Using Off-Path and On-Path Signaling for Internet Security Saikat - PowerPoint PPT Presentation

Using Off-Path and On-Path Signaling for Internet Security Saikat Guha, Paul Francis Cornell University IETF 66 Off-path BoF Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Architecture ◮ Default-Off Data-Path ◮ Turned “on” after off-path negotiation ◮ Default-On Off-Path Signaling ◮ Rate-limited ◮ Mediated by intermediaries ◮ Heavily Secured ◮ On-Path Signaling ◮ Coupled Off-Path negotiation with Data-Path Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Network Elements g policy.cornell.edu policy.cs.cornell.edu Internet Cornell CS alice@cornell.edu Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Discover P-Box g policy.cornell.edu policy.cs.cornell.edu Cornell CS alice@cornell.edu Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Register Off-path policy.cornell.edu policy.cs.cornell.edu REGISTER alice@cornell.edu Cornell CS app = vncserver location = office ... alice@cornell.edu Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Request Data-Path policy.cornell.edu policy.cs.cornell.edu INVITE To: alice@cornell.edu; app=vncserver Cornell CS From: bob@acme.com; app=vncviewer alice@cornell.edu bob@acme.com Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Data-Path with Keys policy.cornell.edu policy.cs.cornell.edu OK 128.84.223.110:4111 Key-saikat: 123ABC Key-cs: 456DEF Cornell CS Key-cornell: 789012 Encryption: ssl alice@cornell.edu bob@acme.com Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Authorized Data g policy.cornell.edu policy.cs.cornell.edu DATA <xyz> Auth-saikat: (123ABC) Auth-cs: (456DEF) Cornell CS Auth-cornell: (789012) alice@cornell.edu bob@acme.com Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Network Elements g Off-path ◮ Policy ◮ Presence ◮ Messaging policy.cornell.edu policy.cs.cornell.edu Internet Cornell CS On-Path alice@cornell.edu ◮ Firewall ◮ TURN Relay ◮ Auditor Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Discover P-Box g P-Box Discovery ◮ Static policy.cornell.edu policy.cs.cornell.edu ◮ DHCP (at boot) Cornell CS ◮ Off-Path Query alice@cornell.edu ◮ On-Path Query Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Register Off-path Authenticate ◮ User, Domain ◮ Application ◮ Location policy.cornell.edu policy.cs.cornell.edu REGISTER alice@cornell.edu Cornell CS app = vncserver location = office Mechanism ... alice@cornell.edu ◮ Certificates ◮ Trusted Computing Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Request Data-Path Request policy.cornell.edu ◮ Authentication policy.cs.cornell.edu INVITE To: alice@cornell.edu; app=vncserver Cornell CS ◮ Off-Path DoS From: bob@acme.com; app=vncviewer alice@cornell.edu ◮ Off-Path MitM bob@acme.com Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Data-Path with Keys Response Token ◮ Contents ◮ IP:port policy.cornell.edu policy.cs.cornell.edu OK 128.84.223.110:4111 ◮ Firewall Key Key-saikat: 123ABC Key-cs: 456DEF CS Cornell Key-cornell: 789012 ◮ # bytes Encryption: ssl ◮ Time valid alice@cornell.edu bob@acme.com ◮ Replay Attack Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Authorized Data g On-Path Signaling policy.cornell.edu policy.cs.cornell.edu DATA <xyz> ◮ Out-of-Band (NSIS) Auth-saikat: (123ABC) Auth-cs: (456DEF) CS Cornell Auth-cornell: (789012) ◮ In-Band (framing) alice@cornell.edu bob@acme.com Guha and Francis Using Off-path and On-Path Signaling for Internet Security

Implementation ◮ P-Box: SER SIP Proxy, static policy rules ◮ P-Box Discovery: Static Configuration ◮ Registration: SIP REGISTER (with user authorization) ◮ Rendezvous: SIP INVITE (with SDP) ◮ Response: 200 OK (with SDP, local address, STUN addresses, TURN address and TURN server authorization key) ◮ Data-Path: In-band (framing inside TCP), TURN path must include authorization Callflows at: nutss.net/bof/cf.txt Guha and Francis Using Off-path and On-Path Signaling for Internet Security