Traversal of the customer edge with NAT-unfriendly protocols

Leppaaho, Petri; Beijar, Nicklas; Kantola, Raimo; Santos, Jesús Llorente

doi:10.1109/icc.2013.6654988

Cited by 5 publications

(5 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Towards that end, we propose a cloud‐based firewall, namely, CES that would make the hosts cooperative in nature. It follows the firewalling model of mobile broadband networks, where mobile hosts are behind a network‐based firewall.…”

Section: Implementing Internet‐wide Trust Managementmentioning

confidence: 99%

“…The adoption of CES does not require changes to end hosts. To this end, a customer edge switch can be complemented with a realm gateway (RG), which allows dynamic and unilateral initiation of communication by legacy Internet hosts to the servers located in the private networks. The behavior of CES for outbound connections to legacy hosts is the same as NAT.…”

Section: Implementing Internet‐wide Trust Managementmentioning

confidence: 99%

“…To outline the feasibility of cooperation among Internet networks, the paper briefly describes the implementation of our solution particularly in 5G. The overall 2-tier security solution proposes: (1) a network-based firewall (Customer Edge Switching [CES] [17][18][19][20][21][22][23][24] ) that addresses inherent Internet vulnerabilities and security at the level of interaction between customer networks and (2) an Internet-wide evidence collection, aggregation, and reputation system. This paper concerns with the latter, i.e.…”

mentioning

confidence: 99%

See 2 more Smart Citations

Cooperation and end‐to‐end in the Internet

Kantola

Kabir

Loiseau

2017

Int J Communication

Self Cite

View full text Add to dashboard Cite

Summary This paper analyzes the motivation and strategies for ensuring cooperative behavior among hosts and customer networks in the Internet and 5G networks. The hypothesis is that better cooperation among the benevolent entities could improve the overall Internet welfare, motivating the need for adoption of cooperative security. However, in state of the art, the prevalent security approach in the Internet is based on self‐help, while the adoption of cooperative methods is progressing slowly. At the same time, the ubiquitous reliance on 5G and mission critical nature of some of the new services, for example, ultrareliable (machine‐to‐machine) communication and Internet of things, requires that 5G will do its best to curb the malicious (noncooperative) behavior from becoming a cause of failure to the legitimate services. In this paper, we relate our analysis of the conditions for sustainable cooperation in the Internet with the famous end‐to‐end principle, and present the hypothesis that there is no end‐to‐end solution to the problem of ensuring cooperation among Internet hosts. Game theory allows studying the outcomes of interactions among the players with conflicting interests. We use it to study the hypothesis and show that introducing the reputation of Internet nodes and customer networks can lead to cooperation, which improves the overall Internet welfare and reduces the payoffs of malicious actors. We study the possible response of noncooperative users with advanced defection strategies and the resulting outcomes. We argue that 5G shall make significant progress towards uprooting the selfish behavior and malicious activities using cooperation and relate it with motivation for providing ubiquitous connectivity and ultrareliable services. The paper concludes by summarizing our earlier work on the application of the proposed methods of cooperation to 5G and the Internet; outlining how cooperation in security is not only desirable but also feasible.

show abstract

Section: Implementing Internet‐wide Trust Managementmentioning

confidence: 99%

Section: Implementing Internet‐wide Trust Managementmentioning

confidence: 99%

mentioning

confidence: 99%

See 1 more Smart Citation

Cooperation and end‐to‐end in the Internet

Kantola

Kabir

Loiseau

2017

Int J Communication

Self Cite

View full text Add to dashboard Cite

show abstract

“…These issues are commonly related to the use of IP address literals as well as split connections for signaling and data. In , we studied the impact of NAT‐unfriendly protocols on CES communication and provide design guidelines to build application layer gateways.…”

Section: The Architecture Of Customer Edge Switchingmentioning

confidence: 99%

Policy-based communications for 5G mobile with customer edge switching

Kantola

Santos

Beijar

2015

Security Comm. Networks

Self Cite

View full text Add to dashboard Cite

Besides more capacity and faster connections, 5G is expected to provide ultra-reliable services, for example, for machineto-machine communications. In this paper, we advocate that 5G must do its best to eliminate malicious traffic as a cause of failure of legitimate services. This paper proposes that all communications in 5G should be controlled by policy. The policies facilitate cooperation of customer networks against misbehaving actors and collecting evidence of malicious activity. Dynamic policies can react to hosts that are used in attacks. We propose a system controlled by policy that overcomes the classical weaknesses in the Internet, namely source address spoofing and denial of service attacks. We propose to improve the mobile device experience by new methods of network address translator traversal suitable for battery-powered mobile devices. We believe that 5G will be the major driver for the future Internet, which is why we relate our approach to other proposals for future Internet architecture. Our approach can be deployed one network at a time as it limits the changes to edge nodes; no compulsory changes are proposed to hosts. The paper reports the experience from experimentation and evaluates scalability and security including initial results on performance.

show abstract

“…They can be also enabled at the CES-or at the host-level. Depending on how the policy is built, CES can act differently for each packet it inspects [14].…”

Section: Introductionmentioning

confidence: 99%

Improving Security of Future Networks Using Enhanced Customer Edge Switching and Risk-Based Analysis

Nowaczewski

Mazurczyk

2021

Electronics

View full text Add to dashboard Cite

Customer Edge Switching (CES) is an extension of the already known classical firewall that is often described and used in future networks like 5G. It extends its functionality by enabling information exchange with other firewalls to decide whether the inspected network traffic should be considered malicious or legitimate. In this paper, we show how the Passive DNS can be used to further improve security of this solution. First, we discuss CES solution and its internals. We also determine how it uses DNS and CETP protocols. Secondly, we describe the basics of the Passive DNS and how it impacts the DNS protocol. Thirdly, we evaluate how the Passive DNS can be extended to collect also CETP information. Finally, we integrate the solutions and present obtained experimental results.

show abstract

Traversal of the customer edge with NAT-unfriendly protocols

Cited by 5 publications

References 20 publications

Cooperation and end‐to‐end in the Internet

Cooperation and end‐to‐end in the Internet

Policy-based communications for 5G mobile with customer edge switching

Improving Security of Future Networks Using Enhanced Customer Edge Switching and Risk-Based Analysis

Contact Info

Product

Resources

About