Download
1 / 20
200 likes | 303 Vues
NetCamo. Camouflaging network traffic at right time and right place. Y. Guan, X. Fu, R. Bettati and W. Zhao Department of Computer Science Texas A&M University http://www.cs.tamu.edu/research/realtime June 6, 2000.
E N D
NetCamo Camouflaging network traffic at right time and right place Y. Guan, X. Fu, R. Bettati and W. Zhao Department of Computer Science Texas A&M University http://www.cs.tamu.edu/research/realtime June 6, 2000 Title: Efficient Traffic Camouflaging in Mission Critical QoS guaranteed Networks
It is often thought that communication may be secured by encrypting the traffic, but this has rarely been adequate in practice. Encryption makes crypto-analysis very difficult, if not impossible. E.g., IPsec makes content of the traffic inaccessible. 85% of the IP traffic will be encrypted in the near future. (VPN, SSL, etc.) An encrypted email message between a customer service center and its ordinary user is not under suspicion, however, the one between an employee of a defense contractor and the embassy of a hostile power has obvious implication. The changes of traffic pattern between the military command center and some military units under different alertness states often indicate some meaningful information to the observers. Traffic analysis can still be used to trace the user’s on-line/off-line periods, uncover the location of military command center, determine operation mode or alertness state of military units, and analyze the intentions of communications. Motivations
Applications Flight Control System Supervisory Command and Control of defense system Hiper-D system (NSWC) ... Security Quality of Service Mission Critical Environment
Keep network traffic pattern unobservable Provide QoS-guaranteed communication services Be upward and downward compatible with existing operating systems, applications, and network technologies Be scalable and evolutionary Objectives
Basic Model • Features of IP-based network • Header of the packet are readable by an observer. • The underlying routing subsystem determines unique path between any pairs of hosts. Basic theorem: If the traffic entering into and exiting from each host is stable, all the traffic in the system are stable.
Stable Traffic Pattern Matrix Example The Existing traffic pattern among the hosts are: Host1 Host2 Host3 Host4 Host 1 0 0 3MB/sec 3MB/sec Host 2 3MB/sec 0 3MB/sec 3MB/sec Host 3 2MB/sec 0MB/sec 0 2MB/sec Host 4 3MB/sec 3MB/sec 3MB/sec 0 Existing Traffic Pattern Matrix The stable traffic pattern among the hosts are: Host1 Host2 Host3 Host4 Host 1 0 3MB/sec 3MB/sec 3MB/sec Host 2 3MB/sec 0 3MB/sec 3MB/sec Host 3 3MB/sec 3MB/sec 0 3MB/sec Host 4 3MB/sec 3MB/sec 3MB/sec 0
? ? ? Traffic Padding Flooding the network at right place and right time to make it appear to be constant rate network Challenge: How much? For link j, Si Fi,j( I ) + Sj( I ) = C(I)
H1 H4 1MB/sec 1MB/sec 1MB/sec 1MB/sec H2 H3 3MB/sec Traffic Rerouting Indirect delivery of packets Challenge: How to reroute the traffic? Real Traffic: 5MB/sec from H3 to H2
QoS guarantee Traffic Padding and Rerouting Challenge: Can we still guarantee real-time delay bound? For for connection j, Si di,,j, < Dj
Approaches • Traffic camouflaging: host-based rerouting and traffic padding based on real-time traffic modeling theory. • Real-time communication: providing end-to-end delay guaranteed services to applications while having traffic camouflaged • A middle-ware solution: achieving effectiveness, compatibility, and scalability
Traffic Planning: Correctness Constraints • Stabilization Constraints • Link Capacity Constraints
Traffic Planning: Correctness Constraints (cont.) • Conservation Constraints • Delay Constraints
Scalability Hierarchical Model: Intra-domain and Inter-domain Easy deployment Appliance-based method Extensions Domain 1 Domain 2 Domain 3
NetCamo System Architecture Host Host NetCamo Network Controller API API H323 NetCamo Traffic Manager H323 Client Applications Client Applications Router Agent Router Agent NetCamo Host Controller Host Agent Host Agent NetCamo Host Controller Host Manager Host Manager Network Traffic Controller Traffic Controller Router Router
NetCamo Traffic Controller
April 2000: Pre-release version * Support both CBR and VBR traffic * Support a fixed cover mode * Support a fixed sensor period for traffic padding * Support real-time monitoring August 2000: b version: * Support multiple cover modes * Support an adaptive sensor period for traffic padding * Support a semi-automatic traffic modeling tool * Provide installation and maintenance services August 2000: Integration with HiPer-D system (NSWC) Status
Camouflage network elements and activity (wired and wireless) Host, router and switch Location Liveliness Movement traces Connectivity Connection VPN tunnel Topology Traffic pattern QoS guaranteed Deterministic QoS service Statistical QoS service Network Camouflaging & QoS-guaranteed Service
Camouflaging, Concealment, and Decoy in Cyber Space Means Packet Conn. Traffic Router Topology Op Mode Hide Blend EncryptionFlooding Disguising ? Neutral mode Disrupting Re-routing ? Decoy Multiple cover modes
Current NetCamo system is the first step! We achieve our goal in a controlled way that traffic analysis prevention and QoS guaranteed service are obtained at the same time. We are working in this new research field, whose essence lies in hiding and camouflaging the information about the network in order to make it anonymous and unobservable. A new field! Much work to be done! Summary
