the aerospace clinic 2002 team members nick hertl (project manager) will berriel richard fujiyama...

The Aerospace Clinic 2002

Team Members

Nick Hertl (Project Manager)

Will Berriel

Richard Fujiyama

Chip Bradford

Faculty Advisor

Professor Michael Erlinger

Aerospace Liaisons

Joseph Betser, PhD

Rayford Sims

Overview:

• Background Information

• Alternatives to Tunnel

• Technical Approach– Completed work– Future work

• Questions

Background

• TCP/IP

• Firewalls

• Security

• BEEP

• IDXP

• Tunnel

TCP/IP

• Main protocols used over the Internet

• Provides reliable, full-duplex, peer-to-peer communication

• Most current application protocols use this directly: HTTP (web), SMTP (email), etc.

• Multiple connections to the same machine are handled using ports

Firewalls

• Set of rules to restrict TCP/IP traffic

• Can filter by any combination of source and destination IP address and port

• Rule sets are usually static—not easy to handle "only allow Joe's messages through" if Joe doesn't always connect from the same computer

Security

• Firewalls attempt to ensure this• To allow Joe access, he must first prove he

is who he claims to be (login/authenticate)• SSH Tunnel is a common solution—

handles authentication• SSH not without drawbacks, however

(discussed later)• Tunnel is a better solution, but first...

BEEP

• General framework for rapidly creating application-level protocols

• Requires an underlying transport protocol (TCP)

• Provides a message framing mechanism and many common service "profiles"

• Profiles provide transparent addition of properties to a connection (i.e. security)

IDXP

• Intrusion Detection eXchange Protocol• BEEP profile used to transfer intrusion

detection alert information from various sensors within a large network to a central repository where an administrator or correlation program can take actions against an attack if needed

• Firewall must not block messages

Tunnel

• General purpose proxy routing BEEP profile

• Our focus is Tunnel for IDXP message

F ig u re 1 : C o nc e ptua l L a y o utL ig h t B lu e : 3 r d p a r t y ID SY e l lo w : A s s u m e d t o w o rk p ro p e r lyG re e n : T h e fo c u s o f o u r c lin ic

Tunnel

• Uses XML messages to establish a tunnel:<tunnel fqdn="host2.example.com" port="10288">

<tunnel /></tunnel>

• Example...

Tunnel

host1.example.com proxy.example.com host2.example.comTransport Connect

Usually TCP

Tunnel


BEEP Greeting

Advertise services (Tunnel, maybe others)

Tunnel


BEEP GreetingStart Tunnel

<tunnel fqdn="host2.example.com" port="10288"><tunnel />

</tunnel>

Tunnel



Transport Connect

Usually TCP

Tunnel



Transport Connect

BEEP Greeting

Advertise services (Tunnel, maybe others)

Tunnel



Transport Connect


<tunnel />

Tunnel



Transport Connect


OK

<ok />

Tunnel



OK

Transport Connect


OK

<ok />

proxy now transparently forwards messages

Tunnel



OK

Transport Connect


OK

BEEP Greeting

Advertise services (proxy now invisible)

Alternatives to Tunnel

• SSL/TLS

• SASL

• SSH

• VPN

• IPsec

SSH (Secure Shell) Tunnelling• Client/Server applications• Provides encryption, client authentication• Mass adoption leaves port 22 open• Commonly used to tunnel through firewalls• Application dependency on SSH• Explicit endpoint connections• Lacks host authentication• Tunnel offers auth/encry details, address anonymity,

doesn't require explicit endpoint

SSL v3 / TLS v1(RFC 2246)

• HTTPS, NNTP, IMAP, POP

• Lives between TCP and application• API is similar to BSD socket API• Encryption• Server authentication and optional host• Simple client configuration – no AC• Certificate spoofing, man-in-the-middle attacks

SASL (RFC 2222)(Simple Authentication and

Security Layer)• SSL with an A?• Framework for adding auth/encry/integrity• Allows network admin to configure proper

security levels for the environment• BEEP makes use of SASL

VPN(Virtual Private Network)

• Secure, private, transparent network• Encryption, strong authentication• Intrusive on the client• Tunnel is easier to deploy and administer,

allows more policy flexibility

IPsec(IP Security)

• Protects everything running on top of IP, including TCP and UDP

• Requires kernel modification• No recompiling necessary to get benefit• IPsec does not work with NAT• Tunnel is easier to deploy, works with

NAT, and configurable

Completed Work

• Proposal Submitted

• Tunnel Evaluated

• Beep Implementations Chosen

• No – Hop Tunnel Implementation

Tunnel Issues:

• No IPv6 support in the DTD or a standard way to extend the DTD.

• Possibility for loops with misconfigured servers.

• No way to specify a Time-To-Live when using a dynamic route, ie: connecting to a service rather than a host.

Beep Implementations:

• JAVA: – PermaBEEP 0.8 – Beepcore–java 0.9.07

• C– Roadrunner 0.9– Beepcore–C 0.2

No-Hop Tunnel

• Profile and application can successfully open a tunnel to a host with no firewall in between.

Future Work

• One–Hop Tunnel

• Firewall Proxy–Hopping

• Multi–Hop Proxying

• Interoperability between C and JAVA implementations

Schedule

ID Task Name

2 Prepare Development Machine

3 Group Presentation

4 Proposal

5 Draft Proposal Due

6 Proposal Due

7 Evaluate Tunnel Draft

8 Fall Break

9 Choose BEEP Implementation

10 Single Host BEEP Communication

11 Peer-to-peer BEEP Communication

12 One-Hop BEEP Communication

13 Thanksgiving Break

14 Midyear Report

15 Draft Midyear

16 Midyear Report

100%

100%

100%

10/4

10/11

100%

100%

10/18

100%

100%

0%

0%

0%

12/5

12/12

9/1 9/8 9/159/229/2910/610/1310/2010/2711/311/1011/1711/2412/112/812/1512/2212/291/5 1/121/191/26 2/2 2/9 2/162/23September October November December January February

Questions?

the aerospace clinic 2002 team members nick hertl (project manager) will berriel richard fujiyama...

Documents

tunnel transport

tunnel ok slide

tunnel ok transport

services tunnel

later tunnel

tunnel host1

beep greeting

tunnel ok proxy