| Title | TARN: A SDN-based traffic analysis resistant network architecture |
| Publication Type | Conference Paper |
| Year of Publication | 2017 |
| Authors | Yu, L., Wang, Q., Barrineau, G., Oakley, J., Brooks, R. R., Wang, K. C. |
| Conference Name | 2017 12th International Conference on Malicious and Unwanted Software (MALWARE) |
| Keywords | business model, computer network security, customer-driven network services, customizable trustable end-to-end network services, destination IP prefix, destination networks, distributed software defined Internet exchange, DNS/IP filtering, end-to-end communication session, end-to-end network services, Hidden Markov models, intended destination AS's prefix, Internet, Internet autonomous systems, Internet routing, IP addressing freedom, IP networks, IP prefixes, IPv4, IPv6, large-scale traffic analysis resistant network support, network communications, Open vSwitches, Peer-to-peer computing, PEERING BGP testbed, pseudorandom IP addresses, pubcrawl, Resiliency, Routing, Routing protocols, Scalability, SDN, SDN security, SDX solution, Software, software defined networking, TARN, telecommunication traffic, traffic analysis resistant network architecture, YouTube |
| Abstract | Destination IP prefix-based routing protocols are core to Internet routing today. Internet autonomous systems (AS) possess fixed IP prefixes, while packets carry the intended destination AS's prefix in their headers, in clear text. As a result, network communications can be easily identified using IP addresses and become targets of a wide variety of attacks, such as DNS/IP filtering, distributed Denial-of-Service (DDoS) attacks, man-in-the-middle (MITM) attacks, etc. In this work, we explore an alternative network architecture that fundamentally removes such vulnerabilities by disassociating the relationship between IP prefixes and destination networks, and by allowing any end-to-end communication session to have dynamic, short-lived, and pseudo-random IP addresses drawn from a range of IP prefixes rather than one. The concept is seemingly impossible to realize in todays Internet. We demonstrate how this is doable today with three different strategies using software defined networking (SDN), and how this can be done at scale to transform the Internet addressing and routing paradigms with the novel concept of a distributed software defined Internet exchange (SDX). The solution works with both IPv4 and IPv6, whereas the latter provides higher degrees of IP addressing freedom. Prototypes based on Open vSwitches (OVS) have been implemented for experimentation across the PEERING BGP testbed. The SDX solution not only provides a technically sustainable pathway towards large-scale traffic analysis resistant network (TARN) support, it also unveils a new business model for customer-driven, customizable and trustable end-to-end network services. |
| DOI | 10.1109/MALWARE.2017.8323961 |
| Citation Key | yu_tarn:_2017 |
TARN: A SDN-based traffic analysis resistant network architecture