Non-IGMP-specific security or Why not to do security at the IGMP - PDF document

Jul 20, 2023 •499 likes •613 views

Non-IGMP-specific security or Why not to do security at the IGMP level Dave Thaler dthaler@microsoft.com General Internet Case Group Receiver Group key Content Group Group Key acquisition Node Provider Key Key Server Server

Non-IGMP-specific security or “Why not to do security at the IGMP level” Dave Thaler dthaler@microsoft.com
General Internet Case Group Receiver Group key Content Group Group Key acquisition Node Provider Key Key Server Server Server App App End-to-end data session Stack Stack Hop-by-hop path setup ? ISP 1 ISP 2 ISP n . . .
Reasonable Security Relationships Group Receiver Content Group Group Key Node Provider Key Key Server Server Server App App Stack Stack ISP 1 ISP 2 ISP n . . .
NOT reasonable in general Group Receiver Content Group Group Key Node Provider Key Key Server Server Server App App X Stack Stack X . . . ISP 1 ISP 2 ISP n . . .
Observations In general, there is no security relationship between receiver’s ISP/network and a content provider If the content provider and receiver are connected to the same ISP/network, there may be a security relationship Both problems are interesting If you solve #1, you also solve #2
General case needs ISP/network needs to be able to – Do accounting per client (port flat rate, per time, per amount of data, whatever) – Use ACLs (ingress filtering, whatever) Content provider needs to be able to – Control who can view content These are not multicast-specific.
A solution that matches security relationships Receiver-edge IP/Link layer: – ACLs placed on ports based on customer- provider relationship at “connect” time – Hop-by-hop messages on LANs secured with same relationship – Port ACLs may change over time based on ISP/network policy/protocol/whatever
A solution (cont.) End-to-end app layer: – Per-group security/keys done between apps and group key server(s) – Data can be encrypted in general Internet case • If it’s not, then it’s no different from LAN case where other receivers benefit from a legit one
Protecting bandwidth General case – Can just charge requesters – Same problem occurs with unicast datagrams and this is not protected today When receiver and content provider are on same network – Content authorizer (e.g. group key server) can cause port ACL to be updated
Summary Solutions need to match practical security relationships Group-specific security in IGMP is not reasonable in general Other solutions exist which appear to meet the goals In the special case, other solutions can do everything IGMP group security does Conclusion: don’t do IGMP group security

Recommend

IGMP and MLD Optimization in Wireless and Mobile Networks

IGMP and MLD Optimization in Wireless and Mobile Networks draft-liu-multimob-igmp-mld-wireless-mobile-00 1 Aims Optimize IGMP and MLD to meet wireless or mobile multicast network requirements: Adaptive to link conditions

266 views • 9 slides

Multicast Protocols IGMP IP Group Membership Protocol DVMRP DV Multicast Routing Protocol

Multicast Protocols IGMP IP Group Membership Protocol DVMRP DV Multicast Routing Protocol MOSPF Multicast OSPF PIM Protocol Independent Multicast S-38.2121 / Fall-2007 / RKa, NB Multicast2-1 Multicast in local area networks

489 views • 25 slides

Multicast Protocols IGMP - IP Group Membership Protocol DVMRP - DV Multicast Routing Protocol

Multicast Protocols IGMP - IP Group Membership Protocol DVMRP - DV Multicast Routing Protocol MOSPF - Multicast OSPF (see notes pages for some slides!) S38.122/RKantola/s00 9 - 1 IGMPv2 - Internet Group Management Protocol implements Group

474 views • 14 slides

Multicast Protocols IGMP IP Group Membership Protocol DVMRP DV Multicast Routing Protocol

Multicast Protocols IGMP IP Group Membership Protocol DVMRP DV Multicast Routing Protocol MOSPF Multicast OSPF PIM Protocol Independent Multicast S-38.121 / Fall-04 / RKa, NB Multicast2-1 Multicast in local area networks

621 views • 24 slides

Multicast Protocols IGMP IP Group Membership Protocol DVMRP DV Multicast Routing Protocol

Multicast Protocols IGMP IP Group Membership Protocol DVMRP DV Multicast Routing Protocol MOSPF Multicast OSPF PIM Protocol Independent Multicast S-38.121 / S-03 / RKa, NB Multicast2-1 Multicast in local area networks

529 views • 26 slides

Improving Security of Autonomous UAVs Fleets by Using New Specific Embedded Secure Elements A

Improving Security of Autonomous UAVs Fleets by Using New Specific Embedded Secure Elements A Position Paper Raja Naeem Akram 1 , Pierre-Franois Bonnefoi 2 , Serge Chaumette 3 , Konstantinos Markantonakis 4 and Damien Sauveron 2 1 Department of

589 views • 24 slides

IOT SECURITY ONGOING CHALLENGES Selvana Naiken Gopalla Information Security Consultant

IOT SECURITY ONGOING CHALLENGES Selvana Naiken Gopalla Information Security Consultant CERT-MU | National Computer Board OUTLINE The Internet of Insecure Things New Devices, New Security Challenges IOT Specific Security Issues

302 views • 27 slides

Locale-specific threats Security challenges due to globalization Anthony Bettini McAfee Labs

Locale-specific threats Security challenges due to globalization Anthony Bettini McAfee Labs June 9, 2010 Agenda In the dawn of time Think globally, act locally Audit fatigue Local concerns, trends, economics, and even

752 views • 37 slides

2 nd Partners Meeting Security Outline of activities/floorplans Timeline and practical

2 nd Partners Meeting Security Outline of activities/floorplans Timeline and practical information EMAS: Waste reduction Se Security, ou our resp sponsib ibil ilit ity Specific security measures Ensuring safety of visitors,

282 views • 15 slides

Specific Aims One Page The single most important page in a grant Specific Aims Specific Aims

Specific Aims One Page The single most important page in a grant Specific Aims Specific Aims should be specific The entire grant is summarized in one page The specific aims should cover: Your broad, long-term goals The

158 views • 12 slides

ECE590 Computer and Information Security Fall 2018 Database Security Tyler Bletsch Duke

ECE590 Computer and Information Security Fall 2018 Database Security Tyler Bletsch Duke University Table of data consisting of rows and columns Each column holds a particular type of data Each row contains a specific value for each

236 views • 19 slides

Computer and Information Security Fall 2019 Database Security Tyler Bletsch Duke University

ECE590 Computer and Information Security Fall 2019 Database Security Tyler Bletsch Duke University Table of data consisting of rows and columns Each column holds a particular type of data Each row contains a specific value for each

540 views • 19 slides

Part 5: Kinookimaw Specific Claim Specific Claim: Specific claims deal with the past

Part 1: Types of Land Claims Part 2: Flood Claim Part 3: 1906 Specific Claim Part 4: 1910 Railway Claim Part 5: Kinookimaw Specific Claim Specific Claim: Specific claims deal with the past grievances of First Nations.

272 views • 24 slides

Network Technology Review and Security Concerns Computer Security I CS461/ECE422 Fall 2010

Network Technology Review and Security Concerns Computer Security I CS461/ECE422 Fall 2010 Outline Overview Issues and Threats in Network Security Review basic network technology TCP/IP in particular Attacks specific to

709 views • 54 slides

Network Technology Review and Security Concerns Computer Security I CS461/ECE422 Fall 2009

Network Technology Review and Security Concerns Computer Security I CS461/ECE422 Fall 2009 Outline Overview Issues and Threats in Network Security Review basic network technology TCP/IP in particular Attacks specific to

807 views • 55 slides

Specific Learning Disabilities: The Role of Working Memory and Other Domain-specific Deficits

Specific Learning Disabilities: The Role of Working Memory and Other Domain-specific Deficits Lisa Archibald, PhD Western University, Canada Cogmed Conference 2014 Specific Learning Disabilities Appear to have typical potential to learn

562 views • 55 slides

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Network security Network security Foundations: what is security? cryptography Network Security Network Security authentication message integrity key distribution and certification Security in practice: Srinidhi Varadarajan

334 views • 6 slides

Modular charging solu lutions Specific for VW Bright Future of Electric Mobility Specific for

Modular charging solu lutions Specific for VW Bright Future of Electric Mobility Specific for VW Dark Reality of Charging Infrastructure Specific for VW 80% 80% of all EV charging processes happen over a long period of time Home Work

231 views • 20 slides

Domain-Specific Engineering of Domain-Specific Languages Rapha el Mannadiar and ,

context and problem our example DSL foundations constructing DSLs from model to artifact our example... conclusion Domain-Specific Engineering of Domain-Specific Languages Rapha el Mannadiar and , Hans Vangheluwe McGill

847 views • 50 slides

PERSONA Codeamans Outline Problem Solution Application Flow Purpose-specific

PERSONA Codeamans Outline Problem Solution Application Flow Purpose-specific Technical Aspects Scalability Accessibility Security Performance Functionality Implementation Third-Party

383 views • 16 slides

Spin Me Right Round: Rotational Symmetry for FPGA-Specific AES CHES 2018, Amsterdam Grant. Nr.

Spin Me Right Round: Rotational Symmetry for FPGA-Specific AES CHES 2018, Amsterdam Grant. Nr. 16KIS0666 SYSKIT_HW Lauren De Meyer 1 , Amir Moradi 2 , Felix Wegener 2 1 imec - COSIC, KU Leuven, Belgium 2 Horst Grtz Institute for IT-Security,

572 views • 40 slides

Security Security as term, Possible Security violations Authentication Criteria for

BS1 WS19/20 topic-based slides Security Security as term, Possible Security violations Authentication Criteria for Trust in Computer Systems Three hearts of Windows Security DACLs A Look at Security System is secure if

988 views • 20 slides

Detect Known Violations of Policy Goal: does a specific action and/or state that is known to

Detect Known Violations of Policy Goal: does a specific action and/or state that is known to violate security policy occur? Assume that action automatically violates policy Policy may be implicit, not explicit Used to look for

546 views • 27 slides

CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC 410 / 611 : Operating Systems CPSC410/611: Security Security Security Attacks Security Threats Crypto Authentication Examples SSL Security Threats Breach of confidentiality unauthorized access to

458 views • 18 slides