A Flow-Based Approach to Datagram Security Suvo Mittra Thomas Y.C. Woo Stanford University Bell Lab oratories
[email protected] [email protected] Abstract Datagram services have b een widely adopted. Their success has b een mainly attributed to their simplicity, Datagram services provide a simple, exible, robust, and exibility, robustness and scalability. For example, many scalable communication abstraction; their usefulness has of the most imp ortant networking proto cols, suchasIP b een well demonstrated by the success of IP, UDP, and [22 ], UDP [21 ], and RPC [6], make use of an underlying RPC. Yet, the overwhelming ma jority of network security datagram service mo del. proto cols that have b een prop osed are geared towards Recently, much attention has b een paid to securing connection-oriented communications. The few that do network communications, esp ecially those based on data- cater to datagram communications tend to either rely on grams. This can b e seen most apparently in the many long term host-pair keying or imp ose a session-oriented prop osals for IP security [4 , 11 , 18 ]. In addition, b oth (i.e., requiring connection setup) semantics. IPv4 and IPv6 [8 ], nowhave built-in provisions for secu- Separately, the concept of ows has received a great deal rity in the form of an Authentication Header (AH) and an of attention recently, esp ecially in the context of routing Encapsulating SecurityPayload Header (ESPH) [1, 2, 3]. and QoS. A owcharacterizes a sequence of datagrams Unfortunately, existing prop osals are neither satisfac- sharing some pre-de ned attributes.