We present a virtualization-based Web server system, a prototype, and experimental results for providing uninterrupted Web services in the presence of intrusion attacks and software faults. The proposed system utilizes replicated virtual servers managed by a closed-loop feedback controller. Using anomaly and intrusion sensor outputs, the controller calculates cost-weighted actions against threats to ensure Web service continuity. We will show that the system can handle broad classes of attacks. Experiment results show that our prototype retains 60% of its peak throughput under 8 DoS attacks per second over extended periods.

The formidable difficulty in securing systems stems in large part from the increasing complexity of the systems we build but also the degree to which we now depend on information systems. Complex systems cannot be fully verified under all possible conditions. Self cleansing intrusion tolerance (SCIT) servers go through periodic cleaning. SCIT can be used to create secure and robust cluster of servers without the impossible requirement of having perfect security on each server in the cluster. In this paper, we identify six SCIT security primitives that must be satisfied. We present a SCIT hardware enhanced (SCIT/HES) implementation that guarantees the incorruptibility of SCIT operations

Domain name systems (DNS) provide the mapping between easily-remembered host names and their IP addresses. Popular DNS implementations however contain vulnerabilities that are exploited by frequent, targeted attacks. The software vulnerabilities of DNS together with the constant innovation and morphing of cyber attack techniques necessitate the consideration of the worst case scenarios: there will be successful but undetected attacks against DNS servers. In this work, we develop a secure DNS architecture that contains the damage of successful, undetected attacks. This formidable end is achieved by constantly cleansing the servers and rotating the role of individual servers. Moreover, the server rotation process itself is protected against corruption by hardware. We will show the advantages of our design in the following areas: (1) protection of the DNS master file and cryptographic keys, (2) incorruptible intrusion tolerance, (3) high availability, and (4) scalability, the support of using of high degrees of hardware/server redundancy to improve both system security and service dependability. Due to the critical importance of DNS, such a dependable and intrusion-resilient design contributes significantly to the overall security of the Internet.

Despite the increased focus on security, critical information systems remain vulnerable to cyber attacks. The problem stems in large part from the constant innovation and evolution of attack techniques. The trend leads importance to the concept of intrusion tolerance a critical system must fend off or at least limit the damage caused by unknown and/or undetected attacks. In prior work, we developed a self-cleansing intrusion tolerance (SCIT) architecture that achieves the above goal by constantly cleansing the servers and rotating the rule of individual servers. In this paper, we show that, with simple hardware enhancements strategically placed in a SCIT system, incorruptible intrusion containment can be realized. We then present an incorruptible SCIT design for use by one of the most critical infrastructures of the Internet, the domain name services. It is our belief that incorruptible intrusion containment as presented here constitutes a new, effective layer of system defense for critical information system

In this paper, we present a high-bandwidth flow identification algorithm, called HIFI, which is designed for use by routers to identify high-bandwidth flows. Rather than maintaining the bandwidth usage states of all flows, HIFI is able to identify K highest-bandwidth flows, where K /spl ges/ 1 is a constant, using O(K) space and incurring only O(1) per sample processing overheads. We show that HIFI can be used in conjunction with well-established flow testing criteria to curb improperly behaving flows in the Internet. Applications of HIFI include identifying high-bandwidth multimedia streams that do not respond to congestion and mitigating the effects of flooding denial-of-service attacks. Our simulation shows that HIFI performs the above tasks with high accuracy and low overheads.

Internet applications use rate control algorithms, such as the additive-increase/multiplicative-decrease (AIMD) mechanism of the TCP protocol, to adjust transmission rates. An important design factor of rate control algorithms is the tradeoff between responsiveness and smoothness. In general, responding aggressively to changes in network conditions causes wide fluctuations in sending rates. In this paper, we address this tradeoff and develop an adaptive AIMD (ADAIMD) model that adjusts AIMD parameters dynamically. When the network condition is stable, an ADAIMD flow changes its sending rate in small steps to avoid rate fluctuations. When the network condition is changing significantly, the flow adjusts the additive and multiplicative coefficients of AIMD to accelerate rate changes. We will show that these goals can be achieved by applying the additive increase and multiplicative decrease rules to the additive coefficient of AIMD. Our simulation studies show that ADAIMD produces near constant bit rate (CBR), TCP-friendly flows with good responsiveness. Such a rate-control model forms the foundation of realtime transport protocols that provide exceedingly smooth streaming services to Internet multimedia applications.

Internet applications use rate control algorithms, such as the additive-increase/multiplicative-decrease (AIMD) mechanism of TCP, to adjust transmission rates dynamically. Previous analytical work of rate control algorithms mainly focuses on steady state behaviors, for instance, the steady state throughput. The goal of this paper is to analyze the General AIMD (GAIMD) rate control during transition periods, when traffic flows increase or decrease sending rates in response to changes in network conditions. We present mathematic characterizations of GAIMD flows in transition periods, verify our analytic results by simulation, and investigate the change responsiveness of GAIMD flows using our model. The results of this study show that our model is accurate unless under extremely adverse conditions. Moreover, such adverse conditions exist only for very short periods of time, and thus the errors of the proposed model are likely insignificant. Our results also reveal that previous estimation methods of change responsiveness consistently underestimate the lengths of transition periods. This research advances the understanding of how Internet traffic reacts to changes in network conditions. Such knowledge in turn are expected to help make informed design decisions of rate control algorithms.

The Java Cryptography Architecture, JCA in short, was created to allow JCA-compliant cryptography providers to be plugged into a JCA-aware application at run time. This configurable feature makes JCA widely used and assures its success. However, the public key cryptographic service interfaces defined by JCA are based on the conventional public key cryptography, which is a single-sender-single-receiver model, and does not accommodate the group-based public key cryptography well. Especially, it does not support the threshold cryptography (TC), an important type of group-based public key cryptography, which has been shown to be a useful tool to enhance system security. As a step towards the systematic application of group-based public key cryptography, this article proposes an extension to the JCA framework to integrate threshold cryptography. Under this extension, various TC providers implementing different TC primitives can be plugged into a security application at run-time. This extension also makes it easy for a existing JCA-aware application to be migrated to use threshold cryptography. An example provider of threshold RSA is implemented under this framework extension. It is our belief that such an extension would help speed up the adoption of threshold cryptography.

Denial-of-service (DoS) attacks have received a great amount of attention in research communities and general public alike, due to recent, high-profile attacks against major Internet e-commerce sites. We present a countermeasure against such attacks, called the congestion-triggered packet sampling/packet filtering (CTPS/PF) architecture. With CTPS/PF, a packet sampling mechanism that is integrated with the congestion control mechanism at routers is used to detect DoS attacks, and packet filters are activated only when sampling results warrant action. One important concern in deploying any form of traffic analysis in the critical data-forwarding paths of the Internet is performance. Our sample processing algorithm takes into account the confidence indicators of statistic results to raise alarms with relatively small numbers of samples. Moreover, the per-sample processing complexity is only O(1). Our simulation study reveals that the CTPS/PF architecture is able to detect the presence of DoS attacks and take proper action within hundreds of milliseconds to tens of seconds. Moreover, the average sampling overhead during a congestion period is in the vicinity of 1 sample per second.

Domain Name System (DNS) is the system for the mapping between easily memorizable host names and their IP addresses. Due to its criticality, security extensions to DNS have been proposed in an Internet Engineering Task Force (IETF) working group to provide authentication. We point out two difficulties in the current DNSSEC (DNS Security Extension) standards in the handling of DNS dynamic updates: the online storage of a zone security key, creating a single point of attack for both inside and outside attackers; and the violation of the role separation principle, which in the context of DNSSEC separates the roles of zone security managers from DNS server administrators. To address these issues, we propose a secure DNS architecture that is based on threshold cryptography. We show that the architecture adheres to the role separation principle without presenting any single point of attack. Our experimental results reveal that, in terms of signature computation times, our architecture incurs negligible performance penalty when using RSA/MD5 signatures but significant overhead when using DSA signatures. It is our belief that the high level of security that can be achieved by the proposed architecture far outweighs its potential overhead, especially in critical DNS zones, such as the .com zone.

A core-based forwarding multicast protocol uses a core router as a traffic transit center: All multicast packets are first sent to the core, then distributed to destinations on a multicast tree rooted at the core. The purpose of this paper was to evaluate, via simulation, the effect of various core selection methods on multicast performance. Performance metrics of interest include network resource usage, packet delay, the join time of multicast participants, and link congestion. In addition, we assess the feasibility of these heuristics in real-world environments. The main contribution of this work is the discovery of a simple yet effective core selection heuristic that can be implemented in a wide variety of networks. Specifically, our results show that the tree center heuristic (using the center of the existing multicast tree as the new core node) significantly outperforms heuristics based on random selection and performs as well as other heuristics that are computationally more expensive. © 2000 John Wiley & Sons, Inc.

Traditionally, link-state routing (LSR) uses two costly techniques to achieve its robustness and responsiveness: message forwarding on every communication link in the broadcast of network status updates, and the periodic broadcast of local status by every router. In this paper, we present a novel LSR protocol, called tree-based LSR (T-LSR), which reduces the operational overhead of LSR as follows. A leader router is elected to periodically broadcast network status on behalf of all the other routers in the network, and a spanning tree is constructed to support these broadcasts. The T-LSR protocol distinguishes itself from previous tree-based, lightweight LSR methods by its fault-tolerance features: the T-LSR protocol is shown to maintain consistent routing information and leader preferences throughout the network in the presence of undetected transmission/information corruption problems. The results of a simulation study demonstrate that the T-LSR protocol imposes a small fraction of the overhead of conventional LSR.

We propose solutions to several multicast core management problems, including automatic core selection, core failure handling, and core migration, for use in networks based on link-state routing. The proposed approach uses a central server, called the core binding server (CBS), to manage core-group bindings, accompanied by a network-level leader election protocol in order to achieve robustness. By modeling the selection of the CBS as a leader election problem, this approach can handle any combination of network component failures, including those that partition the network. Further, our simulation results reveal that the central server can sustain extremely high workloads, and demonstrate the effectiveness of our core selection and core migration methods.

A core-based forwarding multicast protocol uses a core router as a traffic transit center: all multicast packets are first sent to the core, then distributed to destinations on a multicast tree rooted at the core. The purpose of this paper is to evaluate, via simulation, the effect of various core selection methods on multicast performance. The main contribution of this work is the discovery of a simple yet effective core selection heuristic that can be implemented in a wide range of networks. Specifically, our results show that the tree center heuristic (using the center of the existing multicast tree as the new core node) significantly outperforms heuristics based on random selection, and performs as well as heuristics that are more computationally expensive.

In this work, we place the problem of group leader election in a context "inside the network," meaning that participants in the election process are network switches/routers, rather than hosts. A robust solution to the problem, called the Network Leader Election (NLE) protocol, is proposed for use in networks based on link-state routing (LSR). The protocol is robust, for it achieves leadership consensus in the presence of adverse events, such as leader failures and network partitioning. The correctness of the protocol can be proved formally. A simulation study reveals that the NLE protocol incurs low overhead in handling leader failures and in group creation. In addition, it is shown how important network functions, including hierarchical routing, address resolution, and multicast core management, can benefit from the NLE protocol.

In this paper, we propose a flooding method, called switch-aided flooding (SAF), for use in ATM networks. SAF-based protocols take advantage of hardware-supported cell relay and cell duplication, characteristic of such networks, in order to reduce the time needed to disseminate changes in network topology and resource availability. SAF protocols use a spanning multipoint connection (SMC), which is a hardware-switched network spanning tree, but revert to conventional link-by-link flooding when the spanning MC is unavailable or under construction. The results of a simulation study reveal that the proposed flooding protocols deliver network updates several times faster than conventional approaches, while using significantly less bandwidth.

A centralized protocol, C-GMC, is proposed for the construction and maintenance of multipoint connections (MCs). The operation of the protocol is independent of the MC topology algorithm, which is rendered a "plug-in" module. The C-GMC protocol is targeted at networks based on link state routing and uses the concept of a per-MC server. The problems of server election and migration are modeled as consensus problems in distributed systems, and an efficient solution is proposed. Results of a simulation study show that the C-GMC protocol is able to efficiently handle worst case workloads generated by multiparty communication sessions with thousands of participants.

We propose a protocol for the construction and maintenance of multipoint connections (MCs). The protocol is based on link-state routing: information regarding multipoint connections is broadcast to network switches, which perform all computations locally. The protocol is generic in that it can be used with MCs of different types, including symmetric MCs, receiver-only MCs, and asymmetric MCs. Results of a simulation study show that this generality can be achieved with negligible (in normal traffic periods) to moderate (in very busy periods) signaling overhead.

This paper presents the results of an investigation of collective communication operations for distributed computing across asynchronous transfer mode (ATM) networks. Several collective operations have been implemented and studied on a three-switch ATM network testbed at Michigan State University. The methods use virtual topologies constructed from ATM virtual channels. A particular type of virtual topology is described that efficiently implements several collective operations through the use of hardware-supported ATM multicast channels. Performance measurements are presented that illustrate how a thread-based software design can take advantage of such underlying hardware features.

This paper defines and describes the properties of a multicast virtual topology, the M-array and a resource-efficient variation, the REM-array. It is shown how several collective operations can be implemented efficiently using these virtual topologies, while maintaining low complexity. Because the methods are applicable to any parallel computing environment that supports multicast communication in hardware, they provide a framework for collective communication libraries that are portable and yet take advantage of such low-level hardware functionality. In particular, the paper describes the practical issues of using these methods in wormhole-routed massively parallel computers (MPCs) and in workstation clusters connected by Asynchronous Transfer Mode (ATM) networks. Performance results are given for both environments.