Distributed Automatic Configuration of Complex IPsec-Infrastructures

Rossberg, Michael; Schaefer, Guenter; Strufe, Thorsten

doi:10.1007/s10922-010-9168-7

Cited by 15 publications

(8 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In particular, at least for structures like CAN, Chord, Kademlia, Butterfly graphs, and entangled networks such partitions can easily be ruled out. Also, our VPN system [1] does not construct such partitions and therefore a synchronization can be guaranteed.…”

Section: Proofmentioning

confidence: 99%

See 1 more Smart Citation

Attack-Resistant Distributed Time Synchronization for Virtual Private Networks

Rossberg

Golembewski

Schaefer

2012

2012 21st International Conference on Computer Communications and Networks (ICCCN)

Self Cite

View full text Add to dashboard Cite

Abstract-To securely exchange data over public networks, such as the Internet, organizations often utilize Virtual Private Networks (VPNs). However, relying on these potentially large overlay networks makes them vital targets for Denial-ofService (DoS) attacks. Thus, recent approaches for VPN autoconfiguration address DoS resistance by employing distributed management algorithms. Nevertheless, there is no satisfying solution for time synchronization within VPNs that is designed for resistance against DoS as well as internal attacks. For example, Network Time Protocol (NTP) relies on hierarchical structures, and cannot comply with DoS resistance. Thus, in this article we present a novel, fully distributed and fault tolerant time synchronization approach, which is designed to be transparently integrated in VPN gateways. Combining diffusion-based roundtrip-synchronization with an internal attacker detection, the proposed mechanism is making a contribution to resilient VPN design. Simulation results reveal a robustness against rather powerful internal attackers.

show abstract

Section: Proofmentioning

confidence: 99%

“…Thus, VPNs can now be optimized with respect to the previously unaddressed DoS resistance. A fully automated system for a distributed VPN configuration is described in [1]. The approach proposes that all VPN gateways communicate via a peer-to-peer overlay structure with proactively established connections to scale with the number of nodes.…”

Section: Introductionmentioning

confidence: 99%

Attack-Resistant Distributed Time Synchronization for Virtual Private Networks

Rossberg

Golembewski

Schaefer

2012

2012 21st International Conference on Computer Communications and Networks (ICCCN)

Self Cite

View full text Add to dashboard Cite

show abstract

“…In structured overlay networks, just like the VPN auto-configuration system in [18], this typically means that every node has about O(log n) possible mediators to choose from, where n denotes the size of the overlay.…”

Section: Scalable Construction Of Backup Pathsmentioning

confidence: 99%

“…A possible mitigation path is the usage of dynamically reconfiguring VPN approaches [18] that are able to repair associations in the case of DoS attacks, i.e., by allowing administrators to quickly relocate affected systems to different IP address ranges or redirecting traffic over different parts of the network. Furthermore, the unsuccessful attacks of the hacker group "Anonymous" on the Amazon compute centers [13] showed that conventional DoS attacks can be coped with, if precautions are taken.…”

Section: Introductionmentioning

confidence: 99%

Automatic creation of VPN backup paths for improved resilience against BGP-attackers

Grey

Rossberg

Schaefer

2012

Proceedings of the 27th Annual ACM Symposium on Applied Computing

Self Cite

View full text Add to dashboard Cite

Virtual private networks (VPNs) play an integral role in corporate and governmental communication systems nowadays. As such they are by definition an exposed target for attacks on the availability of whole communication infrastructures. A comparably effective way to disturb VPNs is the announcement of the involved IP address ranges by compromised BGP routers. Since in the foreseeable future criminals may focus on such attacks, this article discusses the intelligent creation of backup paths in the context of VPNs as a countermeasure. The proposed system is evaluated in simulations as well as in a prototypic environment.

show abstract

“…In contrast, Secure OverLay for IPsec Discovery (SOLID) [3] employs a self-maintaining VPN with distinct mechanisms for discovery, routing, and topology control. Especially the latter is important as the setup of VPN tunnels is rather resource-and time-intensive (several seconds per tunnel if smartcards are used).…”

mentioning

confidence: 99%