Tomoya Inoue

GINTATE: Scalable and Extensible Deep Packet Inspection System for Encrypted Network Traffic: Session Resumption in Transport Layer Security Communication Considered Harmful to DPI

Deep packet inspection (DPI) is a basic monitoring technology, which realizes network traffic control based on application payload. The technology is used to prevent threats (e.g., intrusion detection systems, firewalls) and extract information (e.g., content filtering systems). Moreover, transport layer security (TLS) monitoring is required because of the increasing use of the TLS protocol, particularly by hypertext transfer protocol secure (HTTPS). TLS monitoring is different from TCP monitoring in two aspects. First, monitoring systems cannot inspect the content in TLS communication, which is encrypted. Second, TLS communication is a session unit composed of one or more TCP connections. In enterprise networks, dedicated TLS proxies are deployed to perform TLS monitoring. However, the proxies cannot be used when monitored devices are unable to use a custom certificate. Additionally, these networks contain problems of scale and complexity that affect the monitoring. Therefore, the DPI processing using another method requires high-speed processing and various protocol analyses across TCP connections in TLS monitoring. However, it is difficult to realize both simultaneously. We propose GINTATE, which decrypts TLS communication using shared keys and monitors the results. GINTATE is a scalable architecture that uses distributed computing and considers relational sessions across multiple TCP connections in TLS communication. Additionally, GINTATE achieves DPI processing by adding an extensible analysis module. By comparing GINTATE against other systems, we show that it can perform DPI processing by managing relational sessions via distributed computing and that it is scalable.

Emulation-Based ICT System Resiliency Verification for Disaster Situations

Disaster situations require resilient ICT systems in order to provide as good as possible communication conditions in such catastrophic circumstances. The resiliency verification of ICT systems is however difficult, because reproducing large-scale disaster conditions in production networks is impossible without affecting their users. In this paper we present an emulation-based approach for evaluating the resiliency of ICT systems in disaster situations. This is achieved by reproducing disaster-like conditions in a emulated environment running on a large-scale test bed on which actual network protocols and applications are executed in real time. The experimental results presented in the paper demonstrate how the effects of both the emulated disasters and those of the recovery technologies we subsequently deploy can be quantified objectively. This methodology can be used to improve the resilience of the systems under test.

NETorium: high-fidelity scalable wireless network emulator

Wireless networks take advantage of various technologies that wired networks do not use, such as authentication and ad hoc networks. Although it is important to verify such wireless network technologies, it is expensive or technologically difficult to repeatedly reproduce the wireless environments required for verification. Additionally, large-scale wireless network environments such as IoT environments are also required for verification of wireless technologies. However, conventional verification approaches cannot provide large-scale wireless network environments that, emulate radio propagation or verify actual wireless technologies and applications. We propose NETorium, which provides large-scale wireless network environments that are suitable for verification of wireless network technologies. NETorium comprises Meteor, a radio propagation emulator, and Asteroid, a virtual wireless network software for building virtual wireless network environments that employ hardware emulators in a wired network. Meteor can handle network protocols that, conventional radio propagation emulators cannot and is capable of emulating radio propagation in large-scale wireless network environments. Asteroid constructs virtual wireless networks that can transmit actual wireless frames. We demonstrate that NETorium can handle 1000-node wireless networks; conventional approaches can only handle a maximum of 100 nodes. Additionally, a performance evaluation of a simulated network with WPA2 authentication in the ad hoc mode demonstrates that NETorium can emulate large-scale wireless network environments with high-fidelity.

DynamiQ: A Tool for Dynamic Emulation of Networks

Interactive network experiments, in which experiment conditions change dynamically based on input from users or other external sources, are the most appropriate approach when evaluating solutions to practical network problems, for teaching and/or training purposes, etc. Support for dynamic experiment conditions is also required whenever an experiment cannot be fully defined from start, for instance when node behavior (application execution, mobility pattern, etc.) depends on factors such as communication conditions in the experiment, traffic content, and so on. In this paper we present the network emulation module named dynamiQ that makes possible the dynamic emulation of networks. We also outline an interactive experiment framework that uses dynamiQ to meet the above requirements. The evaluation of dynamiQ in this context shows that no significant performance penalties occur because of its dynamic nature. Our interactive experiment framework has already been used in practice, including for a demonstration at Interop Tokyo 2014.

Towards an Interactive Experiment Framework: DynamiQ

Interactive network experiments are useful for finding solutions to network problems, for teaching and for training purposes. In this demonstration we shall present an interactive experiment framework that allows users to directly control the experiment scenario by using a touch panel interface. This framework uses the network emulation module named dynamiQ for the dynamic emulation of networks. The demonstration uses a scenario with up to 55 emulated nodes, out of which 30 nodes form an emulated vehicular network and 5 are static buildings. The other nodes represent wireless towers and unmanned aerial vehicles that can be freely placed in the virtual experiment area. Participants are tasked with creating a multi-hop mesh network for sending video tra c between two predefined remote locations. A similar demonstration has already been shown at Interop Tokyo 2014, where it received a special jury award.