Securing nomads: the case for quarantine, examination, and decontamination

ABSTRACT

The rapid growth and increasing pervasiveness of wireless networks raises serious security concerns. Client devices will migrate between numerous diverse wireless environments, bringing with them software vulnerabilities and possibly malicious code. Techniques are needed to protect wireless client devices and the next generation wireless infrastructure. We propose QED, a new security model for wireless networks that enables wireless environments to quarantine devices and then analyze and potentially update or "decontaminate" client nodes. The QED paradigm is presented here, as well as the design of a practical prototype.

REFERENCES

• 1: J. Balasubramaniyan, J. Garcia-Fernandez, E. Spafford, D. Zamboni. An Architecture for Intrusion Detection using Autonomous Agents., COAST Technical Report 98/05, 1998.
• 2: Extensible Authentication Protocol - RFC 2284 - http://www.ietf, org/internet-drafts/draft-ietf-eap-rfc2284bis-01.txt
• 3: Yih-Chun Hu , Adrian Perrig , David B. Johnson, Ariadne:: a secure on-demand routing protocol for ad hoc networks, Proceedings of the 8th annual international conference on Mobile computing and networking, September 23-28, 2002, Atlanta, Georgia, USA [doi>10.1145/570645.570648]
• 4: Iptables : http://www.netfilter.org/
• 5: Peter G. Neumann , Phillip A. Porras, Experience with EMERALD to Date, Proceedings of the Workshop on Intrusion Detection and Network Monitoring, p.73-80, April 09-12, 1999
• 6: Nam Nguyen, Peter Reiher, Geoff Kuenning, Detecting Insider Threats by Monitoring System Call Activity. Submitted to 4th Annual IEEE Information Assurance, West Point, New York, Mar 2003.
• 7: Nmap Network Mapper. http://www.insecure.org/nmap/
• 8: The Open Group's Common Data SecurityArchitecture(CDSA). http://www.opengroup.org/security/12-cdsa.htm
• 9: Paul Roberts. Hackers find way to exploit latest Microsoft hole. IDG News Service, Sept. 16, 2003. http://www.infoworld.com/article/03/09/16/HNhackers_l.html
• 10: Steven R. Snapp et al. DIDS (Distributed Intrusion Detection System) -Motivation, Architecture, and An Early Prototype. Proc. 14th National Computer Security Conference. Washington, DC, Oct. 1991, pp. 167176.
• 11: S. Staniford-Chen, S. Cheung, R. Crawford, M. Dilger, J. Frank, J. Hoagland, K. Levitt, C. Wee, R. Yip, D. Zerkle. GrIDS - A Graph Based Intrusion Detection System for Large Networks, in Proc. of the 19th National Information Systems Security Conference. Baltimore, MD, Oct. 1996, 361--370.
• 12: The Trusted Computing Platform Alliance http://www.trustedpc.org
• 13: W. Venema, W. and D. Farmer. Improving the Security of Your Site by Breaking Into It. 1993 Internet White paper. http://gd.tuwien.ac.at/infosys/security/wietse-archive/admin-guide-to-cracking. 101.Z

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls; Invasive software (e.g., viruses, worms, Trojan horses)

General Terms:
Design, Human Factors, Security

Keywords:
decontamination, examination, mobile computing, nomadic computing, pervasive computing, quarantine, security, ubiquitous computing, wireless, worm