1 / 11

Deny-by-Default Distributed Security Policy Enforcement in MANETs

Deny-by-Default Distributed Security Policy Enforcement in MANETs. Joint work with Mansoor AlicherryAngelos D. Keromytis Columbia University. Angelos Stavrou George Mason University. MANETs. Traditional Firewalls. Keep away malicious traffic from set of nodes Placed on the perimeter

lisandra-church
Download Presentation

Deny-by-Default Distributed Security Policy Enforcement in MANETs

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Deny-by-Default Distributed Security Policy Enforcement in MANETs Joint work with Mansoor AlicherryAngelos D. Keromytis Columbia University Angelos Stavrou George Mason University

  2. MANETs

  3. Traditional Firewalls • Keep away malicious traffic from set of nodes • Placed on the perimeter • Enforce policies of the perimeter • Nodes inside trusted; outside potential enemies • MANETs: There is not well defined perimeter

  4. Our Solution • Policy enforcement framework • Capability: Access rules and bandwidth constraints represented using capabilities • Deny-by-default: Every packet in the network need to have an associated capability • Distributed Enforcement: All the intermediate nodes enforce the capability policy • Unauthorized traffic dropped closer to the source • Protects end-host resources and network bandwidth

  5. Related Work: Network Capabilities • Capability implemented in early computer systems [Lev84] • “visas” for packets [EMT89] • Network capabilities to prevent DoS in wired networks [ARW03] • Capability assigned by receivers • Links in the path between a sender and receiver cannot be snooped

  6. Network Capabilities • Access control and bandwidth limitation represented using capability (KeyNote style) • Identity of the principal • Identity of the destination • Type of service and bandwidth • Expiration date • Issuer & Signature • Policy tokens • Issued by the administrator • Network capability • Issued by the receiving node • Contains policy authorizing it to issue

  7. Policy Token Example serial: 130745 owner: unit01.nj.army.mil (public key) destination: *.nj.army.mil service: https bandwidth: 50kbps expiration: 2010-12-31 23:59:59 issuer: captain.nj.army.mil signature: sig-rsa 23455656767543566678

  8. Network Capability Example serial: 1567 owner: unit01.nj.army.mil (public key) destination: unit02.nj.army.mil bandwidth: 150kbps expiration: 2009:10:21 13:05:35 issuer: unit02.nj.army.mil comment: Policy allowing the receiver to issue this capability. signature: sig-rsa 238769789789898

  9. Protocol • Capability associated with each communication session • Transaction identifier and signature • Capability Establishment • Source node informs the intermediate nodes about transaction identifier, capability and key for signature • Smaller keys used for per packet signature| • Sender • Adds transaction id, sequence number and signature to the packet • Intermediate nodes and Receiver • Verifies the packet (probabilistically) for signature and bandwidth

  10. System Architecture

  11. Conclusions and Future Work • Architecture for enforcing security policies • Extending the use of capabilities for MANETs • Deny-by-default much stronger than regular Internet • Protects end-host-resources and network resources • Future work • Explore the cost of protection in Delay Tolerant Networks • Trade-offs between full policy Enforcement vs probabilistic schemes • Generation of “enclaves” with different policies

More Related