Faculty of Electrical Engineering, Technion DSN 2004 Gal Badishi Exposing and Eliminating Vulnerabilities to Denial of Service Attacks in Secure Gossip-Based Multicast Gal Badishi, Idit Keidar, Amir Sasson

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 OutlineOutline The problem The problem Overview of gossip-based multicast Overview of gossip-based multicast Proposed solution - Drum Proposed solution - Drum Analysis and simulations Analysis and simulations Implementation and measurements Implementation and measurements Summary and general principles Summary and general principles The problem The problem Overview of gossip-based multicast Overview of gossip-based multicast Proposed solution - Drum Proposed solution - Drum Analysis and simulations Analysis and simulations Implementation and measurements Implementation and measurements Summary and general principles Summary and general principles

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 Denial of Service (DoS) Unavailability of service Unavailability of service –Exhausting resources Remote attacks Remote attacks –Network level Solutions do not solve all application problems Solutions do not solve all application problems –Application level Got little attention Got little attention Quantitative analysis of impact on application and identification of vulnerabilities needed Quantitative analysis of impact on application and identification of vulnerabilities needed Unavailability of service Unavailability of service –Exhausting resources Remote attacks Remote attacks –Network level Solutions do not solve all application problems Solutions do not solve all application problems –Application level Got little attention Got little attention Quantitative analysis of impact on application and identification of vulnerabilities needed Quantitative analysis of impact on application and identification of vulnerabilities needed

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 ChallengesChallenges Quantify the effect of DoS at the application level Quantify the effect of DoS at the application level Expose vulnerabilities Expose vulnerabilities Find effective DoS-mitigation techniques Find effective DoS-mitigation techniques –Prove their usefulness using the found metric Multicast as an example Multicast as an example Quantify the effect of DoS at the application level Quantify the effect of DoS at the application level Expose vulnerabilities Expose vulnerabilities Find effective DoS-mitigation techniques Find effective DoS-mitigation techniques –Prove their usefulness using the found metric Multicast as an example Multicast as an example

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 Tree-Based Multicast Use a spanning tree – most common solution Use a spanning tree – most common solution No duplicates (optimal BW when network-level) No duplicates (optimal BW when network-level) Single points of failure Single points of failure Use a spanning tree – most common solution Use a spanning tree – most common solution No duplicates (optimal BW when network-level) No duplicates (optimal BW when network-level) Single points of failure Single points of failure Source

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 Gossip-Based Multicast Progresses in rounds Progresses in rounds Every round Every round –Choose random partners (view ) –Send or receive messages –Discard old msgs from buffer Probabilistic reliability Probabilistic reliability Uses redundancy to achieve robustness Uses redundancy to achieve robustness Two methods Two methods –Push –Pull Progresses in rounds Progresses in rounds Every round Every round –Choose random partners (view ) –Send or receive messages –Discard old msgs from buffer Probabilistic reliability Probabilistic reliability Uses redundancy to achieve robustness Uses redundancy to achieve robustness Two methods Two methods –Push –Pull

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 PushPush Source

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 PullPull Source

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 Effects of DoS on Gossip Surprisingly, we show that naïve gossip is vulnerable to DoS attacks Surprisingly, we show that naïve gossip is vulnerable to DoS attacks Attacking a process in pull-based gossip may prevent it from sending messages Attacking a process in pull-based gossip may prevent it from sending messages Attacking a process in push-based gossip may prevent it from receiving messages Attacking a process in push-based gossip may prevent it from receiving messages Surprisingly, we show that naïve gossip is vulnerable to DoS attacks Surprisingly, we show that naïve gossip is vulnerable to DoS attacks Attacking a process in pull-based gossip may prevent it from sending messages Attacking a process in pull-based gossip may prevent it from sending messages Attacking a process in push-based gossip may prevent it from receiving messages Attacking a process in push-based gossip may prevent it from receiving messages

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 DrumDrum A new gossip-based ALM protocol A new gossip-based ALM protocol Utilizes DoS-mitigation techniques Utilizes DoS-mitigation techniques –Using random one-time ports to communicate –Combining both push and pull –Separating and bounding resources Eliminates vulnerabilities to DoS Eliminates vulnerabilities to DoS Proven robust using formal analysis and quantitative evaluation Proven robust using formal analysis and quantitative evaluation A new gossip-based ALM protocol A new gossip-based ALM protocol Utilizes DoS-mitigation techniques Utilizes DoS-mitigation techniques –Using random one-time ports to communicate –Combining both push and pull –Separating and bounding resources Eliminates vulnerabilities to DoS Eliminates vulnerabilities to DoS Proven robust using formal analysis and quantitative evaluation Proven robust using formal analysis and quantitative evaluation

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 Random Ports Any request necessitating a reply contains a random port number Any request necessitating a reply contains a random port number –“Invisible” to the attacker (e.g., encrypted) The reply is sent to that random port The reply is sent to that random port Assumption: Network withstands load Assumption: Network withstands load Any request necessitating a reply contains a random port number Any request necessitating a reply contains a random port number –“Invisible” to the attacker (e.g., encrypted) The reply is sent to that random port The reply is sent to that random port Assumption: Network withstands load Assumption: Network withstands load Request + random port number Wait on random port Wait on well- known port

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 Combining Push and Pull Attacking push cannot prevent receiving messages via pull (random ports) Attacking push cannot prevent receiving messages via pull (random ports) Attacking pull cannot prevent sending via push Attacking pull cannot prevent sending via push Each process has some control over the processes it communicates with Each process has some control over the processes it communicates with Attacking push cannot prevent receiving messages via pull (random ports) Attacking push cannot prevent receiving messages via pull (random ports) Attacking pull cannot prevent sending via push Attacking pull cannot prevent sending via push Each process has some control over the processes it communicates with Each process has some control over the processes it communicates with

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 Bounding Resources Motivation: prevent resource exhaustion Motivation: prevent resource exhaustion Each round process a random subset of the arriving messages and discard the rest Each round process a random subset of the arriving messages and discard the rest Separate resources for orthogonal operations Separate resources for orthogonal operations Motivation: prevent resource exhaustion Motivation: prevent resource exhaustion Each round process a random subset of the arriving messages and discard the rest Each round process a random subset of the arriving messages and discard the rest Separate resources for orthogonal operations Separate resources for orthogonal operations Valid Request Bogus Request Round Duration

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 Evaluation: Staged DoS Attacks Increasing strength Increasing strength –shows trend under DoS Fixed strength Fixed strength –exposes vulnerabilities Source is always attacked Source is always attacked Analysis, simulations, measurements Analysis, simulations, measurements Increasing strength Increasing strength –shows trend under DoS Fixed strength Fixed strength –exposes vulnerabilities Source is always attacked Source is always attacked Analysis, simulations, measurements Analysis, simulations, measurements

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 Analysis – Increasing Strength Assume static group, strict subset is attacked Assume static group, strict subset is attacked Lemma 1: Drum’s propagation time is bounded from above by a constant independent of the attack rate Lemma 1: Drum’s propagation time is bounded from above by a constant independent of the attack rate Lemma 2: The propagation time of Push grows at least linearly with the attack rate Lemma 2: The propagation time of Push grows at least linearly with the attack rate Lemma 3: The propagation time of Pull grows at least linearly with the attack rate Lemma 3: The propagation time of Pull grows at least linearly with the attack rate Assume static group, strict subset is attacked Assume static group, strict subset is attacked Lemma 1: Drum’s propagation time is bounded from above by a constant independent of the attack rate Lemma 1: Drum’s propagation time is bounded from above by a constant independent of the attack rate Lemma 2: The propagation time of Push grows at least linearly with the attack rate Lemma 2: The propagation time of Push grows at least linearly with the attack rate Lemma 3: The propagation time of Pull grows at least linearly with the attack rate Lemma 3: The propagation time of Pull grows at least linearly with the attack rate

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 Analysis – Fixed Strength Lemma 4: For strong enough attacks, Drum’s expected propagation time is monotonically increasing as the percentage of attacked processes increases Lemma 4: For strong enough attacks, Drum’s expected propagation time is monotonically increasing as the percentage of attacked processes increases

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 High-Throughput Experiments Multithreaded Java implementation Multithreaded Java implementation Single source creates 40 msgs/sec Single source creates 40 msgs/sec Round duration = 1 second Round duration = 1 second Measure throughput and latency at the receiving processes Measure throughput and latency at the receiving processes Multithreaded Java implementation Multithreaded Java implementation Single source creates 40 msgs/sec Single source creates 40 msgs/sec Round duration = 1 second Round duration = 1 second Measure throughput and latency at the receiving processes Measure throughput and latency at the receiving processes

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 SummarySummary Gossip-based protocols are very robust, but… Gossip-based protocols are very robust, but… –naïve gossip-based protocols are vulnerable to targeted DoS attacks Drum uses simple techniques to mitigate the effects of DoS attacks Drum uses simple techniques to mitigate the effects of DoS attacks Evaluations show Drum’s resistance to DoS Evaluations show Drum’s resistance to DoS The most effective attack against Drum is a broad one The most effective attack against Drum is a broad one Gossip-based protocols are very robust, but… Gossip-based protocols are very robust, but… –naïve gossip-based protocols are vulnerable to targeted DoS attacks Drum uses simple techniques to mitigate the effects of DoS attacks Drum uses simple techniques to mitigate the effects of DoS attacks Evaluations show Drum’s resistance to DoS Evaluations show Drum’s resistance to DoS The most effective attack against Drum is a broad one The most effective attack against Drum is a broad one

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004 General Principles DoS-mitigation techniques: DoS-mitigation techniques: –random ports –neighbor-selection by local choices –separate resource bounds Design goal: eliminate vulnerabilities Design goal: eliminate vulnerabilities –The most effective attack is a broad one Analysis and quantitative evaluation of impact of DoS Analysis and quantitative evaluation of impact of DoS DoS-mitigation techniques: DoS-mitigation techniques: –random ports –neighbor-selection by local choices –separate resource bounds Design goal: eliminate vulnerabilities Design goal: eliminate vulnerabilities –The most effective attack is a broad one Analysis and quantitative evaluation of impact of DoS Analysis and quantitative evaluation of impact of DoS

Gal BadishiFaculty of Electrical Engineering, TechnionDSN 2004