Top Banner
Peer-to-Peer Secure Update for Heterogeneous Edge Devices E. Band, H. Herry, C. Perkins, J. Singer School of Computing Science University of Glasgow HeLP-DC, HiPEAC 2018 – University of Glasgow 1
35

Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

Oct 14, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

Peer-to-PeerSecureUpdateforHeterogeneousEdgeDevices

E.Band,H.Herry,C.Perkins,J.SingerSchoolofComputingScience

UniversityofGlasgow

HeLP-DC,HiPEAC2018– UniversityofGlasgow 1

Page 2: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

FRµIT:FederatedRaspberryPi µ-InfrastructureTestbed(www.fruit-testbed.org)• “Massiveaggregationoflow-cost,low-power,commodityinfrastructurecanformanefficientandeffectivecomputefabricforkeydistributedapplications”

• Applications:edge-compute,IoT,portabledata-center,expendable-compute

• FundedbyUK-EPSRC

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Traditional:fewbigdata-centersvs

FRµIT:manymicrodata-centers

2

Page 3: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

Problem:UpdatingRemoteSystem

• Updatesystemiscritical• Securitypatch• Deployfirmware,software,configurations

• Regularupdate• Limited(orno)physicalaccess

• Remotelocations• Mobile• Privateresidentiallocations

• Existingtools• RequiresdirectSSHaccess• Needswell-connectedserver

HeLP-DC,HiPEAC2018– UniversityofGlasgow 3

Page 4: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

Problem:UpdatingRemoteSystem

• HeterogeneousNetwork• SomenodesarebehindNATs(e.g.residential)orFirewalls(e.g.university)

• Single-pointoffailure• Scalability

• DenialofServiceattackonupdateserver• Linuxdistributions:dedicatedmirrorservers• Randomizeddownloadslot-times[Pollocket.al.]

HeLP-DC,HiPEAC2018– UniversityofGlasgow 4

Page 5: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

OurApproach

• DecentralizedmanagementframeworkusingPeer-to-Peeroverlaynetwork• Agossipprotocoltodistributesecuredupdatenotifications(torrent-file)

• STUN-basedUDPholepunchingtodiscoverandopenNATbindings(NAT-TM)

• BitTorrent tosecurelydistributeupdates(software,managementscripts,etc)

• Contribution:oursystemassumespartialnetworkconnectivity,andworksinthepresenceofNATsorfirewalls

HeLP-DC,HiPEAC2018– UniversityofGlasgow 5

Page 6: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

OurApproach

• Otheradvantages• Bandwidthsharing• Updatescanreachindirectlyconnectednodes• Resilienttosinglepointoffailureandattacks• Wemaynotneedadedicatedupdateserver

HeLP-DC,HiPEAC2018– UniversityofGlasgow 6

Page 7: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

Architecture

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Agent

NAT-TMBTClient(Trans-mission)

OS

P2PUpdateSystem

Puppet Chef

Deployer

Shell

7

NAT

STUNServer

Page 8: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

Torrent-file++

HeLP-DC,HiPEAC2018– UniversityofGlasgow

• Tracker/Nodes• File-name• File-length• Piece-length• Cryptographic-hashesoffilepieces• Targetresourceidentifier• Version• Digitalsignature

Torren

t-file

(Stand

ard)

Torren

t-file++

• Targetresourceidentifier• Distinguishdifferenttargetresources

• Version(monotonicallyincreasing)• Helpagenttoignoreoutdatedupdateexistinginthenetwork

• DigitalSignature• Adminholdsaprivate-key• Eachnodehasapublic-key• Signature=encrypt(sha512(torrent-file),private-key)

• sha512(torrent-file)=?decrypt(signature,public-key)

8

Page 9: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node2

Torrent-file++Update-fileNodeUpdated-Node

Walkthrough

9

IP1:Port1

Page 10: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node2

Torrent-file++Update-fileNodeUpdated-Node

10

IP1:Port1

Walkthrough

Page 11: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node2

Torrent-file++Update-fileNodeUpdated-Node

11

IP1:Port1

IP2:Port2Walkthrough

Page 12: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node2

Torrent-file++Update-fileNodeUpdated-Node

12

IP1:Port1

IP2:Port2Walkthrough

Page 13: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node2

Torrent-file++Update-fileNodeUpdated-Node

13

IP1:Port1

IP2:Port2Walkthrough

Page 14: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node2

Torrent-file++Update-fileNodeUpdated-Node

14

IP1:Port1

IP2:Port2Walkthrough

Page 15: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node3

Torrent-file++Update-fileNodeUpdated-Node

NAT

STUNServer

15

Node4 Node5

NAT

IP4:Port4

Walkthrough

Page 16: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node3

Torrent-file++Update-fileNodeUpdated-Node

NAT(EIP3:EPort3)

STUNServer

16

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

Node4 Node5

NAT(EIP4:EPort4)

IP4:Port4

Walkthrough

Page 17: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node3

Torrent-file++Update-fileNodeUpdated-Node

STUNServer

17

NAT(EIP3:EPort3)

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

Node4 Node5

NAT(EIP4:EPort4)

IP4:Port4 IP1:Port1EIP4:EPort4,IP4:Port4

IP1:Port1EIP3:EPort3,IP3:Port3

Walkthrough

Page 18: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node3

Torrent-file++Update-fileNodeUpdated-Node

STUNServer

18

NAT(EIP3:EPort3)

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

Node4 Node5

NAT(EIP4:EPort4)

IP4:Port4 IP1:Port1EIP4:EPort4,IP4:Port4

IP1:Port1EIP3:EPort3,IP3:Port3IP5:Port5

Walkthrough

Page 19: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node3

Torrent-file++Update-fileNodeUpdated-Node

STUNServer

19

NAT(EIP3:EPort3)

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

Node4 Node5

NAT(EIP4:EPort4)

IP4:Port4 IP1:Port1EIP4:EPort4,IP4:Port4

IP1:Port1EIP3:EPort3,IP3:Port3IP5:Port5

Walkthrough

Page 20: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node3

Torrent-file++Update-fileNodeUpdated-Node

STUNServer

20

NAT(EIP3:EPort3)

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

Node4 Node5

NAT(EIP4:EPort4)

IP4:Port4 IP1:Port1EIP4:EPort4,IP4:Port4

IP1:Port1EIP3:EPort3,IP3:Port3IP5:Port5

Walkthrough

Page 21: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node3

Torrent-file++Update-fileNodeUpdated-Node

STUNServer

21

NAT(EIP3:EPort3)

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

Node4 Node5

NAT(EIP4:EPort4)

IP4:Port4 IP1:Port1EIP4:EPort4,IP4:Port4

IP1:Port1EIP3:EPort3,IP3:Port3IP5:Port5

Walkthrough

Page 22: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node3

Torrent-file++Update-fileNodeUpdated-Node

STUNServer

22

NAT(EIP3:EPort3)

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

EIP3:EPort3,IP3:Port3EIP4:EPort4,IP4:Port4

Node4 Node5

NAT(EIP4:EPort4)

IP4:Port4 IP1:Port1EIP4:EPort4,IP4:Port4

IP1:Port1EIP3:EPort3,IP3:Port3IP5:Port5

Walkthrough

Page 23: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node6

STUNServer

Torrent-file++Update-fileNodeUpdated-Node

Firewall

23

Walkthrough

Page 24: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node6

STUNServer

Torrent-file++Update-fileNodeUpdated-Node

Firewall(EIP6:EPort6)(Adminmodifiestherules)

24

Walkthrough

Page 25: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node6

STUNServer

Torrent-file++Update-fileNodeUpdated-Node

25

EIP6:EPort6,IP6:Port6

Firewall(EIP6:EPort6)(Adminmodifiestherules)

Walkthrough

Page 26: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node6

STUNServer

Torrent-file++Update-fileNodeUpdated-Node

26

EIP6:EPort6,IP6:Port6

EIP6:EPort6,IP6:Port6

Firewall(EIP6:EPort6)(Adminmodifiestherules)

Walkthrough

Page 27: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node6

STUNServer

Torrent-file++Update-fileNodeUpdated-Node

27

EIP6:EPort6,IP6:Port6

EIP6:EPort6,IP6:Port6

IP1:Port1

Firewall(EIP6:EPort6)(Adminmodifiestherules)

Walkthrough

Page 28: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node6

STUNServer

Torrent-file++Update-fileNodeUpdated-Node

28

EIP6:EPort6,IP6:Port6

EIP6:EPort6,IP6:Port6

IP1:Port1

Firewall(EIP6:EPort6)(Adminmodifiestherules)

Walkthrough

Page 29: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node6

STUNServer

Torrent-file++Update-fileNodeUpdated-Node

29

EIP6:EPort6,IP6:Port6

EIP6:EPort6,IP6:Port6

IP1:Port1

Firewall(EIP6:EPort6)(Adminmodifiestherules)

Walkthrough

Page 30: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow

Node1

Node6

STUNServer

Torrent-file++Update-fileNodeUpdated-Node

30

EIP6:EPort6,IP6:Port6

EIP6:EPort6,IP6:Port6

IP1:Port1

Firewall(EIP6:EPort6)(Adminmodifiestherules)

Walkthrough

Page 31: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

PreliminaryExperiment

• 6 Raspberry-Pis 2/3• Residentialnetworks(HomeNAT)– Sky,BT• FirewallNetwork– SchoolofComputingScience(UniversityofGlasgow)• STUNServeronGoogleComputeEngineVM• Update:webserverwithstaticfiles

• Puppetmanifest,puppet-modules,softwarepackages,htmlfiles

• Result:successfulupdatesonall-nodes,includingbehindhomeNATsandfirewall

HeLP-DC,HiPEAC2018– UniversityofGlasgow 31

Page 32: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

Shortcomings

• NotworkwithallNATtypese.g.SymmetricNAT

HeLP-DC,HiPEAC2018– UniversityofGlasgow 32

Page 33: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

Conclusion&FutureWork

• Our(prototype)frameworkcanupdatesecurelythesystemwithpartialnetworkconnectivity,andworksinthepresenceofNATsorfirewalls• IntegratethisP2PsecureupdateframeworkintoFRµITTestbed• Large-scaleexperimentsonFRµITTestbed

HeLP-DC,HiPEAC2018– UniversityofGlasgow 33

Page 34: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

https://picycle.org

DoyouhaveanunusedRaspberryPiboardlockedawayinacupboard?Pleasedonateitforscientificresearch.

HeLP-DC,HiPEAC2018– UniversityofGlasgow 34

Page 35: Peer-to-Peer Secure Update for Heterogeneous Edge Devices€¦ · HeLP-DC, HiPEAC 2018 –University of Glasgow 31. Shortcomings •Not work with all NAT types e.g. Symmetric NAT

Thankyou!

HeLP-DC,HiPEAC2018– UniversityofGlasgow 35


Related Documents
5th International Conference , HiPEAC 2010

5th International Conference , HiPEAC 2010

Category: Documents
Rfc5128_State of Peer-To-Peer (P2P) Communication Across NAT

Rfc5128_State of Peer-To-Peer (P2P) Communication Across NAT

Category: Documents
Scalability, Portability, and Numerical Stability in Many-core …impact.crhc.illinois.edu/Shared/PR/HiPEAC-Keynote-Hwu-1... · 2013. 1. 21. · hipeac 2013 There are some existing

Scalability, Portability, and Numerical Stability in...

Category: Documents
Vigor2920 WAN FTTx 32 VPN ' IPSec 40Mbps 3.5G , … · DHCP over IPSec NAT- (NAT-T) Dead Peer Detection CDPD) VPN Dra Tek DHCP IGMP DNS RADIUS DNS UPnP LAN • RIPV2 USB • 3.5G

Vigor2920 WAN FTTx 32 VPN ' IPSec 40Mbps 3.5G , … · DHCP...

Category: Documents
info24 · HiPEAC News Message from the HiPEAC Coordinator Dear friends, I hope all of you have enjoyed relaxing summer holidays and that you are ready to tackle the challenges of

info24 · HiPEAC News Message from the HiPEAC Coordinator.....

Category: Documents
EMC2 workshop @HIPEAC 2017 Agenda · EMC2 workshop @HIPEAC 2017 – Agenda; cont’d. 24.01.2017 Page 3 ARTEMIS 2013 AIPP5 EMC² ... Prototype of Embedded Linux and AUTOSAR running

EMC2 workshop @HIPEAC 2017 Agenda · EMC2 workshop @HIPEAC....

Category: Documents
Firewall and NAT Traversal for Peer-to-Peer Storage Nodes

Firewall and NAT Traversal for Peer-to-Peer Storage Nodes

Category: Documents
2016-01-19-HiPEAC-SMLA-Splitusers.ece.cmu.edu/~omutlu/pub/...3d-stacked-memory_ghose_hipea… · Title: Microsoft PowerPoint - 2016-01-19-HiPEAC-SMLA-Split Author: Saugata Created

2016-01-19-HiPEAC-SMLA-Splitusers.ece.cmu.edu/~omutlu/pub/.....

Category: Documents
Intraplex IP LinkWorks in peer to peer and proxy mode NAT traversal support Redundancy Automatic failover mode between Primary, Secondary and Backup streams Backup Audio Source USB

Intraplex IP LinkWorks in peer to peer and proxy mode NAT...

Category: Documents
HiPEAC/Sundance Internship Report

HiPEAC/Sundance Internship Report

Category: Documents
Application analysis for parallelization on multi-core devicesOct 16, 2012  · HiPEAC Computing Systems, Ghent, Belgium Oct 16, 2012 . 2 | Oct 16, 2012 HiPEAC Computing Systems week

Application analysis for parallelization on multi-core...

Category: Documents
Peer-to-Peer Networks - uni-freiburg.dearchive.cone.informatik.uni-freiburg.de/teaching/... · Dan Kegel (1999), NAT and Peer-to-Peer Networking, Technical Report Caltech A does not

Peer-to-Peer Networks -...

Category: Documents