1. Research Overview Carl A. Gunter University of Pennsylvania

2. Projects Authenticated Traversal : L3A : Goodloe, Gunter, Stehr DoS : Selective Verification : Gunter, Khanna, Venkatesh OpEm : PPC : Alur, Gunter PISCES FUNDING SOURCES Army Research Office National Science Foundation Office of Naval Research PROFESSORS Rajeev Alur Michael Greenwald Carl A. Gunter Sanjeev Khanna Jose Meseguer Andre Scedrov Santosh Venkatesh Steve Zdancewic RESEARCH STAFF Mark-Oliver Stehr Kaijun Tan PHD STUDENTS Margaret Delap Matthew Jacobs Alwyn Goodloe Michael McDougall Peng Li Gaurav Shah Raman Sharykin Jason Simas Ying Xu RESEARCH PROGRAMMERS Sumeet Bedi Watee Arsjamat

3. Wireless Security Why is wireless security any different from wired security? –Resource constraints. –Value of the network link. –Increased risk to confidentiality.

4. Wireless Security Efforts Layer 1 (Physical) –Spread spectrum Layer 2 (Link) –802.11x – 802.11(b) WEP, 802.11(g) –GPRS –CDMA 2000

5. Network Layer Wireless Security Advantages –Independent of underlying link layer. –Overcomes the challenges addressed by layer 2 mechanisms for most cases. –Leverages extensive experience, s/w, and h/w support from Ipsec for VPNs. Disadvantage –Need set up protocols.

6. Basic Challenge CSNAS LAN Internet

7. L3A Architecture L3ASIKESAM SPDSAD IP Ipsec

8. Protocol Messages and Tunnels CSNAS SIKE SIKE w/ delegation SIKE

9. Research Directions Build on sectrace experience. Formal simulation of SIKE and L3A in Maude in parallel with design. Implementation on BSD with X.509 certs. Develop requirements for accounting and prove correctness.

10. DoS Models and Protection Measures Shared Channel Model Selective Verification Bin Verification Current Directions

11. Shared Channel Model Adversary can replay and insert packets. Legitimate sender sends packets with a maximum and minimum bandwidth. Legitimate sender experiences loss, but not deliberate modification.

12. Shared Channel Model Example S1A1S2S3S4A2A3S5A4A5 Model is a four-tuple (W 0, W 1, A, p). W 0, W 1 min and max sender b/w A attacker max b/w p loss rate of sender Sender PacketDropped Sender PacketAttacker Packet

13. Signature Flooding Attack factor R = A / W 1. Proportionate attack R = 1. Disproportionate attack R > 1. Stock PC can handle about 8000 PKC/sec. 10Mbps link sends about 900 pkt/sec, 100Mbps link sends about 9000 pkt/sec. Budget: no more that 5% of processor on PKCs.

14. Selective Sequential Verification Adversary can devote his entire channel to fake signature packets. Countermeasure: –Valid sender sends multiple copies of the signature packet. –Receiver checks each incoming signature packet with some probability (say, 25% or 1%).

15. Attack Profile R S requires low b/w channel with high processing cost at R A loads this channel with bad packets S A

16. Selective Verification RA S

17. R R makes channels lossy S adds redundancy A gets reduced channel Tradeoff: bandwidth vs. processing S A

18. Bin Verification 1 1 1 1 22 34 4123

19. Current Research Develop a unified theory with Dolev Yao A  B : M Investigate general protocol analysis techniques. Analysis of TCP. t