Policy Enforcing for Probe Based Amission Control政策執(zhí)行為基礎(chǔ)的準(zhǔn)入控制探討

1、policy enforcing for probe based admission controlmaster of science thesismarcello conte8 may 2002policy enforcing for probe based admission control2royal institute of technology (kth), dept. of teleinformatics (it)stockholm, swedenpolitecnico di torino, dept. of computer and control engineering tur

2、in, italytechnical advisor:ignacio ms ivarssupervisor at kth/itviktria fodorsupervisor at politecnico di torinoantonio lioy8 may 2002policy enforcing for probe based admission control3content background probe based admission control (pbac) testbed architecture policy enforcing protocol performance e

3、valuation conclusion & future work8 may 2002policy enforcing for probe based admission control4background predictable qos guarantees for real time services integrate and support multimedia applications: voip, video/audio streaming etc. best-effort service unsatisfactory ietf set up working group

4、s: intservrfc 1633 diffservrfc 24758 may 2002policy enforcing for probe based admission control5measurement based admission control (mbac) solve scalability problems combine intserv and diffserv architecture access control at the edge nodes: probes the network to experience the congestion level perf

5、orms measurement on: packet loss percentage, packet delay accept/reject incoming session8 may 2002policy enforcing for probe based admission control6probe based admission control (pbac) provides a controlled load service (cls) upper bound on packet loss, low delay probe packets include: peak bit rat

6、e, time duration, session identifier router support: distinguish probe and data packets serve packets with priority trust between network and end-users 8 may 2002policy enforcing for probe based admission control7pbac requirements sender does not transmit data: at a higher bitrate than the one agree

7、d if rejected by the receiver receiver: take a reliable admission decision protection of the probing flow8 may 2002policy enforcing for probe based admission control8testbed architectureinternetxmmsffserver hardware: celeron 800mhz, ram 128 mbytes8 may 2002policy enforcing for probe based admission

8、control9testbed architecturexmmsffserverinternetagagclsproviderclsprovider8 may 2002policy enforcing for probe based admission control10security issuexmmsffserverinternetagagintruder attackusers misbehavior8 may 2002policy enforcing for probe based admission control11policy enforcing protocol collec

9、tion of cryptographic mechanisms assist the probe phase of the pbac functions: monitors pbac users behavior protects the probe phase from intruder attacks ag support at the border of the network8 may 2002policy enforcing for probe based admission control12cryptographic mechanisms entity authenticati

10、on signature scheme, certificate extension message integrity check sha-1, md5, mac, etc. key exchange diffie-hellman, needham-schroeder, etc. message encryption rc4, des, rsa, idea, etc.8 may 2002policy enforcing for probe based admission control13solutionmonitor users behaviour checking the cls api

11、 usedprotect the probing flow encrypting the linkcode authenticationsecure tunnel8 may 2002policy enforcing for probe based admission control14code authentication (ca) forces the end-users to follow the steps of pbac makes sure ags about the cls api authenticity requires end-users to show an authent

12、ication key 8 may 2002policy enforcing for probe based admission control15code authentication (ca) ag generates a key end-user: computes mac on the cls api sends back the digest ag: checks the validity of the digest accept/reject end-useragend-userkeydigest8 may 2002policy enforcing for probe based

13、admission control16secure tunnel establishmentags involved in the communication: authenticate themselves share a secret key cover the messages exchangedpolicy enforcing protocol task: rsa signature key exchange protocol encryption 8 may 2002policy enforcing for probe based admission control17rsa sig

14、naturevb,ssb(ipb,ipa)agaagbva,ssa(ipa,ipb)aga sends a public verification key va and a signed message with both the ip address of the ag agb verifies agaagb sends a public verification key vb and a signed message with both the ip address of the ag aga verifies agbags authentication8 may 2002policy e

15、nforcing for probe based admission control18secure tunnel establishmentags involved in the communication: authenticate themselves share a secret key cover the messages exchangedpolicy enforcing protocol task: rsa signature key exchange protocol encryption 8 may 2002policy enforcing for probe based a

16、dmission control19key exchange protocolaga generates a prime random number p and a random exponent g gb,ssb(gb,ga)agaagb p, g, gassa(ga,gb)agb picks a random number b and sends the public key gb and a signed message with both the public keysaga sends a signed message with both the public keys as ack

17、nowledgment aga picks a random number a and sends the parameters and the public key ga both aga and agb compute the shared key k = gab8 may 2002policy enforcing for probe based admission control20secure tunnel establishmentags involved in the communication: authenticate themselves share a secret key

18、 cover the messages exchangedpolicy enforcing protocol task: rsa signature key exchange protocol encryption 8 may 2002policy enforcing for probe based admission control21message encryptionusing fast algorithm to lower the delay of the encryption/decryption rc4to cover:ek(admission packet)agaagbek(pr

19、obe packets) the content of the probe packet the admission decision8 may 2002policy enforcing for probe based admission control22connection shutdownif a security check fails: the ags do not forward packets between the end-users the ags close the sockets to the end-users user forced to repeat the pro

20、cedureotherwise: the probe phase begins8 may 2002policy enforcing for probe based admission control23ca evaluationtest performed varying the size of the keydigest computed on the cls api of 1 mbytesthe size of the key does not affect the delay in computing the digestaverage value of 53 msecs8 may 20

21、02policy enforcing for probe based admission control24rsa evaluationtest performed varying the size of the public and private keyscomplexity in generating the public/private keysdelay introduced by the sign/verify functionsdelay increases with the size of the keys8 may 2002policy enforcing for probe

22、 based admission control25kep evaluationthe rsa signature scheme affects the kepshared key size fixed to: 16 bytesvarying the size of the rsa keysdelay: introduced by the rsa sign/verify functions increases linearlyfirst test8 may 2002policy enforcing for probe based admission control26fixed size of

23、 the rsa keysvarying the size of the shared keyexponential trend due: complexity in generating shared parameters (p,g) delay for computing the shared keythe security level increases the delaykep evaluationsecond test8 may 2002policy enforcing for probe based admission control27policy enforcing setup

24、 delayevaluation of the delay that the protocol introducesdelay increases with the security leveltrade off between the security level and the delaysuggest set of parameters:ca1024 bytesrsa128 byteskep32 bytesdelay introduced:ca 52 msecsrsa1799 msecskep1086 msecs2937 msecs8 may 2002policy enforcing for probe based admission control28policy enforcing setup delay probe duration time in the worse case: 5 secs policy enforcing protocol delay:2937 msecs delay for the service provision: 8secs medium security level delay comparable to the probe duration time reliable upper bound on the service provi