access control in atm networks
DESCRIPTION
IBM Zurich, March 1 st. Access Control in ATM Networks. Olivier Paul. ENST Bretagne RSM Department. Agenda. Introduction Access Control Parameters Access Control Architectures Access Control management Conclusion. Firewall. Network. Source and destination addresses. - PowerPoint PPT PresentationTRANSCRIPT
ENST Bretagne
Access Control in ATM Networks
Olivier Paul
IBM Zurich, March 1st
ENST Bretagne
RSM Department
IBM Zurich ENST
Bretagne2
Agenda
• Introduction
• Access Control
Parameters
• Access Control
Architectures
• Access Control
management
• Conclusion
IBM Zurich ENST
Bretagne3
Introduction• Access Control:
– Security service providing a protection against an unauthorised used by an entity or group of entities (ISO).
Network
Client Server
Firewall
access-list 101 permit tcp any gt 1023 192.165.203.5 0.0.0.0 eq 80
• Source and destination addresses
• Protocol
• Application or Service identifiers
• Action
IBM Zurich ENST
Bretagne4
Introduction
• ATM (Asynchronous Transfer Mode) :
– Specified to transport various kind of flows.
– Allows applications to request Quality of Service.
– High Speed (Mb/s -> Gb/s).
– Connection oriented.
– Data transported through small packets (cells).
– Usage:
• Directly: Some native ATM applications (ANS, VoD).• Indirectly: IP over ATM (IPOA, LANE, MPOA, MPLS): most
common use.
IBM Zurich ENST
Bretagne5
Introduction
ReassemblyOperations
FragmentationClassificationBuffer
Firewall
Bus/
Switch
• The impact on the QoS depends on the buffer characteristics.
• Classification and copy(bus) operations are generally considered as the bottleneck in the firewall architecture.
IBM Zurich ENST
Bretagne6
The flow classification problem
Classifier
ProtoSourceports
DestAddress
SourceSource
AddressAddressFlags
Destports
If Cond1 and Cond2 and Cond3 then action1If Cond4 and Cond5 then action2If Cond6 then action1
n rules carrying on d fields
Theoretical bounds :Theoretical bounds :
• Temporal Comp. : O(log n),
Spatial Comp. : O(n d).
• Temporal Comp.: O(n),
Spatial Comp.: O(log d-1 n).
d fieldsd fields
Lakshman & al. [ACM SIGCOMM ‘ 98]
IBM Zurich ENST
Bretagne7
Introduction
• In the case of ATM networks:
Throughput Quality of Service Access Control Parameters
Reassemble FragmentationClassificationBuffer
Firewall
Bus/
Switch
• The impact on the QoS depends on the buffer characteristics.
• Classification and copy(bus) operations are generally considered as the bottleneck in the firewall architecture.
IBM Zurich ENST
Bretagne8
Agenda
• Introduction
• Access Control
Parameters
• Access Control
Architectures
• Access Control
Management
• Conclusion
IBM Zurich ENST
Bretagne9
Access Control parameters
ATM parameters
TCP/IP parameters
Already Well KnownAddresses
Information generated by the ATM model
ExistingParamet
ers
New attacks
Analogies with parameters used in existing protocols
New ATM Access Control Parameters
Access Control Parameters Classification
Analysis of ATM applications &
services
Application Access Control profiles
IBM Zurich ENST
Bretagne10
Access Control parameters
Information generated by the signalling protocol
Service descriptors
Quality of Service Descriptors
New addressing information
Other parameters
Information generated by ATM cell headers
Connection identifiers Type of flow
ATM parameters
TCP/IP parameters
Already Well KnownAddresses
ExistingParamet
ers
IBM Zurich ENST
Bretagne11
Agenda
• Introduction
• Access Control Parameters
• Access Control Architectures
• Access Control Management
• Conclusion
IBM Zurich ENST
Bretagne12
Access Control Architectures
Two main problems to solve:
Classification process efficiency
QoS insurance
Agents based access control architecture
Centralised Access Control Architecture
Distributed access control process
Non blocking Access Control
ProcessFast packet
classification Algorithm
Classification Algorithm with
bounded complexities
Goal: Provide an Access Control service– For ATM native applications
By using our new access control parameters– For IP over ATM applicationsBy using well known TCP/IP access Control Parameters
IBM Zurich ENST
Bretagne13
Agents based access control architectureImproving access control performance
ControllerInternal Network External NetworkPolicy
Controller
Controller
Policy
Policy
Concurrent access control processes
Schuba [Ph. D. Thesis, Purdue University, 97]
IBM Zurich ENST
Bretagne14
Agents based access control architectureImproving access control performance
Controller
Internal Network 1
External Network
Controller
Controller
Internal Network 2
Internal Network 3
Policy 1
Policy 2
Policy 3
Controllers specialisation through policy segmentation
IBM Zurich ENST
Bretagne15
Agent based access control architectureAre performance improvements sufficient to solve the QoS problem ?
• If we can prove that – The classification process is always fast enough.– The delay introduced by the classification process is small and bounded.
• Then: Yes.• Do existing access control devices comply with these conditions ?
Respect of the QoS has to be insured through other means
Basic Idea: Using a non blocking access control process
The Access Control decision is taken independently from the flows transported over the network.
Sometimes
No
IBM Zurich ENST
Bretagne16
If we don ’t block the flows, where can we find the useful access control information ?
> In the network devices protocol stacks . • Network devices keep information about ongoing
communications in their protocol stack.
ATMEnd
System 1
ATMSwitch
ATMEnd
System 2
External network
Line 1
Line 3
• This information can be accessed though external programs.
E. P.
E. P.E. P.
Line 2
ATMSwitch
• Most of the useful access control information can be found there.
Agent based access control architecture
IBM Zurich ENST
Bretagne17
• The basic idea is to extend such a program (later referred to as agent) with access control capabilities.
ATMEnd
System 1
ATMSwitch
ATMEnd
System 2
External network
Line 1
Line 3
Agent
Agent
Agent
• It then compares this information with a description of allowed communications.
• Periodically the agent polls the information located in the protocol stacks.
• If the communication is not allowed then the agent interacts with the protocol stack to stop the communication.
ATMSwitch
Line 2
Agent based access control architecture
IBM Zurich ENST
Bretagne18
Conclusions
• New architecture
– Distributed.
– Asynchronous.
• Traditional Classification algorithm
Agent Based Architecture
• Performance improvement is difficult to evaluate.
• Security is not guaranteed.
• How to manage access control agents.
IBM Zurich ENST
Bretagne19
Agenda
• Introduction
• Access Control Parameters
• Access Control Architectures
– Agents based Access Control Architecture
– Centralised Access Control Architecture.
• Access Control Management
• Conclusion
IBM Zurich ENST
Bretagne20
Classification Algorithms
Existing Determinist Classification Algorithms
• Algorithms for Static Policies
– Fast.
– Take advantage of access control policies redundancies.
– Unbounded temporal & spatial complexities.
– Generation & Update of the classification structure are slow.
• Algorithms for Dynamic Policies
– Comparatively slow.
– Bounded temporal & spatial complexities.
– Bounded complexities for Generation & update of the classification structure.
– Implementable.
IBM Zurich ENST
Bretagne21
Classification Algorithm
• New flow classification algorithm:
– Temporal Complexity : O(d).
– Spatial Complexity. : O((2n+1)d).
– d : number of fields to analyse, n number of rules in the classification policy.
Independent from the number of rules
Unusable when d = 4 and n = 50
However !
• In practice we succeed to implement large policies by taking advantage of:
– The redundancy in the classification structure.
IBM Zurich ENST
Bretagne22
Implementation
• IFT Traffic Analysis Cards (Designed by France Telecom R&D)
• Characteristics:
– Mono-directional.
– Physical connector: OC12 (622 Mb/s).
– Unspecified Classification algorithm.
– Action (1st Cell from an AAL5 frame, classification policy) : AAL5 switching.
Classification
Buffer
IFT
Physical Connector
PhysicalConnector
Switchingoperations
Policy
IBM Zurich ENST
Bretagne23
Content of the first ATM cell
IP Header TCP/UDP/ICMP
TCP/UDP/ICMP
IP Header TCP/UDP/ICMPSNAP/LLC
IP Header TCP/UDP/ICMPSNAP/LLC AAL5
IP Header TCP/UDP/ICMPSNAP/LLCATM
TCP/UDP/ICMP
IP
SNAP/LLC
AAL5
ATM
53 bytes
IP Header with options/ v6 TCP/UDP/ICMPSNAP/LLCATM
IBM Zurich ENST
Bretagne24
Centralised Architecture
• Goals:
– Design an architecture allowing IFTs to be used to provide the relevant access control service.
– Test our new classification algorithm to check if the performance bottleneck and QoS insurance problems could be solved.
• IFT Traffic Analysis Cards (Designed by France Telecom R&D)
• Characteristics:
– Mono-directional.
– Physical connector: OC12 (622 Mb/s).
– Unspecified Classification algorithm.
– Action (1st Cell from an AAL5 frame, classification policy) : AAL5 switching.
Classification
Buffer
IFT
Physical Connector
PhysicalConnector
Switchingoperations
Policy
IBM Zurich ENST
Bretagne25
Architecture
• Located between a private network and public network.
• Made of three modules:
ATM ATM IFT IFT
SignallingFilter
Manager
SUN Station
IFT Driver
Demon
ATMSwitch
Solaris PC
InternalNetwork
ExternalNetwork
Controler
– Manager
– Signalling Filter.
– Cell-Level Filter
• Integrates to an existing ATM switch.
IBM Zurich ENST
Bretagne26
Tests
• Throughput and QoS.
<1,31 * 53 * 8 = 555 Mb/s
Min Classification capabilities
Size of ATM Cells
Min. Classification capacity :
622 * 26/27= 599 Mb/s
Phys. ConnectorMax. Throughput
Physical LayerOverhead
Max. Throughput to classify:
Buffer (8192 bytes)Max. Delay= 120 s
• Memory requirements : Practical examples, analysis of 9 fields, using 15 ns analysis cycle.
Type of policy Number of rules Classification capabilities Memory required[Che94], [Cha95] 40 1,31 Mc/s 17 K bytes
750 1,31 Mc/s 1.2 M bytesFrench ISP 7900 1,31 Mc/s 3,4 M bytes
IBM Zurich ENST
Bretagne27
Conclusions
Centralised Architecture
• Old architecture
• New Classification algorithm
– Determinist.
– Delay introduced by the access control process can be bounded.
– Minimal throughput can be bounded.
– Resistant to DoS attacks.
• IPv6 problem.
• Algorithm is currently only able to deal with static policies.
IBM Zurich ENST
Bretagne28
Agenda
• Introduction
• Access Control parameters
• Access Control Architectures
• Access Control Management
– Distribution Criteria.
– A Distributed Access Control Management Architecture.
• Conclusion
IBM Zurich ENST
Bretagne29
Access Control Management
– Make sure that the whole access control architecture will provide the access control service defined by the security officer.
• Efficiency Insurance• Security Insurance
– Configure each device with the smallest subset of access control rules allowing the policy to be enforced.
• Criteria have to be defined to build these sets.
• Problem 1: Manage a set of devices with proprietary access control configuration interfaces. (Heterogeneity problem).
• Answer: Generic and ergonomic way to define the access control policy.
Constraints
• Problem 2: Manage distributed access control architectures (A big number of access control devices have to be configured remotely).
• Answer: Automatic configuration architectures.
IBM Zurich ENST
Bretagne30
Criteria
• Criterion 1: Device Access Control Capabilities.
– A rule r should not be attributed to a device if this device is not located between the source and the destination described by r.
Source Destination
A.C.
A.C. A.C.
A.C.
A.C.
A.C.A.C.A.C.
A.C.
• Criterion 2: Network Topology.
IF SRC_ADDRESS = Source AND DST_ADDRESS = Destination THEN PERMIT
A.C.A.C.A.C.
A.C.
– A rule can not be attributed to a device if this device is not able to implement the rule.
IBM Zurich ENST
Bretagne31
Criteria
• Criterion 3 (new): Type of rule (permit/ deny)
– A “deny” rule r has to be attributed to a single device. This device is the closest from the source or the destination described by r.
Source Destination
A.C.
A.C. A.C.
A.C.
A.C.
IF SRC_ADDRESS = Source AND DST_ADDRESS = Destination THEN DENY
A.C.A.C.
A.C.
A.C. A.C.A.C.A.C.
A.C.
A.C.
IBM Zurich ENST
Bretagne32
Centralised A.C. Management Architectures
Device 1 Device 3
Console Device 2
Security Officer
Access Control Policy
NetworkModel
• Filtering Postures, J. Guttman, IEEE S&P 97.
• Firmato toolkit, Bartal & al., IEEE S&P 99.
• Policy based management, S. Hinrichs, ACSAC 99.
• An Asynchronous Distributed Access Control Architecture For IP Over ATM Networks, Paul & al. , ACSAC 99.
• Managing Security In Dynamic networks, Konstantinou & al., LISA 99.
IBM Zurich ENST
Bretagne33
Acyclic Network model
Source Destination
A.C.
A.C.
A.C.
A.C.
IF SRC_ADDRESS = Source AND DST_ADDRESS = Destination THEN PERMIT
IF SRC_ADDRESS = Source AND DST_ADDRESS = Destination THEN DENY
IBM Zurich ENST
Bretagne34
Acyclic Network Model
Distribution enforces the three criteria.
Topology changes force the Security Officer to reconfigure access control devices.
Source Destination
A.C.
A.C.
A.C.
A.C.
IBM Zurich ENST
Bretagne35
Acyclic Model
The delay between topology changes and access control devices reconfiguration can introduce security holes.
Source Destination
A.C.
A.C.
A.C.
A.C.
X
A.C.
A.C.
IBM Zurich ENST
Bretagne36
Source Destination
A.C.
A.C.
A.C.
A.C.
X
A.C.
A.C.
X
Acyclic Model
The delay between topology changes and access control devices reconfiguration can introduce security holes.
IBM Zurich ENST
Bretagne37
Distributed A.C. Management Architecture
Device 1 Device 3
Console
Security Officer
AccessControlPolicy
Device 2
• Management of network security application, Hyland & Sandhu, NISSC 98.
• Integrated management of network and host based security mechanisms, Falk & al., ACISP 98.
IBM Zurich ENST
Bretagne38
Our proposal
• The agents interact with the other elements.
Device 1
Routing Agent
Device 3
Routing Agent
Device 2
Routing Agent
Device 4
Routing Agent
• Management agents located on access control devices. A.C.M. Agent
A.C.M. AgentA.C.M. Agent
Device 5
A.C. Manager
• The agents generate efficient configurations using our three criteria.
IBM Zurich ENST
Bretagne39
Our Proposal• Key features:
– Continuous interaction between the agent and it’s environment.
• Local Access Control Policy automatic adaptation.
Routing AgentAccess Control
Management Agent
Access ControlMechanisms
Routing Table
– Topology changes can be used when a new access control posture has been computed and implemented.
• Security holes can be avoided.
IBM Zurich ENST
Bretagne40
Simulation Results
The usage of the three criteria leads to a number of rules equivalent to the one generated through a manual configuration
Total number of rules in the network/Criterion Used
0
20000
40000
60000
80000
No criteria Criteria 1 Criteria 2 Crit. 2 & 3 All crit.Automatic Distribution results Hand configuration
The number of rules without optimisation grows in a polynomial way with the number of access control devices whereas the number of rules after optimisation grows linearly.
Nbr of rules/Nbr of nodes in the network
1
10
100
1000
10000
100000
1000000
4 13 40 121
Nb of rules after opt.C3C1C2Nb of rules before opt.
IBM Zurich ENST
Bretagne41
Conclusions
• The security officer learns “a posteriori” what happened in the network.
• The whole access control policy has to be sent to the agents.
• Generates more efficient configuration through the use of an additional distribution criterion.
• Reduces the interactions between the security officer and the access control management architecture.
• Prevents temporary security holes.
Distributed Access Control Management Architecture
IBM Zurich ENST
Bretagne42
• Introduction
• Access Control Parameters
• Access Control Architectures
• Access Control Management
• Conclusion
Agenda
IBM Zurich ENST
Bretagne43
Conclusion
• ATM Access Control parameters analysis – Application Protection Profiles.– Access Control Parameters have been classified.
• Two IP over ATM Access Control Architectures– Able to take new ATM access control parameters into account.– New access control architecture/ Old classification Algorithm.– Traditional access control Architecture/New classification Algorithm.– Implementation through IFT cards.
• Distributed Automatic Access Control Management Architecture
– New distribution criterion.– Distributed access control management architecture allowing security holes to be avoided.– Implementation using the ns simulator.
IBM Zurich ENST
Bretagne44
Future work• New application level
access control parameters • Improvements to our classification algorithm
• New version of IFTs.
– Higher Throughput (1Gb/s).
– Wider analysis capability.
– New classification functions.
• Application in new areas (Intrusion Detection, Application level Access Control).
• Adaptation to other security services.
• Taking mobility into account.
• Taking access control service integrity into account.
IBM Zurich ENST
Bretagne45
Questions ?