KRB-CCN: Lightweight Authentication & Access Control for Private Content-Centric Networks Ivan O. Nunes and Gene Tsudik University of California Irvine {ivanoliv, gene.tsudik}@uci.edu ACNS 2018 1
Agenda • CCN Overview – Authentication and AC in CCN • Kerberos • KRB-CCN – Design – Security – Implementation & Evaluation • Final Remarks ACNS 2018 2
CCN Overview ACNS 2018 3
Content-Centric Networking: • Named data, instead of host addresses: – /edu/uci/ics/ivan/krbccn-paper.pdf • Decouples Content from its location • Optional in-network caching: potentially better network utilization, lower latency... ACNS 2018 4
Content-Centric Networking: • Network entities: – Producers: generate and publish contents under unique names ( owns a prefix ) – Consumers: issue “interests” for contents containing such contents names – Routers: forward interests and contents • May cache content ACNS 2018 5
Content-Centric Networking: ACNS 2018 6
Content-Centric Networking: ACNS 2018 7
Content-Centric Networking: ACNS 2018 8
Content-Centric Networking: ACNS 2018 9
Content-Centric Networking: ACNS 2018 10
Content-Centric Networking: ACNS 2018 11
Content-Centric Networking: ACNS 2018 12
Content-Centric Networking: Overview Routing: – Pending Interest Table (PIT) : • Table of pending interests and corresponding incoming interfaces • Used to route the content back to the requesting consumer ACNS 2018 13
Content-Centric Networking: Overview Routing: – Pending Interest Table (PIT) : • Table of pending interests and corresponding incoming interfaces • Used to route the content back to the requesting consumer – Forwarding Interest Base (FIB) : • Table of name prefixes and corresponding outgoing interfaces • Used to route interests towards content producers (Longest Prefix Match of names) ACNS 2018 14
CCN Security • The architecture demands that content is signed by its producer ACNS 2018 15
CCN Security • The architecture demands that content is signed by its producer • Some IP-equivalent services have been proposed: – Anonymity networks, VPNs, TLS-like key exchange... ACNS 2018 16
CCN Security • The architecture demands that content is signed by its producer • Some IP-equivalent services have been proposed: – Anonymity networks, VPNs, TLS-like key exchange... • Currently 2 flavors of AC: – CBAC: inability to decrypt unauthorized content – IBAC: inability to request (generate interests for) unauthorized content • must be used jointly with CBAC ACNS 2018 17
CCN Security • Issues with current approaches for AC: – Producer Overhead: Producers are responsible for handling consumer authentication and content AC on their own ACNS 2018 18
CCN Security • Issues with current approaches for AC: – Producer Overhead: Producers are responsible for handling consumer authentication and content AC on their own – Consumer Privacy: AC enforced by producers implies sacrificing consumer privacy ACNS 2018 19
CCN Security • Issues with current approaches for AC: – Producer Overhead: Producers are responsible for handling consumer authentication and content AC on their own – Consumer Privacy: AC enforced by producers implies sacrificing consumer privacy – Policy Changes: It is difficult to react to policy changes, e.g., access revocation for a given consumer ACNS 2018 20
CCN Security • Issues with current approaches for AC: – Producer Overhead: Producers are responsible for handling consumer authentication and content AC on their own – Consumer Privacy: AC enforced by producers implies sacrificing consumer privacy – Policy Changes: It is difficult to react to policy changes, e.g., access revocation for a given consumer – Confidentiality: If consumer is authenticated by other means, e.g., passwords and biometrics, each producer would have to store and manage potentially sensitive state information ACNS 2018 21
CCN Security • Issues with current approaches for AC: – Producer Overhead: Producers are responsible for handling consumer authentication and content AC on their own – Consumer Privacy: AC enforced by producers implies sacrificing consumer privacy – Policy Changes: It is difficult to react to policy changes, e.g., access revocation for a given consumer – Confidentiality: If consumer is authenticated by other means, e.g., passwords and biometrics, each producer would have to store and manage potentially sensitive state information • What else can we do? ACNS 2018 22
Kerberos ACNS 2018 23
Kerberos Overview • Since mid-1980s, Kerberos has been successfully and widely used for authentication and AC in IP-based private networks • Separate entities for authentication, AC, and services • Solves aforementioned issues of other approaches for authentication and AC in CCNs. • Suited for private networks (within autonomous system) ACNS 2018 24
Kerberos Overview • Authentication and AC service for private networks and autonomous systems ACNS 2018 25
Kerberos Overview • Authentication and AC service for private networks and autonomous systems • 3 rounds: ACNS 2018 26
Kerberos Overview • Authentication and AC service for private networks and autonomous systems • 3 rounds: 1 - Authentication Request: Generates a TGT (Ticket-Granting Ticket) that serves as a “proof” of authentication ACNS 2018 27
Kerberos Overview • Authentication and AC service for private networks and autonomous systems • 3 rounds: 1 - Authentication Request: Generates a TGT (Ticket-Granting Ticket) that serves as a “proof” of authentication 2 - Authorization Request: Generates an ST (“Service Ticket”) that serves as a “proof” of authorization ACNS 2018 28
Kerberos Overview • Authentication and AC service for private networks and autonomous systems • 3 rounds: 1 - Authentication Request: Generates a TGT (Ticket-Granting Ticket) that serves as a “proof” of authentication 2 - Authorization Request: Generates an ST (“Service Ticket”) that serves as a “proof” of authorization 3 - Service Request: Execution/Access to the actual service/data (authenticated both ways). ACNS 2018 29
KRB-CCN ACNS 2018 30
KRB-CCN: Big Picture ACNS 2018 31
Design • Parties: – TGT Producer (TGT-Prod) : • Verifies Identity Produces a TGT ACNS 2018 32
Design • Authentication (Between Consumer and TGT-Prod ) ACNS 2018 33
Design • Authentication (Between Consumer and TGT-Prod ) ACNS 2018 34
Design • Authentication (Between Consumer and TGT-Prod ) ACNS 2018 35
Design • Authentication (Between Consumer and TGT-Prod ) Encrypted using a Same key key shared between as in the TGT-Prod and token CGT-Prod ACNS 2018 36
Design • Authentication (Between Consumer and TGT-Prod ) Encrypted using a Same key key shared between as in the TGT-Prod and token Someone else can CGT-Prod not decrypt the token ACNS 2018 37
Design • Parties: – TGT Producer (TGT-Prod) : • Verifies Identity Produces a TGT – CGT Producer (CGT-Prod) : • Verifies TGT and AC Policy Produces a CGT ACNS 2018 38
Design • Authorization (Between Consumer and CGT-Prod ) Content’s name prefix, e.g.: edu/uci/ivan/* ACNS 2018 39
Design • Authorization (Between Consumer and CGT-Prod ) Content’s name prefix, e.g.: edu/uci/ivan/* ACNS 2018 40
Design • Authorization (Between Consumer and CGT-Prod ) Content’s name prefix, e.g.: edu/uci/ivan/* Kp shared between CGT-Prod and Content Producer ACNS 2018 41
Design • Authorization (Between Consumer and CGT-Prod ) Content’s name prefix, e.g.: edu/uci/ivan/* Kp shared between CGT-Prod and Content Producer From authentication phase: only UID has this key ACNS 2018 42
Design • Authorization (Between Consumer and CGT-Prod ) Content’s name prefix, e.g.: edu/uci/ivan/* Kp shared between CGT-Prod and Content Producer From authentication phase: only UID has this key Someone else can ACNS 2018 43 not decrypt the token
Design • Parties: – TGT Producer (TGT-Prod) : • Verifies Identity Produces a TGT – CGT Producer (CGT-Prod) : • Verifies TGT and AC Policy Produces a CGT – Content Producer : • Verifies CGT Produces Content/Service ACNS 2018 44
Design • Content requests (Between Consumer and Producer ) ACNS 2018 45
Design • Content requests (Between Consumer and Producer ) No UID, only CGT! ACNS 2018 46
Design • Content requests (Between Consumer and Producer ) No UID, only CGT! ACNS 2018 47
Design • Content requests (Between Consumer and Producer ) No UID, only CGT! From authorization phase: only UID has this key ACNS 2018 48
Design • Content requests (Between Consumer and Producer ) No UID, only CGT! From authorization phase: only UID has this key Someone else can not access content D! ACNS 2018 49
Design • Content requests (Between Consumer and Producer ) Mutual Authentication Support ACNS 2018 50
Recommend
More recommend
