“Research and Development on IP packet traceback technology”
National Institute of Information and Communications Technology(NICT) sponsored

ISP field test planof IP packet traceback prior experiments in 2008
・Summary
・Network Environment
・Management system
・Legal issues
・Experiment summary
Ken.Wakasa
1
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Summary： Purpose• The preparations for demonstration experiment in 2009
– Collect information necessary for demonstration experiment• Data, problems, know-how to be collected with a long-timeconsecutive operation• Set up real machine at ISP environment• Data, problems, know-how to be collected at ISP field trial– Investigate risks from the information collected and formulate
measures to realize the demonstration experiment.
• Review outstanding issues• Define any function to be added or corrected

2Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Summary： Schedule
IP packet traceback R&D project* A research project offered by NICT(*), started 2005 by the Consortium of six parties* Goal of the project is Demonstration Experiment of IP packet traceback(CY)200520062007

2008

2009

Consortium (five other parties)

Research and development：Telecom iSAC Japan
Experiment preparations：
Investigation / examination / document making

ISP field test
From October to December

The investigation of ISP’s consciousness / concern / demand on IP packet traceback

Demonstration Experiment
From July to December

Positive responses,anticipations…

Legal investigation #1
Investigate laws related to the temporary model systemand operational model(*) NOTE: NICT stands for
National Institute of Information and Communications Technology.

Legal investigation #2
Legally investigate field test system and its test scenario
3Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Summery：Outline of Traceback system
1. Store suspicious information.
Whenever IDS notify suspicious attacks, TB manager calculate the attack PKT’s HASH, andautomatically recursive analyze it’s AS map with neighbor AS’s TB manager, and store it to TB-DB.
TB Contral Center
TB-DB
Real attack path
(AS map)

2. Detect the real attack path
After an incident be recognized, TBOperator analyze TB-DB by attack PKT’s
HASH, and detect the real attack path.
TB ManagerIDS

ProveIncident

ISP(a)

ISP(b)

Real attack

ISP(c)
Attack fromspoofed IP addresses

0. Store HASH data temporary.
Each probe convert PKT to HASH, and store own cache automatically.
4
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Summary： Prior Experiments• Closed network test
– Use machines at Data Center (closed network environment)– Collect data with consecutive long-term operation– Verify operations and functions, not available at ISP
field test because of the legal issues• ISP field test
– Integrating machines at Data Center and ISP site
networking “The Internet”– Verify primitive act and operations

5
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Summary： Project formation
Project R&D parties (other five parties)
Contract

ISPs participated in this field test

NICTOther suppliers

Contract

Responsible forexperiments

Contract

Contract

Contract

Nippon Information Communication Association
Traceback Working Group

Traceback Project Management center
Demonstration experiment PJT* Experiment participated ISP-Team* Experiment preparations Team* Experiment Team

6
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Network : overview
Simulated attack, Real attack

The Internet
ISP-1

Exclusive network forparticipated ISPs

ISP-4ISP-3

ISP-2

ISP-5

Virtual Private Network
Test network
Management center＜Data Center＞

Test support network
R&D party

Operationunit

Exclusive network
for R&D and test
operating parties

R&D party

7
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Network： ISP network configuration
Virtual Private Network

The Internet
VPN switch

Laptop-PC(Win.XP)

L2-SW

Probe
MirrorProbe

MirrorProbe

Tap

TB process server

1U-Servers Linux

Test network

Simulated attackserver

ISP
Network

5U～7U

8Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Management system： Documents• Operation policy• Operation basic regulations– Safety measures rule, Information system management / instruction manual,
media handling manuals– TB Management center operative unit criteria of selection (testfacilities/operation）•Operation procedure book– Setting/removal manuals, Operation manual, Simulation test manual, Incident
test manual•

Testing unit organizing regulations– Working Group/TB Management center administration rule, preparations /implementation / Participated ISP-team administration rule,••

Contract model
Test plan (for prior experiment / demonstration experiment)– Scenario•

Risk analysis– Questionnaires, list of information system, management, countermeasures•

Criteria of selection on ISPs (field test participants)
9Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Legal issues：ISP field test scopez Prepare for three years and confirm it in a permissible range.
9 2005： Investigation on laws - domestic
9 2006： Investigation on laws - global
9 2007： Brush up prior experiment plans

Investigation on laws related tothe temporary model systemand operational model• Experiment in network resembles real ISP environment• Closed test (in lab)
Issues not to be solved with the current laws
Issues to be solved with the current laws
Issues raised
ISP field test
Available for implementation
10Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

ISP field test - outline 1. Setting
2. Verification on system•

Automatic operation

simulated attack / real attack

3. Verification on operative plans for attacks––

Simulated attack•

Verification on operation against attacks along the scenario•

Verification on operation against attacks without the scenario

Real attack (passive)•Verification on operation against attacks along the operation manual•

Verification on operation against attacks beyond (above assumption)
the operation manual

4. Removal
11Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

１．Setting１）Pre-adjustment, Contract conclusion
Participation contract
for field test

Application
for ISP service

ISP field test plan２）System integration
ISP：Probe accessTrace Back：Machine setting,Operational check

Provide traffic to each probe½ rack rental + VPN
Test machine operation

Test machine List３）Operative explanation
From TB consortium to ISP
From ISP to TB consortium

Daily report

Report forincidents

12Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

２．Verification on system （Automatic operation）
The Internet

Participation contract
for field test１）Attack detection

Mirrorsimulatedattack server

ISPNetworkother ISP
TB system

Simulated attack between simulated attack servers
Not decided :Specific attack to the simulated attack server .
Specific attack to the specific server

Prove２）Attack source tracing

Detection
ControlCommunication

Ask attack source to other TB system referringhash value of attack IP packet ID.
Record source attack AS map by DB.

Test network

３）Operation verification

VPN network

ISP：Confirm and send test logs
TB consortium：Verify test logs

Trace Back Management Center

DB HashAS map
Time stamp13
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

３．Simulated attack scenario•

Leader： TB management center

•

Roles
– Assailant：Sender of simulated attack （TB management center）– Victim：Owner of the server that simulated attack took place （TB management center）– Damaged ISP：ISP which has the server that simulated attack took place– TB management center : Administration group of TB system.
– Attack ISP：ISP which has the server that sends simulated attack– Pass-through ISP：ISP that simulated attack passes through (no role）– Participated ISP：All ISP participants on this field test•

Story– Scenario to continuous simulated attacks consecutive 2 to 3 hours.
– TB management center prepares Server for attack, reputation trust Server and handles
simulated attack enforcement, the collection of simulated attack packets.
– In response to request from victim, damaged ISP / TB management center / attack ISP
cope and handle the incident.

14
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

４．Removal１）Conclusion (verification)
Third party interviews ISPs that the field test is
carried out adequately
Daily report

Report forincidents

２）Data elimination
Eliminate all data created at the test３）Removal of machines
Test machine list

15
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

More difficult issues piled up ...
• Operative issue– The operative management that it is easy to introduce,
Security of the reliability.
– Cost, cost-benefit performance• Technical issue– High speed, high-precision tracing– New technology besides packet capture, tap, mirror?
– How the application traceback will work out……
– Who confirms an incident, who starts traceback?
– Hash retention time?

• Legal issue– Lots of issues piled up…
16
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.