Secure Virtually Isolated Networks to Avoid and Tolerate Denial of Service

点击翻译按钮获取中文摘要

The widespread need and ability to connect machines across the Internet, in a world where intelligent objects rather than documents are exchanged, has caused the network to be more vulnerable to intrusions and has facilitated break-ins of a variety of types. Most of the methods currently available to deal with networkvulnerability to abuse and attacks are either inadequate, inefficient oroverly restrictive. Compounding theproblem is the need to maintain an acceptable level of quality of service (QoS). The proposed research project considers a heterogeneous network environment where servers, whichprovide different levels of QoS support to clients through a contract protocol, are prone to faults and denialof service attacks. The research project assumes the existence of intrusion detection mechanisms, and aimsat investigating new and potentially revolutionary approaches for the development of scalable and efficientservice deployment strategies and network resource management schemes to maintain acceptable levels ofQoS and security, despite faults. Two types of faults, namely, benign malfunctions and malicious intrusions,will be considered. The former can be caused by a faulty, yet legitimate client that accidentally loses controlover its behavior, while the latter occurs with the intent to cause damage, such asDenial of Service (DoS).Both types of faults can severely affect the performance of the network and compromise the integrity andsecurity of its services. These faults can manifest themselves in the form of a protocol breach or a contract violation. The formeris exemplified by an authorized clients (impersonation may take place) who attempt to deliberately breachthe contract protocol and impact the behavior of the server to eventually cause its failure. Contract violationoccurs when a client attempts to acquire a level of service beyond what has been agreed upon in the servicecontract. In order to protect the servers and the network, we propose two new techniques: fault avoidance,based on the concept of replicated elusive servers, and fault tolerance, based on resource management schemes through the creation of a Virtually Isolated Network (VIN). The concept of replicated elusive servers espouses ideas such as roaming addresses and frequent frequencychanges in wireless networks. Replication is coordinated through group communication supported by anunderlying multicast mechanism. VINs, on the other hand, provide the basis to achieve both physical andlogical separation (in space and time) of the resources reserved for each service, client, or class of clients. Efficient management of network resources is achieved based on an integrative approach which considersnetwork performance, fault tolerance and security asintegral components of a multi-dimensional QoS space.QoS support can then be perceived as a multi-layered optimization process which considers security, fault-tolerance, resource allocation, communication protocol optimization and user level application managementas inhabitants of the same QoS spectrum and seeks to exploit tradeoffs in order to reach anoptimal operatingpoint. The techniques developed will be designed to handle multiple coordinated intrusions, clustered inboth space and time. A coordinated/clustered fault model will be developed and a study of its effect on thedeveloped techniques and algorithms will be conducted. The proposed research will build on a foundation of prior work developed by the PIs which have astrong track record of success in a wide range of research topics related to fault-tolerance, operating systemdevelopment and resource management for QoS support in wired and wireless networks. It is anticipatedthat through algorithms development and analysis, simulation and testbed implementations, the results ofthis project will lead to a better understanding of how to provide efficient support to QoS performance,fault-tolerance and securityin an integrated manner, both in wired and wireless environments. An equallyimportant contribution of this project will be the training of high quality students in a field where expertiseis scarce.