Secure Multicast Control Plane

Multicast data transmission is a technology for distributing a single copy of (user data) packets to multiple destinations. Essentially, a distribution tree is built by the network routers, and the outgoing packets are duplicated at the branch points in the tree. The receiving host makes a request to "join" the tree, and the routers along the tree between the source and the receiver(s) exchange messages to establish this distribution tree. If a rogue router can insert itself into this distribution tree, then legitimate customers may be cut off (i.e., unable to receive what they are entitled to), or private information may be captured by the rogue router. The solution to this problem is to arrange for secure communication among the (legitimate) routers.

Standard Internet Protocol Security (IPsec) was designed for peer-to-peer (unicast) connections. It is used to establish a Security Association (SA) between two communicating peers. The key(s) used for this SA are negotiated between the two peers as they are needed. To establish multicast routing, all of the one-hop inter-router messages for multicast tree construction and maintenance are sent from a router to all of its neighbors simultaneously (using multicast!), and so are likely to have more than one listener. In this case, standard IPsec key management is not suitable. However, for the specific case of manual keying (i.e., pre-established keys), standard IPsec supports the use of a multicast destination address in the SA entry.

Recent standards activity has resulted in certain extensions to IPsec that enable a group SA. This provides the possibility of automating the key management, but that is (probably) not within the scope of the COMP 490/492 project. (See below.)

Using an open source implementation of a multicast router, called XORP, on a set of Linux-based computers, and configuring standard IPsec SAs between these "soft" routers, a demonstration has been made this summer of secure communication among the (soft) routers.

The goal of the proposed COMP 490/492 project is to extend this demonstration to a network based on commercial routers (Cisco 2811 ISR), and to a mixed network with both XORP routers and Cisco routers. I have all the necessary hardware: processors, switches, routers, etc., in my lab.

The initial list of steps for the project is:

1) Read the documentation provided by the summer project.

2) Understand the present setup, based on XORP routers.

3) Duplicate the summer experiments, and demonstrate that it works with video as well.

4) Set up the Cisco routers, and demonstrate that the same results can be achieved.

5) Set up a "hybrid" configuration to show interoperability of XORP and Cisco routers.

6) Document the work done.

Depending on how long it takes to complete the above steps, we can discuss the ways in which this can be extended to use automated key assignment. (This is a significantly larger problem.)