Secure in-packet bloom filter based forwarding tle pt node on a - PowerPoint PPT Presentation

Secure in-packet bloom filter based forwarding tle pt node on a netfpga 1st EUROPEAN NETFPGA DEVELOPERS WORKSHOP tle SEP 9-10 TH , 2010 pt UNIVERSITY OF CAMBRIDGE, UK Adnan Ghani and Pekka Nikander

Presentation outline › Background – In-packet Bloom filter (iBF) based forwarding – Link IDs and Bloom Filters – Forwarding decision – Using Link Identity Tags (LITs) – False positives and forwarding efficiency – Algorithmic view › Computational iBFs – Split key management – Flow diagrams – Implementation details – Latency measurements

iBF-based forwarding › Give names to links, not to nodes › Form a source-route using the links names › Encode the set, as a Bloom filter, into the packet header › Main drawback: false positives due to using Bloom filters › Details on next slides: – Link-identity-based source routing – Forwarding decisions – Optimising with multiple link identifiers – Simulation results – Enhancing with computational link identifiers – Virtual trees

Link IDs and Bloom filters › No names for nodes – Each link identified with B ➜ C A ➜ B a unidirectional Link ID B C › Link IDs (Bloom masks) – Statistically unique A – Periodically changing – Size e.g. 256 bits D – Local or centrally controlled › Source routing – Encode Link IDs into A ➜ B 0 1 0 0 0 1 0 0 1 B ➜ C 1 0 0 0 0 1 1 0 0 a Bloom filter (zFilter) zF: A ➜ B ➜ C 1 1 0 0 0 1 1 0 1 – Naturally multicast › “Stateless”

Forwarding Decision › Forwarding decision based on binary AND and CMP – zFilter in the packet matched with all outgoing Link IDs – Multicasting: zFilter contains more than one outgoing links Link ID & = Yes/No zFilter zFilter

Using Link Identity Tags (LIT) › Better forwarding efficiency with a simple trick – Define d different LITs instead of a single LID – LIT has the same size as LID, and also k bits set to 1 – [Power of choices] › Route creation and packet forwarding – Calculate d different candidate zFilters – Select the best performing zFilter, based on some policy Host 1: Iface out Host 2: Iface out Candidate zFilter Link ID Link ID zFilter 1 LIT 1 LIT 1 zFilter 2 LIT 2 LIT 2 zFilter d LIT d LIT d

Using Link Identity Tags (LIT) LIT1 & = LIT2 & = n? LITd & = Yes/No n BF n BF

Forwarding efficiency Wrongly sent packets › Simulations with – Rocketfuel – SNDlib › Forwarding efficiency › 20 receivers – Basic LID: 80% – Optimised: 88% › with 8 LITs # receivers

Algorithmic view › Forwarding based on following algorithm Input: LITs of the outgoing links; zFilter in the packet header foreach LIT of outgoing interface do if (zFilter & LIT) = LIT then Forward packet on the link end end › Security problem: An attacker may try to determine bits set to one in forwarding identifier. › Solution: Computational Bloom masks

Secure case: Computational iBFs › Form LITs algorithmically K(t) – at packet handling time › Secure periodic key K IN port # › Input port index OUT port # Z › Output port index Flow ID › Flow ID from the packet, LIT(d) e.g. – Information ID = & – IP addresses & ports yes/no › n from the packet n BF

ComputaTional iBFs › O = Z(K, M, I) › K = semi static secret key – varies every few minutes or hours or days › M = medium dynamic data – e.g. captures a session, link indices, etc › I = dynamic, i.e. varies per packet › The key is split into three parts: K 1 = KDF(K, ”1”); K 2 = KDF(K, ”2”); K 3 = KDF(K, ”3”); › O 1 = F 1 (K 1 , <other semi static inputs>) › O 2 = F 2 (K 2 , O 1 || M) › O = O 3 = F 3 (K 3 , O 2 || I)

Sender operations (as info) Sender has data to send Find route between sender and destination and represent it by a set of in/out pairs For each O 2 value in the O 2 -set 1. Generate a nonce 2. Compute O = F 3 (K 3 , O 2 XOR nonce) 3. Convert O into a Boom mask Get pairs <O 1 , K 2 > and K 3 for the 4. Add the Bloom mask into the iBF forwarding elements on the path For each link, compute Insert the iBF and the nonce into packet O 2 = (K 2 , O 1 || link) Send Packet

Forwarding node operation Receive set of O 2 -values and K 3 for the session Receive a packet For each value in the O 2 -set O = F 3 (K 3 ,O 2 XOR once) (Parallel for all outgoing links) NO Is the O present in the iBF in the packet? YES Forward packet on that link

Reference Datapath and modified datapaths user_data_path user_data_path input_arbiter input_arbiter output_port_lookup output_port_selector parsers and LUTs output_queues output_queues

Output_port_selector module structure Register Register Access Interface logic Mostique or AES Header Counter do_zFiltering Header Ctrl bus State parser bit_counter Combine out_ports results New TTL ethertype Data bus TTL

itle Latency measurement results pt ws l 1 pt Path and packet format Average Latency Standard Deviation 2-5 pt Wire (New) 12,784 ns 4,448.96 ns NetFPGA with Moustique 15,272 ns 4991.28 ns (New) NetFPGA with AES 15,057 ns 3,756.86 ns (New) Wire (old) 12,549 ns 4,867.34 ns NetFPGA with LIPSIN 14,627 ns 4,204.58 ns (old) s or Ericsson Internal | 2010-09-07 | Page rea