Can MPTCP secure Internet communications from man-in-the-middle attacks?

Abstract

Multipath communications at the Internet scale have been a myth for a long time, with no actual protocol being deployed so that multiple paths could be taken by a same connection on the way towards an Internet destination. Recently, the Multipath Transport Control Protocol (MPTCP) extension was standardized and is undergoing a quick adoption in many use-cases, from mobile to fixed access networks, from data-centers to core networks. Among its major benefits -i.e., reliability thanks to backup path rerouting; throughput increase thanks to link aggregation; and confidentiality thanks to harder capacity to intercept a full connection -the latter has attracted lower attention. How interesting would it be using MPTCP to exploit multiple Internet-scale paths hence decreasing the probability of man-in-the-middle (MITM) attacks is a question to which we try to answer. By analyzing the Autonomous System (AS) level graph, we identify which countries and regions show a higher level of robustness against MITM AS-level attacks, for example due to core cable tapping or route hijacking practices.

Can Multipath TCP be Robust to Cyber Attacks With Incomplete Information?

“…Jadin et al [41] designed a secure MPTCP variant by closely integrating authentication and encryption inside the MPTCP protocol. Nguyen et al [42] investigated the Autonomous System (AS)-level Man-in-the-Middle (MITM) attacks acting at the robustness of MPTCP communications, reported which countries and regions had a high-level of robustness against the MITM attacks by studying the AS level graph, and provided a countermeasure in preventing MPTCP from the AS-level MITM attacks when concurrently using multiple Internet-scale paths for multipath communications. Munir et al [43] first reported the potential security vulnerabilities in MPTCP due to crosspath interactions among MPTCP subflows, caused by two typical attacks: connection hijack attacks and directed traffic diversion attacks, and then proposed the corresponding countermeasure proposal to guarantee MPTCP to be no less secure than TCP under the two typical attacks.…”

MPTCP robustness against large-scale man-in-the-middle attacks

“…In [36], cryptography based solutions are proposed against eavesdropping. The authors in [6] [43], we attempt to provide a response to such questions.…”

Escalonador de Pacotes para Transmissão por Multi-caminhos Não-Correlacionados em Redes Heterogêneas sem Fio

“…Neste caso, o caminho de ida (P ij ) e o de volta (P ji ) podem ser assimétricos, sendo i e j um endereço IP de N s e N d , respectivamente. Contudo, as regras de roteamento não impedem que os caminhos de uma mesma conexão MPTCP compartilhem um ou mais enlaces na rede [Nguyen et al 2017]. Conforme ilustra a Figura 1, os nós de origem N s e de destino N d possuem dois endereços IP cada.…”

“…O projeto desse escalonador segue a premissa de que os caminhos possuem uma alta diversidade, ou seja, não compartilham enlaces. Porém, isto nãoé válido em redes reais, como a Internet, em que as regras de roteamento tradicionais guiam os pacotes de um fluxo TCP por uma mesma rota [Nguyen et al 2017]. Como o MPTCP utiliza sub-fluxos TCP, as regras de roteamento os consideram como fluxos TCP distintos, podendo ser transmitidos por caminhos compartilhados.…”