Implementation of Data Path Credentials for High-Performance Capabilities-Based Networks

• Main Author: Vasudevan, Kamlesh T
• Format: Others
• Published: ScholarWorks@UMass Amherst 2009
• Subjects: Network Security; capability; deny-by-default; Data Path security; Systems design; Computer and Systems Architecture; Computer Engineering; Digital Communications and Networking; Other Computer Engineering
• Online Access: https://scholarworks.umass.edu/theses/323; https://scholarworks.umass.edu/cgi/viewcontent.cgi?article=1405&context=theses

Capabilities-based networks present a fundamental shift in the security design of network architectures. Instead of permitting the transmission of packets from any source to any destination, routers deny forwarding by default. For a successful transmission, packets need to positively identify themselves and their permissions to the router. A major challenge for a high performance implementation of such a network is an efficient design of the credentials that are carried in the packet and the verification procedure on the router. A network protocol that implements data path credentials based on Bloom filters is presented in this thesis. Our prototype implementation shows that there is some connection setup cost associated with this type of secure communication. However, once a connection is established, the throughput performance of a capabilities-based connection is similar to that of conventional TCP.