All R j (1 j k) must be random and unique, ALSU contains: 7

8 Hash Table 1... L j... L k L down... up down... up down up 1 H 1 (R 1 ) G 1 (R 1 )... H 1 (R j ) G 1 (R j )... H 1 (R k ) G 1 (R k ) i H i (R 1 ) G i (R 1 )... H i (R j ) G i (R j )... H i (R k ) G i (R k ) n H n (R 1 ) G n (R 1 )... H n (R j ) G n (R j )... H n (R k ) G n (R k ) 8

9 8 >< >: 8 >< >: H n,i (R j ) if LF i (j) =1 G n,i (R j ) if LF i (j) =0 CLSU Construction For each link L j ; (1 j k) and for each CLSU i, (1 i< n)link state ags (LSF i ) is dened as: LSF i =[LF i (1); :::; LF i (k)] where: 1 if L j is UP LF i (j) = 0 if L j is DOWN For each link L j ; (1 j k) and for each CLSU i, (1 i< n)link state vector (LSV i ) is dened as: LSV i =[LS i (1); :::; LS i (k)] where: LS i (j) = CLSU i contains: [nodeid; i; T i ;LSF i ;LSV i ] 9

10 G i,p (LS i (j)) if LF i (j) =0 H i,p (LS i (j)) if LF i (j) =1 G i (G n,i (R j )) if LF i (j) =0 H i (H n,i (R j )) if LF i (j) =1 CLSU Processing 1. Looks up the current entry for nodeid 2. Validates T i and i: Checks that T i is valid (reasonably close to current time), i>pand T i >T p (last stored timestamp from CLSU p.) 3. For each link L j reected in CLSU i (0 <j<k): a) if L j 's state is unchanged (LF i (j) =LF p (j)), compute: and compare to LS p (j); reject upon mismatch. b) if L j 's state has changed (LF i (j) 6= LF p (j)), compute: and compare to LS n (j); reject upon mismatch. Replace LSV p with LSV i. 10

11 4. Loose clock synchronization: maximum skew =(2t) Analysis Security (both SLS and FLS): 1. Strength of the underlying signature function (wrt ALSUs) 2. Strength of the underlying hash function (wrt CLSUs) 3. Randomness of the starting values Limitations: Very frequent state oscillations Clock synchronization impossible Multiple-valued (or continuous) link state 11

12 Conclusions Related Work: [MB-96 ] S. Murphy and M. Badger, Digital Signature Protection of the OSPF Routing Protocol, 1996 Symposium on Network and Distributed Systems Security (SNDSS'96), February [P-88 ] R. Perlman, Network Layer Protocols with Byzantine Robustness, Ph.D. Dissertation, MIT LCS TR-429, October Future Work: Experimental Results (OSPF) SLS/FLS Hybrid Other Constructs? 12

Introduction to OSPF. ISP Workshops. Last updated 11 November 2013

Introduction to OSPF. ISP Workshops. Last updated 11 November 2013 Introduction to OSPF ISP Workshops Last updated 11 November 2013 1 OSPF p Open Shortest Path First p Open: n Meaning an Open Standard n Developed by IETF (OSPF Working Group) for IP RFC1247 n Current standard