- Research Article
8
- 10.1109/access.2019.2957434
Secure and Lightweight Subflow Establishment of Multipath-TCP
- Jan 01, 2019
- IEEE Access
- Gunhee Noh + 3 more +3
Multipath Transmission Control Protocol (MPTCP) is an approach towards high-throughput and efficient load balancing over multiple paths. Each of paths forms a TCP connection with an IP address, and those can be implemented as multiple network interfaces or multiple ports within a network interface. In this paper, we focus on the multiple network interfaces environment. Each network interface with an IP address is called as a subflow. A subflow is a TCP connection which can have a different internet path identified by IP addresses of source and destination network interfaces. To control these multiple subflows, MPTCP supports many options. Specifically, to establish a new subflow, MPTCP uses an <monospace>ADD_ADDR</monospace> option. A host sends <monospace>ADD_ADDR</monospace> option to inform another host of its IP address, and then, the host receiving <monospace>ADD_ADDR</monospace> option tries to establish a subflow at the address of <monospace>ADD_ADDR</monospace> option. However, by forging the <monospace>ADD_ADDR</monospace> option, an attacker can create a fake subflow that passes through itself and eventually hijack the connection between both end hosts. In a previous study, Hash-based Message Authentication (HMAC) was added to the <monospace>ADD_ADDR</monospace> option, preventing it from being forged. Nevertheless, since the keys for generating HMAC can be leaked during three-way handshake, a variant of the <monospace>ADD_ADDR</monospace> attack called the persistent <monospace>ADD_ADDR</monospace> attack can be possible. To this end, we propose a protocol that can prevent the <monospace>ADD_ADDR</monospace> attacks by backward confirmation of the <monospace>ADD_ADDR</monospace> option without encryption. The main idea of our proposal is to apply a digital signature scheme for the backward confirmation. We show security analysis for the proposed protocol and compare with the previous studies in terms of time/space overheads.
Read more