MPLS, GMPLS et NGN. Sécurité MPLS. Jacques BAUDRON ixtel octobre 2009 Ingénierie Conseils Services Télécommunications

Transcription

1 MPLS, GMPLS et NGN Sécurité MPLS Jacques BAUDRON ixtel octobre

2 Contents Treats Requirements VPN Attacks & defence

3 3 Threats

4 Threats Denial of service Resources unavailable to user Smurf DoS from a broadcast server TCP - Sync / Flooding Client server -> message Syn -> server system - > message SYN-ACK -> Client Serveur -> message ACK -> server systeml... 4

5 Threats Intrusion User not authorized to access to resources Label spoofing False label inserting MPLS security has to be as efficient as Layer 2 ATM 5

6 Threats DDoS (Distributed Denial of Service) 2000 : Attacks of commercial sites 2008: DDoS for DNS 6

7 Threats New context Distributed Use of network means to increase nuisance Network itself is attack s target 7

8 Requirements 8

9 Integrity Authentication Confidentiality Acces control Replay 9

10 User point of view Two different points of view: Data are protected Example: DDoS (Distributed Denial of service) Network operator point of view Infrastructure is protected For the operator: the problem is solved at the moment where the source equipment is found For the user: its equipment has been used behind his back and he is now deconnected. 10

11 Security Requirements of MPLS Networks Reference: Frame Relay and ATM Any VPN must be able to use the same address space as the MPLS core and or any other VPN MPLS core is not visible from the outside word (as ATM) Internal addressing, network structure 11

12 Main protagonists: Administrative domain (operator) Autonomous system Can be an Access Provider User 12

13 Chiffrement Niveau 7 Niveau 4 Niveau 3 Niveau 2 SSH SSL IPsec Secure SHell Confidentialité, authentification, authorisation Secure Socket Layer Chiffrage des données Chiffrement PPP, WEP 13

14 14 VPN

15 VPN Ability to Maintain Existing Network Addressing Plans No configuration change to servers Data and Routing Separation Between VPNs Each VPN is assigned to a Virtual Routing and Forwarding (VRF) instance 15

16 VPN Enterprise CPEbased VPNs Layers 4-7 Session -based (SSL) Provider Provisioned Dedicated VPN appliance Web server & s/w agents Source Burton Group ( d après Nortel) Enterprise CPEbased VPNs CPE-based VPNs Provider Provisioned RFC2547 (MPLS/BGP) Virtual Router Dedicated VPN appliance Technology Firewall with VPN add-on Check Point -based appliance VPN Router L3 routing Network-based Ethernet VPN's (leveraging MPLS) MPLS (point to point) Optical Ethernet L2 switching ATM/FR VPN's ATM Frame Relay 16

17 Address space and routing separation VPN-IPv4 address Distinct VPNs can use the same address space Each VPN has its own VRF (Virtual Routing & Forwarding) instance VPN unique address 64 bits 32 bits 17

18 Each VPN has its own plane Virtual Routing and Forwarding VPN1 VPN2 VPN3 VPN4 No interaction between different VPN 18

19 19 Attacks & defence

20 Attacks of the core network Attacks Attacks Attacks Attacks An IP address has to be known 20

21 Where from are the attacks? The point: knowing IP address 21

22 Core network No specific information on the hosts Information is about the routes 22

23 Core network addressing structure is hidden 23

24 Address knowledge Routing Static Dynamic CE need to know at least PE address From the CE No IP address from the core network known by CE From the PE CE need to know at least PE address => use of security mechanisms as ACL (Access Control Lists) 24

25 PE (Provider Edge) attack DoS (Denial Of Service) ACE (Access Control List) CE to PE interface is the most obvious point for attack 25

26 Shared connection from CE to PE 26

27 Label spoofing 27

28 IPsec & MPLS MPLS and ATM provide similar protection User has to trust the netwok Provider If not user can use IPSec Authentication of both endpoints Protocol authentication Replay detection Integrity of the traffic 28

29 Limits of MLS security It is assumed that internal attacks from core network is not feasible There is no misconfiguration Equipment easy to configure Trained and experimented staff Security behaviour for core network Access control, physical security, management security 29

30 Today mains attacks Layer 3 or higher Against applications 30

31 Thanks for your attention! 31