Secure Virtually Isolated Networks to Avoid and Tolerate Denial of Service

在交换智能对象而不是文档的世界里，通过互联网连接机器的广泛需求和能力导致网络更容易受到入侵，并为各种类型的入侵提供了便利。目前大多数可用来处理网络易受滥用和攻击的方法要么不充分、效率低下，要么限制过度。使问题更加复杂的是需要保持可接受的服务质量(Qos)水平。该研究项目考虑了一个异质网络环境，在这种环境中，服务器通过契约协议为客户提供不同级别的服务质量支持，容易发生故障和拒绝服务攻击。该研究项目假设入侵检测机制的存在，旨在研究新的和潜在的革命性方法，以开发可扩展和高效的服务部署策略和网络资源管理方案，以在出现故障的情况下保持可接受的服务质量和安全水平。将考虑两种类型的故障，即良性故障和恶意入侵。前者可能是由于有故障的合法客户端意外失去对其行为的控制，而后者的发生是为了造成损害，如拒绝服务(DoS)。这两种类型的故障都会严重影响网络的性能，并危及其服务的完整性和安全性。这些错误可能以违反协议或违反合同的形式表现出来。前者以授权客户端(可能发生模拟)为例，这些客户端试图故意违反合同协议并影响服务器的行为，最终导致服务器故障。当客户试图获得超出服务合同中约定的服务级别时，就会发生违反合同的情况。为了保护服务器和网络，我们提出了两种新的技术：基于复制的难以捉摸的服务器的概念的故障避免技术和基于虚拟隔离网络(VIN)的资源管理方案的容错技术。复制的难以捉摸的服务器的概念支持漫游地址和无线网络中频繁的频率变化等想法。复制通过由底层多播机制支持的组通信来协调。另一方面，VINS提供了实现为每个服务、客户端或客户端类别保留的资源的物理和逻辑分离(在空间和时间上)的基础。该方法将网络性能、容错和安全视为多维Qos空间的有机组成部分，从而实现对网络资源的有效管理，从而将Qos支持视为一个多层次的优化过程，将安全性、容错、资源分配、通信协议优化和用户级应用管理视为同一Qos频谱上的居民，并寻求权衡以达到最优操作点。开发的技术将被设计成处理在空间和时间上聚集的多个协同入侵。将建立协调/集群故障模型，并研究其对所开发的技术和算法的影响。拟议的研究将建立在私人投资机构以前开展的工作的基础上，这些机构在与有线和无线网络中的服务质量支持的容错、操作系统开发和资源管理有关的广泛研究课题上有着良好的成功记录。预计通过算法开发和分析、仿真和试验台实现，该项目的结果将有助于更好地理解如何在有线和无线环境中以集成的方式为服务质量性能、容错和安全提供有效的支持。该项目的一个同样重要的贡献将是在一个专业知识匮乏的领域培养高素质的学生。

The widespread need and ability to connect machines across the Internet, in a world where intelligent objects rather than documents are exchanged, has caused the network to be more vulnerable to intrusions and has facilitated break-ins of a variety of types. Most of the methods currently available to deal with networkvulnerability to abuse and attacks are either inadequate, inefficient oroverly restrictive. Compounding theproblem is the need to maintain an acceptable level of quality of service (QoS). The proposed research project considers a heterogeneous network environment where servers, whichprovide different levels of QoS support to clients through a contract protocol, are prone to faults and denialof service attacks. The research project assumes the existence of intrusion detection mechanisms, and aimsat investigating new and potentially revolutionary approaches for the development of scalable and efficientservice deployment strategies and network resource management schemes to maintain acceptable levels ofQoS and security, despite faults. Two types of faults, namely, benign malfunctions and malicious intrusions,will be considered. The former can be caused by a faulty, yet legitimate client that accidentally loses controlover its behavior, while the latter occurs with the intent to cause damage, such asDenial of Service (DoS).Both types of faults can severely affect the performance of the network and compromise the integrity andsecurity of its services. These faults can manifest themselves in the form of a protocol breach or a contract violation. The formeris exemplified by an authorized clients (impersonation may take place) who attempt to deliberately breachthe contract protocol and impact the behavior of the server to eventually cause its failure. Contract violationoccurs when a client attempts to acquire a level of service beyond what has been agreed upon in the servicecontract. In order to protect the servers and the network, we propose two new techniques: fault avoidance,based on the concept of replicated elusive servers, and fault tolerance, based on resource management schemes through the creation of a Virtually Isolated Network (VIN). The concept of replicated elusive servers espouses ideas such as roaming addresses and frequent frequencychanges in wireless networks. Replication is coordinated through group communication supported by anunderlying multicast mechanism. VINs, on the other hand, provide the basis to achieve both physical andlogical separation (in space and time) of the resources reserved for each service, client, or class of clients. Efficient management of network resources is achieved based on an integrative approach which considersnetwork performance, fault tolerance and security asintegral components of a multi-dimensional QoS space.QoS support can then be perceived as a multi-layered optimization process which considers security, fault-tolerance, resource allocation, communication protocol optimization and user level application managementas inhabitants of the same QoS spectrum and seeks to exploit tradeoffs in order to reach anoptimal operatingpoint. The techniques developed will be designed to handle multiple coordinated intrusions, clustered inboth space and time. A coordinated/clustered fault model will be developed and a study of its effect on thedeveloped techniques and algorithms will be conducted. The proposed research will build on a foundation of prior work developed by the PIs which have astrong track record of success in a wide range of research topics related to fault-tolerance, operating systemdevelopment and resource management for QoS support in wired and wireless networks. It is anticipatedthat through algorithms development and analysis, simulation and testbed implementations, the results ofthis project will lead to a better understanding of how to provide efficient support to QoS performance,fault-tolerance and securityin an integrated manner, both in wired and wireless environments. An equallyimportant contribution of this project will be the training of high quality students in a field where expertiseis scarce.