Subject: Re: [ipfix-req] security considerations - resend

From: [email-masked]
Date: Tue, 11 Jun 2002 11:26:59 -0400

Tanja Zseby wrote:
> 
> Hi Benoit,
> 
> here comes the new security considerations section. I integrated
> comments from Sebastian and Carter.
> 
> Regards
> Tanja
> 
> 9. Security considerations
> 
> The future IPFIX protocol must be capable to transport data over the
> public Internet. Therefore it cannot be excluded that an attacker
> captures or modifies exchanged packets or inserts additional packets.
> This document describes requirements for IP Flow Information Export
> (IPFIX). It therefore also states the required security features for a
> future IPFIX protocol. Like other requirements, the security
> requirements differ for the considered applications. The incentive to
> modify collected data for accounting or intrusion detection for instance
> is usually higher than the incentive to change data collected for
> traffic profiling. Therefore the required security features in this
> document are listed per application in the appendix.
> The suggestion of concrete solutions for achieving the required security
> properties will be part of the IPFIX architecture and protocol
> description and is out of scope of this document. Furthermore, methods
> for remote configuration of the IPFIX processes are out of scope for
> IPFIX. Therefore, threads that are caused by data exchange for remote
> configuration are not considered here.
> 
> The following potential security hazards for an IPFIX protocol can be
> identified:
> 
> - Disclosure of IP flow information data
> The content of data exchanged by the IPFIX protocol (e.g. IPFIX flow
> records) should be kept confidential between the involved parties
> (exporting process and colleting process). Observation of IPFIX flow
> records gives an attacker information about the active flows in the
> network, communication endpoints and traffic patterns. This information
> cannot only be used to spy out user behavior but also to plan and
> conceal future attacks. Therefore the requirements document recommends
> to ensure the confidentiality of the transferred data. This can be
> achieved for instance by encryption.
> 
> - Forgery of IPFIX flow records
> Because of the potential uses of IPFIX flow records in accounting and
> security applications, there are strong incentives to forge exported
> IPFIX  flow records (e.g. to save money or prevent the detection of an
> attack). This can be done either by altering flow records on the path or
> by injecting forged flow records that pretend to be originated by the
> original exporting process. In order to make the IPFIX protocol
> resistant against such attacks this document requires to ensure
> authenticity and integrity for the IPFIX data transfer.
> Special caution is required if security applications rely on IPFIX data.
> With forged flow records it is possible to trick on security
> applications. It is for instance possible to pretend that a DoS attack
> happens without even launching a real attack.
> 
> - Denial of Service (DoS) attacks
> DoS attacks on routers or other middleboxes that have the IPFIX protocol
> implemented would also affect the IPFIX protocol and impair the sending
> of IPFIX records. Nevertheless, since such hazards are not induced
> specifically by the IPFIX protocol the prevention of such attacks is out
> of scope of this document.
> Nevertheless IPFIX itself also causes potential hazards for DoS attacks.
> All processes that expect the reception of traffic can be target of a
> DoS attack. With the IPFIX exporting process this is only the case if it
> supports the pull mode (which can be an optional feature of the future
> IPFIX protocol according to this document). The collecting process
> always expects data and therefore can be flooded by forged flow records.
> 
> --
> Dipl.-Ing. Tanja Zseby
> FhI FOKUS/Global Networking                     Email: [email-masked]
> Kaiserin-Augusta-Allee 31                               Phone: +49-30-3463-7153
> D-10589 Berlin, Germany                         Fax:   +49-30-3463-8153
> --------------------------------------------------------------------------------------
> "Living on earth is expensive but it includes a free trip around the sun." (Anonymous)
> --------------------------------------------------------------------------------------
> 
> --
> Help        mailto:[email-masked] and say "help" in message body
> Unsubscribe mailto:[email-masked] and say
> "unsubscribe ipfix" in message body
> Archive     http://ipfix.doit.wisc.edu/archive/

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/