PR SM A Secure Code Deployment Scheme for Active Networks Amdjed Mokhtari Leïla Kloul 22 November 2005

2 PR SM Outline Introduction & Motivation Code distribution mechanisms Security mechanisms Conclusions and future works

3 PR SM Code distribution Code identification address Filter …) and type (TCP, …) limited to one user class Identifier : hash code (MD5, …) links an identifier to its developer Code deployment In band persistence and sharing of codes Out band pre-selection of nodes, multiple path

4 PR SM Publication phase Deployment phase 1 – Active code sending 1 2- identifier sending 2 Code developer CISS Active Node Publication Web Site User 4 4-Consultation of the application service and recuperation of the identifier 3 3- Publication on the web site 6- Request of referenced code 6 7– Active code sending Active data packets and reference sending Referencing phase Code distribution CISS Approach (Code Identification and Storage Server)

5 PR SM Code distribution Approach multi CISS Repartition of CISS Placed at the edge of the network Code base management Distributed code bases Replicated code bases Guarantee the uniqueness of the identifier Distributed code bases management

6 PR SM Injection phaseMigration Phase User CISS Passive node A B C Active node D 1 1- Code request 2 2 – Active code sending 3 3- Code request Active code sending 4 Code distribution Mixed Approach : combines CISS approach and Hop by Hop approach (Node by Node defined in ANTS) Packet header A - Previous node

7 PR SM Security mechanisms Security in code distribution Authentication CAAN (Certificate Authority for Active Network) Key for each entity : CISS, nodes, developers, users and also the code Execution authorization Utilization of a temporary keys Adaptation of ROSA technique [BAGNULO et al 02]

8 PR SM Security mechanisms Publication phase Deployment phase Certificate authentication request 7- Request of code and its key 7 8– Active code and its key sending Active data packets with reference sending and temporary key Referencing phase 1 – Certificate sending with code publication request 1 2- Code reception acceptation – Active code sending Code developer CISS Active node CAAN User 4- Certificate sending with a temporary key request Temporary key sending after verification Certificate authentication request Security in code distribution

9 PR SM Conclusions & Future works Conclusions Global scheme for code distribution based on A Code Identification and Storage Server (CISS) A Publication Site Web of the CISS code base Global scheme for the security based on Utilization temporary keys for the code deployment A certification authority (CAAN) Future works Performance analysis of the defined techniques in large scale network Evaluate the cost of the developed security mechanisms in terms of execution times