Adam Bender, Neil Spring Dave Levin, Bobby Bhattacharjee University of Maryland, College Park In Proc. USENIX SRUTI, 2007 Speaker: Yun Liaw Accountability as a Service

Introduction The purpose of accountability: To blame the miscreants, and let everyone else be Spoofed IP – Both IP address and ISP are not reliable Accountability Service Provider To “vouch for” sending traffic generated by endpoints Separate accountability from addressing and routing 3/09/09 Speaker : Yun Liaw 1

Related Work Explicit blocking of unsolicited traffic Implicit blocking of unsolicited traffic Stepping stone detection Approaches to stop spoofed source addresses in 3/09/09 Speaker : Yun Liaw 2

The Accountability Service The role of an accountability service To provide authenticated clients with identifiers that can be used to mark packets accountable Other clients of the service can block unwanted traffic, and report malicious packets to the service Accountability services may differentiate from each other by how much anonymity or accountability level they provide and what the require from their clients 3/09/09 Speaker : Yun Liaw 3

The Accountability Service Hold identities in escrow and reveals in case of severe proven abuse vouch for the traffic of its client Accountability identifiers are independent of destination Accountability identifiers are proxiable Receivers specify what accountability service they accept A victim can ask the network to filter traffic that has specific identifier 3/09/09 Speaker : Yun Liaw 4

Design: Straw-man Protocol Signing Every Packets Every router on the forwarding path can check the certificate, but it is expensive 3/09/09 Speaker : Yun Liaw 5 Service Provider (A) Sender (S) Receiver (R) Keypair: (S pub, S priv ) cert s = {S, S pub }A priv pkt, cert s {pkt}S priv Prove Sender himself

Design: An Efficient protocol Sender S, receiver R agree to use accountability service A Each client C of A has a private key c, public key g c and certification cert c = {C, C pub }A priv Use Diffie-Hellman to create shared key S and R: (g s ) r = (g r ) s S and S’s ISP, P 1 : k s = (g P 1 ) s = (g s ) P 1 Outgoing packets from S: cert s timestamp a hash h R = hash(pkt, timestamp, cert s, g sr ) a hash h 1 = hash(pkt, timestamp, cert s, k s ) 3/09/09 Speaker : Yun Liaw 6

Design: An Efficient protocol 3/09/09 Speaker : Yun Liaw 7 P 1 can cache cert s and k s for fast verification P 1 is expected to check cert s, timestamp, and h 1 Non-checking origination ISP identification Let P 1 insert into each packet from S to R P i ’s AS number and h i = hash(pkt,timestamp, cert s, k i ) If R receives a invalid certification packet, R can show this hashed-by-P 1 packet and cert s to any P i along the path, thereby proving that P 1 did not check the certification “First-hop accountability service ISP” R can ask its ISP P n to block traffic from cert s on its behalf

Design: An Efficient protocol Does not provide non-repudiation property 3/09/09 Speaker : Yun Liaw 8

Discussions and Comments Accountability services can help ISPs to filter unwanted traffic Centralized and trusted authority would limit the scalability Accountability should be held by people, while machines are neutral Bots and zombies The cost of accountability service What is the value and profit that accountability service would bring to us? Is it worth deploying? 3/09/09 Speaker : Yun Liaw 9