Implementing and Evaluating IOAM Integrity Protection

Iurman, Justin; Donnet, Benoît

doi:10.1145/3673422.3674886

Download

Paper published in a book (Scientific congresses and symposiums)

Implementing and Evaluating IOAM Integrity Protection

Iurman, Justin; Donnet, Benoît

2024 • In Applied Networking Research Workshop (ANRW)

Peer reviewed Dataset

Permalink
https://hdl.handle.net/2268/319952

DOI
10.1145/3673422.3674886

Files (1)Send to Details Statistics Bibliography Similar publications

Files

Full Text

paper.pdf

Author preprint (895.41 kB)

Download

All documents in ORBi are protected by a user license.

Send to

RIS BibTex APA Chicago Permalink X Linkedin

Details

Keywords :

IOAM; IPv6; integrity; validation; threats

Abstract :

[en] In-Situ Operations, Administration, and Maintenance (IOAM) gathers telemetry and operational information along a path, within packets. Up to now, IOAM header and data are carried in plain text without any protection against data-altering nodes or middleboxes. However, deploying IOAM in an untrusted or semi-trusted environment requires at least integrity protection. This paper leverages and analyzes work in progress about \ioam integrity protection and explains why the currently proposed solution can be improved. Accordingly, several alternative solutions are discussed, implemented in the Linux kernel, and evaluated. Based on the results, guidance is provided for standardization. Our source code is publicly available.

Disciplines :

Computer science

Author, co-author :

Iurman, Justin ; Université de Liège - ULiège > Montefiore Institute of Electrical Engineering and Computer Science

Donnet, Benoît ; Université de Liège - ULiège > Département d'électricité, électronique et informatique (Institut Montefiore) > Algorithmique des grands systèmes

Language :

English

Title :

Implementing and Evaluating IOAM Integrity Protection

Publication date :

July 2024

Event name :

Applied Networking Research Workshop (ANRW)

Event date :

23 Juillet 2024

Audience :

International

Main work title :

Applied Networking Research Workshop (ANRW)

Publisher :

ACM

Peer reviewed :

Peer reviewed

Name of the research project :

CyberExcellence project funded by the Walloon Region, under number 2110186

Funders :

Walloon region

Funding number :

2110186; This work is supported by the CyberExcellence project funded by the Walloon Region, under number 2110186.

Data Set :

Source code

Available on ORBi :

since 23 June 2024

Statistics

Number of views

27 (0 by ULiège)

Number of downloads

45 (4 by ULiège)

More statistics

Scopus citations^®

Scopus citations^®
without self-citations

OpenCitations

OpenAlex citations

Bibliography

J.-P. Aumasson and D. J. Bernstein. 2012. SipHash: A Fast Short-Input PRF. In Proc. International Conference on Cryptology in India (INFOCRYPT).
F. Brockners, S. Bhandari, and T. Mizrahi. 2022. Data Fields for In Situ Operations, Administrations, and Maintenance (Ioam). RFC 9197. Internet Engineering Task Force.
F. Brockners, S. Bhandari, T. Mizrahi, S. Dara, and S. Youell. 2020. Proof of Transit. Internet Draft (Work in Progress) draft-ietf-sfc-proof-oftransit-08. Internet Engineering Task Force.
F. Brockners, S. Bhandari, T. Mizrahi, and J. Iurman. 2024. Integrity of In-Situ Oam Data Fields. Internet Draft (Work in Progress) draft-ietfippm-ioam-data-integrity-08. Internet Engineering Task Force.
B. Carpenter and S. Jiang. 2013. Transmission and Processing of IPv6 Extension Headers. RFC 7045. Internet Engineering Task Force.
Cisco. [n. d.]. TRex: Realistic Traffic Generator. https://trex-tgn.cisco. com [Last Accessed: February 28th, 2024].
S. Deering and R. Hinden. 2017. Internet Protocol, Version 6 (IPv6) Specification. RFC 8200. Internet Engineering Task Force.
M. Dworking. 2007. Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC. Special Publication 800-38D. National Institute of Standards and Technology.
S. Even and Y. Mansour. 1997. A Construction of a Cipher from a Single Pseudo-Random Permutation. Journal of Cryptology 10, 3 (1997), 151–161.
G. Fioccola, A. Capello, M. Cociglio, L. Castaldelli, M. G. Chen, L. Zheng, G. Mirsky, and T. Mizrahi. 2018. Alternate-Marking Method for Passive and Hybrid Performance Monitoring. RFC 8321. Internet Engineering Task Force.
Internet Assigned Numbers Authority (IANA). [n. d.]. IOAM - Option-Type registry. https://www.iana.org/assignments/ioam/ioam.xhtml# option-type [Last Accessed: April 09th, 2024].
J. Iurman. [n. d.]. IPv6 IOAM: Linux Kernel implementation. https://github.com/Advanced-Observability/ioam-linux-kernel [Last Accessed: June 7th, 2024].
J. Iurman, B. Donnet, and F. Brockners. 2020. Implementation of IPv6 IOAM in Linux Kernel. In Proc. Technical Conference on Linux Networking (Netdev 0x14).
D. Katz and D. Ward. 2010. Bidirectional Forwarding Detection (BFD). RFC 5880. Internet Engineering Task Force.
C. Kim, A. Sivaraman, N. Katta, A. Bas, A. Dixit, and L. J. Wobker. 2015. In-Band Network Telemetry via Programmable Dataplanes. In In Proc. ACM SIGCOMM Conference Posters and Demos.
D. Kong, Z. Zhou, Y. Shen, X. Chen, Q. Cheng, D. Zhang, and C. Wu. 2023. In-Band Network Telemetry Manipulation Attacks and Countermeasures in Programmable Networks. In Proc. IEEE/ACM International Symposium on Quality of Service (IWQoS).
D. McGrew and J. Viega. 2006. The Use of Galois Message Authentication Code (GMAC) in IPsec ESP and AH. RFC 4543. Internet Engineering Task Force.
T. Mizrahi, N. Sprecher, E. Bellagamba, and Y. Weingarten. 2014. An Overview of Operations, Administration, and Maintenance (OAM) Tools. RFC 7276. Internet Engineering Task Force.
T. Pan, E. Song, Z. Bian, X. Lin, X. Peng, J. Zhang, T. Huang, B. Liu, and Y. Liu. 2019. INT-Path: Towards Optimal Path Planning for In-Band Network-Wide Telemetry. In Proc. IEEE INFOCOM.
X. Pan, S. Tang, S. Liu, J. Long, X. Zhang, D. Hu, J. Qi, and Z. Zhu. 2020. Privacy-Preserving Multilayer In-Band Network Telemetry and Data Analytics: For Safety, Please do Not Report Plaintext Data. Journal of Lightwave Technology 38, 21 (November 2020), 5855–5866.
Scapy Community. [n. d.]. Scapy. https://scapy.net [Last Accessed: April 20th, 2024].
H. Song, B. Gafni, F. Brockners, S. Bhandari, and T. Mizrahi. 2022. In-Situ Operations, Administration, and Maintenance (Ioam) Direct Exporting. RFC 9326. Internet Engineering Task Force.
L. Tan, W. Su, W. Zhang, J. Lv, Z. Zhang, J. Miao, X. Liu, and N Li. 2021. In-Band Telemetry: A Survey. Computer Networks 186 (February 2021).
R. Wang, Z. Wang, D. Wang, and Y. Liu. 2021. In-Band Network Telemetry Based Fine-Grained Traceability Against IP Address Spooling Attack. In Proc. ACM Conference on Intelligent Computing and Its Emerging Applications (ICEA).
M. Yu. 2019. Network Telemetry: Towards a Top-Down Approach. ACM SIGCOMM Computer Communication Review 49, 1 (January 2019), 11–17.
Y. Zhao, G. Cheng, and Y. Tang. 2023. SINT: Toward a Blockchain-Based Secure In-Band Network Telemetry Architecture. IEEE Transactions on Information Forensics and Security 18 (April 2023), 2667–2682.