A flow-based approach to datagram security

Abstract

Datagram services provide a simple, flexible, robust, and scalable communication abstraction; their usefulness has been well demonstrated by the success of IP, UDP, and RPC. Yet, the overwhelming majority of network security protocols that have been proposed are geared towards connection-oriented communications.The few that do cater to datagram communications tend to either rely on long term host-pair keying or impose a session-oriented (Le., requiring connection setup) semantics. Separately, the concept of flows has received a great deal of attention recently, especially in the context of routing and &OS. A flow characterizes a sequence of datagrams sharing some pre-defined attributes.In this paper, we advocate the use of flows as a basis for structuring secure datagram communications.We support thii by proposing a novel protocol for datagram security based on flows. Our protocol achieves zero-message keying, thus preserving the connectionless nature of datagram, and makes use of soft state, thus providing the per-packet processing efficiency of session-oriented schemes. We have implemented an instantiation for IP in the 4.4BSD kernel, and we provide a description of our implementation along with performance results.

Digital signatures for flows and multicasts

“…1 Most investigations on securing data delivery over packet networks have focused on unicast delivery of data sent as independent packets. Exceptions include recent papers on scalable secure multicasting [1,13,20] and a flowbased approach to datagram security [14]. All of these papers are mainly concerned with data confidentiality.…”

A scalable scheme for multilevel packet authentication in secure multicasting

“…The crux of this idea is to use flows as the basis for signatures. A flow can be defined as a sequence of datagrams satisfying some pre-defined attributes [18]. A flow is neither a datagram nor a connection-based method; instead, it combines the best of both ideas.…”

“…It will be appended to the signature packet for receivers to know which signatures to use for verification, and inside the signature to verify the ID tag has not been modified. Figures 17,18, and 19 compared the eFFS method with this modified MeFFS method for the same networks of 25, 100, and 250 nodes as the above figures. As can be seen in the figures, this modified method is more efficient than the eFFS method in many experiments.…”