Naming and Security in a Mobile, Multihomed and Multiple Interfaces Environement Daniel Migault
Total Page：16
File Type：pdf, Size：1020Kb
Naming and security in a mobile, multihomed and multiple interfaces environement Daniel Migault To cite this version: Daniel Migault. Naming and security in a mobile, multihomed and multiple interfaces environement. Architecture, space management. Institut National des Télécommunications, 2012. English. NNT : 2012TELE0033. tel-01016686 HAL Id: tel-01016686 https://tel.archives-ouvertes.fr/tel-01016686 Submitted on 1 Jul 2014 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. I99 59 5h/hw! /hbWhLb 9[9/ha 5t!wL [bL9wL9 tL9ww9 9 a!wL9 /wL9 L !"# 9 $ L Ç 9 t t % 5 a&# t# ' & $ $ 5h/9w 59 Ç9[9/ha {5t!wL b!!& {# $% # ( ! a') a#*! + L % a#% ## ,- !' ,./, $( 0# 1 !% $ 5 # $ *2% a 1 [# t %%# ! #$ t % w # % !'$!$0$ .#'$* t %%# Ü( % Ç*&"# $ /!2& !$ 4# ( t %%# Ü( % $ h## 95!# % 4#1 t#0 t %%# Ü( % t a /# * . 6!1 !%% C 8% # b!!& L / b$ .#9*! t %%# t %* Thèse n° 2012TELE0033 Ref : 2012TELE0033 Télécom Sud Paris / Université Pierre et Marie Curie École Doctorale - EDITE Naming and Security in a Mobile, Multihomed and Multiple Interfaces Environement by Daniel Migault Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy at Télécom Sud Paris September 26, 2012 Supervised by Maryline Laurent, Professor at Institut Mines-telecom Certified by Andrei Gurtov, Professor at l’Université de Oulu Abdelmadjid Bouabdallah, Professor at Université Technologique de Compiègne Guy Pujolle, Professor at Pierre et Marie Curie Stéphane Bortzmeyer, Association Française pour le Nommage Internet Coopératif Nadia Boukhatem, Professor at Paristech Contents Summaries 1 EnglishSummary..................................... ... 1 FrenchSummary ...................................... .. 2 Acknowledgments 5 Introduction 7 HowtodeployaSecureNamingService . ....... 8 ContextDescription .................................. 8 OrganizationoftheMaterial . .... 9 How to provide a Seamless Network Security . ......... 10 ContextDescription .................................. 10 OrganizationoftheMaterial . .... 12 I Providing Secure Naming Resolution 15 Introduction 17 DescriptionoftheWork ............................... ..... 17 Notations&Abbreviations . ...... 19 1 A Performance view on DNSSEC migration 21 1.1 Introduction..................................... ... 21 1.2 DNSSECCurrentStatus.............................. ... 22 1.2.1 DNSSECBriefDescription . ... 22 1.2.2 DNSSECDeployment .............................. 23 i CONTENTS 1.2.3 DNSSECImpactsontheNetwork . 24 1.2.4 ISPPositionforMigratingtoDNSSEC . .... 25 1.3 RelatedWork..................................... .. 26 1.4 TestingPlatform ................................. .... 27 1.4.1 TestingEnvironment. ... 27 1.4.2 TestingTools .................................. 28 1.4.3 TestingMethodology. ... 28 1.5 Experimental Work to Measure DNSSEC Impact on Servers and EndUsers . 29 1.5.1 ImpactofDNSSEConUnitaryTests. ... 29 1.5.2 ImpactofDNSSEConMaximumLoad . 29 1.5.3 Impact of DNSSEC on Network Latency & Response Time . .... 30 1.5.4 ImpactofDNSSEConDNSUpdateOperations . ... 31 1.5.5 ImpactofCacheHitRate ............................ 32 1.6 Application for ISPs: Estimation of Costs for Migrating fromDNStoDNSSEC . 34 1.7 Conclusion ....................................... 35 2 Overcoming DNSSEC Performance Issues with FQDN Load Balancer and Cache Sharing 37 2.1 Introduction..................................... ... 37 2.2 FQDNorIPsasLoadBalancerCriteria . ..... 40 2.2.1 Measured DNS(SEC) CPU R and CPU H ................... 41 2.3 PositionofourWork............................... .... 42 2.3.1 DNSTrafficAnalysis.............................. 43 2.3.2 DNSCacheOptimization . 43 2.3.3 DNSResolutionOptimization. ..... 44 2.3.4 DNSserviceoverDHToverlay . ... 45 2.3.5 AlternateNamingArchitecture . ...... 45 2.3.6 ActiveCachingforDHTarchitectures . ...... 46 2.4 Traffic-basedLoadBalancerSimulation . ......... 47 2.4.1 CacheHitRate(CHR)Simulation . .. 48 2.4.2 CPU Time Simulation : CPU R, CPU H .................... 49 2.4.3 ScalabilitySimulation . ..... 50 2.4.4 ConclusiononLoadBalancer . ... 51 2.5 Modelization of Pastry based Architectures . ............ 52 2.5.1 Single Node Model: τr .............................. 53 ii CONTENTS 2.5.2 IPSHA1 Architecture............................... 55 2.5.3 FQDN Architecture ............................... 55 2.5.4 Pastry-based architecture (no cache, no replication) . ... 57 2.5.5 Pastry-Stateless Forwarding (Pastry-SF): (no cache, no replication) . 59 2.5.6 Pastry-Active Caching (Pastry-AC)(noreplication) . 59 2.5.7 Pastry-Passive Caching (Pastry-PC):(cache,noreplication) . 60 2.5.8 Pastry-Replication (Pastry-R):(nocache,replication) . 61 2.6 ConfigurationforSimulation . ...... 61 2.7 Simulation of Pastry Based Architectures . ........... 62 2.7.1 γ, Neighbors ................................... 63 2.7.2 CPU &Scalability................................ 65 CPU R 2.7.3 CPU & CPU H .................................. 66 2.7.4 Evaluation of TTL impact over CPU ..................... 67 2.7.5 CPU & Query Rate ............................... 67 2.8 DNSSECMigration ................................. .. 68 2.8.1 AnalysisonCPUTime ............................. 68 2.8.2 AnalysisonResponseTime(RT) . .. 70 2.9 Conclusion ....................................... 72 3 PREFETCH Architecture to overcome DNSSEC Performance Issue in large Resolving Platforms 75 3.1 Introduction..................................... ... 75 3.2 RelatedWork..................................... .. 76 3.3 PREFETCHArchitecture: GoalsandDesign . ...... 77 3.3.1 Better load balancing and smaller cache for reducing CPU.......... 77 3.3.2 Pastry auto-configuration to reduce Operations, Administration and Main- tenance ...................................... 78 3.3.3 P REF ET CHX ArchitectureDefinition . 78 3.4 Deriving X, HEADX , T AILX fromlivecapturetraffic . 80 3.4.1 LoadBalancerAnalysis . ... 80 3.4.2 Defining X for a proper δCP UX ........................ 82 3.4.3 δCP UX timestability .............................. 83 3.4.4 T AILX Distribution............................... 84 3.4.5 Discussion.................................... 84 3.5 Executing DHT models with T AILX .......................... 85 3.6 FreePastryExperimentation . ....... 88 iii CONTENTS 3.7 Conclusion ....................................... 89 II Providing Seamless Security for Multiple Interfaces 91 Introduction 93 DescriptionoftheWork ............................... ..... 93 Notations&Abbreviations . ...... 96 4 Issues and Protocols Relative to Simultaneous Support of Security, Mobility, Multihoming and Multiple Interfaces 99 4.1 Introduction..................................... ... 99 4.1.1 Mobility, Multihoming and Multiple Interfaces Definition .......... 100 4.1.2 SCTPforMobilitySupport . 100 4.2 IPsecOverview .................................... 102 4.3 IPsecDatabases ................................... 103 4.3.1 SecurityPolicyDatabase . .... 103 4.3.2 SecurityAssociationDatabase . ...... 105 4.3.3 PeerAuthorizationDatabase . ..... 106 4.4 Mobility Multihoming and Multiple Interfaces impacts onIPsec........... 106 4.4.1 InitialConfigurationattheMN. ... 106 4.4.2 Mobility...................................... 108 4.4.3 Multihoming ................................... 109 4.4.4 MultipleInterfaces . ... 109 4.5 IKEv2........................................... 112 4.5.1 CREATE_CHILD_SAOperation . 112 4.5.2 DELETEOperation ............................... 114 4.6 MOBIKE ......................................... 114 4.6.1 HardHandoverMobility. ... 115 4.6.2 Multihoming ................................... 116 4.7 MOBIKE-X........................................ 117 4.7.1 UseCases..................................... 117 4.7.2 ProblemStatement.............................. 119 4.7.3 ProtocolDesign................................ 120 4.7.4 ProtocolDescription . .... 121 5 IPsec Cost Measurement in Mobile, Multihomed and Multiple Interfaces Envi- iv CONTENTS ronment 129 5.1 Introduction..................................... ... 129 5.2 TestingPlatform ................................. .... 131 5.3 SCTPMobilityMultihomingwithIPsec . ..... 132 5.3.1 GeneralInput/OutputGraphs . 133 5.3.2 Measured Time Definition: TSCT P , TIKE, TSY S and TST ALLED ...... 133 5.3.3 TIKE Analysis .................................. 134 5.3.4 TSCT P Analysis.................................. 135 5.3.5 TSY S Analysis .................................. 135 5.3.6 TST ALLED Analysis ............................... 136 5.4 MOBIKEMobilityMultihoming . .... 136 5.5 MOBIKE-XMobilityMultihoming . ..... 138 5.6 Conclusion ....................................... 140 6 MOBIKE-X & Offload 143 6.1 Introduction..................................... ... 143 6.2 OffloadEconomics .................................. 144 6.2.1 IncreasingDemandforMobileData . .... 144 6.2.2 Offloading traffic to WLAN: the only viable solution for ISPs ........ 144 6.2.3 OffloadComplexEnvironment . 146 6.2.4 CurrentOffloadDeployments . 146 6.3 Offload Service Architecture (OSA) vs Offload Access Architecture(OAA) . 147 6.3.1