began security writing
This commit is contained in:
parent
651712a1ef
commit
bb5fb75aef
@ -1,4 +1,3 @@
|
||||
%!TEX root = ../thesis.tex
|
||||
%*******************************************************************************
|
||||
%****************************** Third Chapter **********************************
|
||||
%*******************************************************************************
|
||||
@ -11,3 +10,21 @@
|
||||
\graphicspath{{Implementation/Figs/Vector/}{Implementation/Figs/}}
|
||||
\fi
|
||||
|
||||
\section{Security}
|
||||
|
||||
For the security implementation, I paid careful attention to the work of Wireguard (Donenfeld, “WireGuard.” \cite{donenfeld_wireguard_2017}). Wireguard is a modern, well respected method of securely transferring Layer 3 packets across the Internet.
|
||||
|
||||
However, as Wireguard is a VPN, it provides certain security benefits that are not within the remit of my threat model (section \ref{section:threat-model}). The primary example of this is privacy. When Wireguard, and most VPNs, send a packet, they first encrypt the contents such that the contents of the datagram are only visible to the intended recipient. For this project, encryption will not be necessary, as that would provide privacy above using the modem without this solution. If a user wishes to also have the benefits of an encrypted Internet connection, the transparency of this solution allows existing VPNs to run underneath and provide that. This follows the philosophy of do one thing and do it well.
|
||||
|
||||
The security in this solution will be achieved by using public and private keypairs to perform a key exchange at the beginning of connections, and then using that key to produce a message authentication code for each packet sent across the connection. To prevent replay of earlier messages, a timestamp will be included within the authenticated section of the message. This timestamp can be used to discard messages sent a certain time earlier than now, reducing the usefulness of replay attacks.
|
||||
|
||||
As far as is possible, the security of the application relies on external libraries. Although an interesting exercise, implementing security algorithms directly from papers is far more likely to result in errors and thus security flaws. Due to this, I will be using trusted and open source libraries for the scheme I have chosen.
|
||||
|
||||
\subsection{Key Exchange}
|
||||
|
||||
TODO
|
||||
|
||||
\subsection{Message Authentication Codes}
|
||||
|
||||
TODO
|
||||
|
||||
|
||||
@ -13,7 +13,7 @@
|
||||
|
||||
\section{Motivation}
|
||||
|
||||
Many regions in the UK do not have access to high bandwidth Internet connections\cite{ookla-uk-2017}. However, it is often possible to have multiple low bandwidth connections installed. More generally, a wider variety of Internet connections for fixed locations are becoming available with time. These include: DSL, Fibre To The Premises, 4G, 5G, Wireless ISPs such as LARIAT and Low Earth Orbit ISPs such as Starlink.
|
||||
Many regions in the UK do not have access to high bandwidth Internet connections\cite{noauthor_2018_2018}. However, it is often possible to have multiple low bandwidth connections installed. More generally, a wider variety of Internet connections for fixed locations are becoming available with time. These include: DSL, Fibre To The Premises, 4G, 5G, Wireless ISPs such as LARIAT and Low Earth Orbit ISPs such as Starlink.
|
||||
|
||||
\section{Existing Work}
|
||||
|
||||
|
||||
@ -86,7 +86,7 @@
|
||||
|
||||
%\usepackage{multicol}
|
||||
%\usepackage{longtable}
|
||||
%\usepackage{tabularx}
|
||||
\usepackage{tabularx}
|
||||
|
||||
|
||||
% *********************************** SI Units *********************************
|
||||
|
||||
@ -1,4 +1,3 @@
|
||||
%!TEX root = ../thesis.tex
|
||||
%*******************************************************************************
|
||||
%****************************** Second Chapter *********************************
|
||||
%*******************************************************************************
|
||||
@ -12,6 +11,7 @@
|
||||
\fi
|
||||
|
||||
\section{Threat Model}
|
||||
\label{section:threat-model}
|
||||
|
||||
Proxying a network connection via a Remote Portal creates an expanded set of security threats than connecting directly to the Internet via a modem. In this section, I will discuss my analysis of these threats, in both isolation, and compared to the case of connecting directly.
|
||||
|
||||
@ -23,13 +23,63 @@ These security problems will be considered in the context of the success criteri
|
||||
|
||||
\subsection{Public Packets}
|
||||
|
||||
\subsubsection{Cost}
|
||||
A convenient factor of the Internet being an interconnected set of smaller networks is that there are very few guarantees of security. At layer 3, none of anonymity, integrity, privacy or freshness are provided once the packet leaves private ranges, so it is up to the application to ensure its own security on top of this lack of guarantees. For the purposes of this software, this is very useful: if there are no guarantees to maintain, applications can be expected to act correctly regardless of how they occur.
|
||||
|
||||
Many Internet connections have caps or cost for additional bandwidth. In a standard network, the control of your cap is physical, in that, if someone wished to increase the load,
|
||||
Therefore, to maintain the same level of security for applications, this project can simply guarantee that the packets which leave the Remote Portal are the same as those that came in. By doing this, all of the security implemented above Layer 3 will be maintained. This means that whether a user is accessing insecure websites over HTTP, running a corporate VPN connection or sending encrypted emails, the security of these applications will be maintained.
|
||||
|
||||
\subsection{Portal to Portal Communication}
|
||||
|
||||
\subsubsection{Authenticity}
|
||||
\subsubsection{Cost}
|
||||
|
||||
Many Internet connections have caps or cost for additional bandwidth. In a standard network, the control of your cap is physical, in that, if someone wished to increase the load, they would have to physically connect to the modem.
|
||||
|
||||
Due to this, it is important that care is taken with regards to cost. The difference in this case, is that rather than needing physical access to send data through your connection, all one needs is an Internet connection. A conceivable threat is for someone to send packets to your Remote Portal from their own connection, causing the Portal to forward these packets, and thus using your limited or costly bandwidth.
|
||||
|
||||
\subsubsection{Denial of Service}
|
||||
\label{subsubsection:threats-denial-of-service}
|
||||
|
||||
\begin{figure}
|
||||
\centering
|
||||
\begin{subfigure}{.49\textwidth}
|
||||
\begin{tabularx}{\textwidth}{ | l l }
|
||||
Downlink Capacity & Percentage of Packets \\
|
||||
25 Mbps & 5\% \\
|
||||
25 Mbps & 5\% \\
|
||||
25 Mbps & 5\% \\
|
||||
(BAD) 425 Mbps & 85\%
|
||||
\end{tabularx}
|
||||
\caption{A bad actor with a fast connection taking a percentage of packets.}
|
||||
\label{fig:fast-bad-actor-packet-loss}
|
||||
\end{subfigure}
|
||||
\begin{subfigure}{.49\textwidth}
|
||||
\begin{tabularx}{\textwidth}{ | l l | }
|
||||
Downlink Capacity & Percentage of Packets \\
|
||||
25 Mbps & 25\% \\
|
||||
25 Mbps & 25\% \\
|
||||
25 Mbps & 25\% \\
|
||||
(BAD) 25 Mbps & 25\%
|
||||
\end{tabularx}
|
||||
\caption{A bad actor with an equally slow connection to you taking a percentage of packets.}
|
||||
\label{fig:slow-bad-actor-packet-loss}
|
||||
\end{subfigure}
|
||||
\caption{Bad actors taking a percentage of packets based on their network speed.}
|
||||
\label{fig:bad-actor-packet-loss}
|
||||
\end{figure}
|
||||
|
||||
If a malicious actor can fool the Remote Portal into sending them a portion of your packets, they are immediately performing an effective Denial of Service. In figure \ref{fig:fast-bad-actor-packet-loss}, it can be seen that a bad actor, with a significantly faster connection than you, can cause huge packet loss if the Remote Portal would accept them as a valid Local Portal connection.
|
||||
|
||||
\begin{figure}
|
||||
\begin{equation}
|
||||
Throughput = \sqrt{\frac{3}{2}}\frac{1}{RTT\sqrt{p}}
|
||||
\end{equation}
|
||||
\caption{TCP Throughput Equation (New Reno)}
|
||||
\label{fig:tcp-throughput}
|
||||
\end{figure}
|
||||
|
||||
However, of much more relevance is \ref{fig:slow-bad-actor-packet-loss}. Given the TCP throughput equation, shown in figure \ref{fig:tcp-throughput}, there is an inverse relation between packet loss and throughput of any TCP connections. Assuming a Round Trip Time of $20ms$ and Maximum Segment Size of $1460$, packet loss of $25\%$ limits the maximum TCP throughput to approximately $1.17Mbps$. In fact, due to this relation, a packet loss of even $1\%$ leads to a maximum throughput of approximately $5.84Mbps$. This means that even a small packet loss has a drastic effect on the performance of the connection as a whole, and thus makes Remote Portals an effective target for Denial of Service attacks. Thus care should be taken that all Local Portal connections are from the subject that is intended.
|
||||
|
||||
\subsection{Privacy}
|
||||
|
||||
Though the packets leaving a modem have no reasonable expectation of privacy, having the packets enter the Internet at two points does increase this vector. For example, if a malicious actor convinces the Remote Portal that they are a valid connection from the Local Portal, a portion of packets will be sent to them. However, as a fortunate side effect, this method to attempt sniffing would cause a significant Denial of Service to any congestion controlled links based on packet loss, due to the amount of packet loss caused. Thus, as long as it is ensured that each packet is not sent to multiple places, privacy should be maintained at a similar level to simple Internet access.
|
||||
|
||||
Authenticity is a strong requirement for packets transported between the portals. That is, the packet must have both freshness and integrity.
|
||||
|
||||
|
||||
@ -2,8 +2,6 @@
|
||||
|
||||
\begin{proforma}
|
||||
|
||||
|
||||
Stuff to be filled in later.
|
||||
|
||||
TODO
|
||||
|
||||
\end{proforma}
|
||||
|
||||
@ -1,403 +1,43 @@
|
||||
% ------------------------------------------------------------------------
|
||||
% Real Bibliography Entries
|
||||
% ------------------------------------------------------------------------
|
||||
@misc{ookla-uk-2017,
|
||||
institution = {Ookla, LLC.},
|
||||
author = {Ookla},
|
||||
title = {2018 United Kingdom Speedtest Market Snapshot},
|
||||
year = 2018,
|
||||
note = {\url{https://speedtest.net/reports/united-kingdom/#fixed}},
|
||||
url = {https://www.speedtest.net/reports/united-kingdom/#fixed},
|
||||
}
|
||||
|
||||
|
||||
% ------------------------------------------------------------------------
|
||||
% SAMPLE BIBLIOGRAPHY FILE
|
||||
% ------------------------------------------------------------------------
|
||||
@misc{cve-2008-1368,
|
||||
key = {CVE-2008-1368},
|
||||
title = {Publication quality tables in \LaTeX*},
|
||||
howpublished = {},
|
||||
institution = {NIST},
|
||||
day = 17,
|
||||
month = {March},
|
||||
year = 2008,
|
||||
note = {[online] \url{http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1368}},
|
||||
url = {http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1368}
|
||||
}
|
||||
|
||||
@MISC{prime-number-theorem,
|
||||
author = "Charles Louis Xavier Joseph de la Vall{\'e}e Poussin",
|
||||
note = "A strong form of the prime number theorem, 19th century" }
|
||||
|
||||
% ------------------------------------------------------------------------
|
||||
|
||||
@BOOK{texbook,
|
||||
author = "Donald E. Knuth",
|
||||
title= "The {{\TeX}book}",
|
||||
publisher = "Addison-Wesley",
|
||||
year = 1984 }
|
||||
|
||||
@BOOK{latex,
|
||||
author = "Leslie Lamport",
|
||||
title = "{\LaTeX:} {A} Document Preparation System",
|
||||
publisher = "Addison-Wesley",
|
||||
year = 1986 }
|
||||
|
||||
% ------------------------------------------------------------------------
|
||||
@article{Ancey1996,
|
||||
author = {Ancey, Christophe and Coussot, Philippe and Evesque, Pierre},
|
||||
journal = {Mechanics of Cohesive-frictional Materials},
|
||||
number = {4},
|
||||
pages = {385--403},
|
||||
title = {Examination of the possibility of a fluid-mechanics treatment of dense granular flows},
|
||||
url = {http://doi.wiley.com/10.1002/(SICI)1099-1484(199610)1:4<385::AID-CFM20>3.0.CO;2-0},
|
||||
volume = {1},
|
||||
year = {1996}
|
||||
}
|
||||
|
||||
@BOOK{RR73,
|
||||
author={H. Radjavi and P. Rosenthal},
|
||||
title={Invariant {Subspaces}},
|
||||
publisher={Springer-Verlag},
|
||||
address={New York},
|
||||
year={1973},
|
||||
}
|
||||
|
||||
@BOOK{Aup91,
|
||||
author={B. Aupetit},
|
||||
title={A {Primer} on {Spectral} {Theory}},
|
||||
publisher={Springer-Verlag},
|
||||
address={New York},
|
||||
year={1991},
|
||||
}
|
||||
|
||||
@BOOK{Dou72,
|
||||
author={R. G. Douglas},
|
||||
title={Banach {Algebra} {Techniques} in {Operator} {Theory}},
|
||||
publisher={Academic Press},
|
||||
address={New York},
|
||||
year={1972},
|
||||
}
|
||||
|
||||
@BOOK{Hal82,
|
||||
author={P. R. Halmos},
|
||||
title={A {Hilbert} {Space} {Problem} {Book}},
|
||||
edition={Second},
|
||||
publisher={Springer-Verlag},
|
||||
address={New York},
|
||||
year={1982},
|
||||
}
|
||||
|
||||
@BOOK{Rud73,
|
||||
author={W. Rudin},
|
||||
title={Functional {Analysis}},
|
||||
publisher={McGraw-Hill},
|
||||
address={New York},
|
||||
year={1973},
|
||||
}
|
||||
|
||||
@BOOK{Con90,
|
||||
author={J. B. Conway},
|
||||
title={A {Course} in {Functional} {Analysis}},
|
||||
edition={Second},
|
||||
publisher={Springer-Verlag},
|
||||
address={New York},
|
||||
year={1990},
|
||||
}
|
||||
|
||||
@BOOK{Con78,
|
||||
author={J. B. Conway},
|
||||
title={Functions of {One} {Complex} {Variable}},
|
||||
publisher={Springer-Verlag},
|
||||
address={New York},
|
||||
year={1978},
|
||||
}
|
||||
|
||||
@BOOK{KR83,
|
||||
author={R. V. Kadison and J. R. Ringrose},
|
||||
title={Fundamentals of the {Theory} of {Operator} {Algebras},
|
||||
{Part} {I}},
|
||||
publisher={Academic Press},
|
||||
address={New York},
|
||||
year={1983},
|
||||
}
|
||||
|
||||
@BOOK{KR86,
|
||||
author={R. V. Kadison and J. R. Ringrose},
|
||||
title={Fundamentals of the {Theory} of {Operator} {Algebras},
|
||||
{Part} {II}},
|
||||
publisher={Academic Press},
|
||||
address={New York},
|
||||
year={1986},
|
||||
}
|
||||
|
||||
@INBOOK{SFPT,
|
||||
author={N. Dunford and J. T. Schwartz},
|
||||
title={Linear {Operators},
|
||||
{Part} {I}: {General} {Theory}},
|
||||
pages={456},
|
||||
publisher={Interscience},
|
||||
address={New York},
|
||||
year={1957},
|
||||
}
|
||||
|
||||
@BOOK{DS57,
|
||||
author={N. Dunford and J. T. Schwartz},
|
||||
title={Linear {Operators},
|
||||
{Part} {I}: {General} {Theory}},
|
||||
publisher={Interscience},
|
||||
address={New York},
|
||||
year={1957},
|
||||
}
|
||||
|
||||
@BOOK{Gan59,
|
||||
author={F. R. Gantmacher},
|
||||
title={Applications of the {Theory} of {Matrices}},
|
||||
publisher={Interscience},
|
||||
address={New York},
|
||||
year={1959},
|
||||
}
|
||||
|
||||
@BOOK{Pau86,
|
||||
author={Vern I. Paulsen},
|
||||
title={Completely bounded maps and dilations},
|
||||
series={Pitman Research Notes in Mathematics Series},
|
||||
volume={146},
|
||||
publisher={Longman Scientific \& Technical},
|
||||
address={Harlow UK},
|
||||
year={1986},
|
||||
}
|
||||
|
||||
@BOOK{Dav88,
|
||||
author={Kenneth R. Davidson},
|
||||
title={Nest algebras},
|
||||
series={Pitman Research Notes in Mathematics Series},
|
||||
volume={191},
|
||||
publisher={Longman Scientific \& Technical},
|
||||
address={Harlow UK},
|
||||
year={1988},
|
||||
}
|
||||
|
||||
@BOOK{Spi65,
|
||||
author={Michael Spivak},
|
||||
title={Calculus on {Manifolds}},
|
||||
publisher={The Benjamin/Cummings Publishing Company},
|
||||
address={New York},
|
||||
year={1965},
|
||||
}
|
||||
|
||||
@BOOK{Dev68,
|
||||
author={Allen Devinaz},
|
||||
title={Advanced {Calculus}},
|
||||
publisher={Holt, Rinehart and Winston},
|
||||
address={New York},
|
||||
year={1968},
|
||||
}
|
||||
|
||||
@BOOK{Gam90,
|
||||
editor={R. V. Gamkerlidze},
|
||||
title={Analysis {I}{I}: {Convex} {Analysis} and
|
||||
{Approximation} {Theory}},
|
||||
series={Encyclopaedia of Mathematical Sciences},
|
||||
volume={14},
|
||||
publisher={Springer-Verlag},
|
||||
address={New York},
|
||||
year={1990},
|
||||
}
|
||||
|
||||
@BOOK{Hen93,
|
||||
author={Peter Henderson},
|
||||
title={Object-oriented specification and design with {C}$++$},
|
||||
publisher={McGraw-Hill},
|
||||
address={London},
|
||||
year={1993},
|
||||
}
|
||||
|
||||
% ------------------------------------------------------------------------
|
||||
|
||||
@ARTICLE{Rea85,
|
||||
author={C. J. Read},
|
||||
title={A solution to the invariant subspace problem on the space $l_1$},
|
||||
journal={Bull. London Math. Soc.},
|
||||
volume={17},
|
||||
year={1985},
|
||||
pages={305-317},
|
||||
}
|
||||
|
||||
@ARTICLE{Enf87,
|
||||
author={P. Enflo},
|
||||
title={On the invariant subspaces problem for {Banach} spaces},
|
||||
journal={Acta. Math.},
|
||||
note={Seminare Maurey-Schwartz (1975-1976)},
|
||||
volume={158},
|
||||
year={1987},
|
||||
pages={213-313},
|
||||
}
|
||||
|
||||
@ARTICLE{Dau75,
|
||||
author={J. Daughtry},
|
||||
title={An invariant subspace theorem},
|
||||
journal={Proc. Amer. Math. Soc.},
|
||||
volume={49},
|
||||
year={1975},
|
||||
pages={267-268},
|
||||
}
|
||||
|
||||
@ARTICLE{KPS75,
|
||||
author={H. W. Kim and C. Pearcy and A. L. Shields},
|
||||
title={Rank-One Commutators and Hyperinvariant Subspaces},
|
||||
journal={Michigan Math. J.},
|
||||
volume={22},
|
||||
number={3},
|
||||
year={1975},
|
||||
pages={193-194},
|
||||
}
|
||||
|
||||
% --------------------------------------------------------------------------
|
||||
|
||||
@ARTICLE{Rad87,
|
||||
author={H. Radjavi},
|
||||
title={The {Engel}-{Jacobson} {Theorem} {Revisited}},
|
||||
journal={J. Alg.},
|
||||
volume={111},
|
||||
year={1987},
|
||||
pages={427-430},
|
||||
}
|
||||
|
||||
@ARTICLE{MOR91,
|
||||
author={B. Mathes and M. Omladi\v{c} and H. Radjavi},
|
||||
title={Linear {Spaces} of {Nilpotent} {Operators}},
|
||||
journal={Linear Algebra Appl.},
|
||||
volume={149},
|
||||
year={1991},
|
||||
pages={215-225},
|
||||
}
|
||||
|
||||
@ARTICLE{Lom73,
|
||||
author={V. I. Lomonosov},
|
||||
title={Invariant subspaces for operators commuting with compact
|
||||
operators},
|
||||
journal={Functional Anal. Appl.},
|
||||
volume=7,
|
||||
year=1973,
|
||||
pages="213-214",
|
||||
}
|
||||
|
||||
@ARTICLE{Lom91,
|
||||
author={V. I. Lomonosov},
|
||||
title={An extension of {Burnside}'s theorem to infinite
|
||||
dimensional spaces},
|
||||
journal={Israel J. Math},
|
||||
volume=75,
|
||||
year=1991,
|
||||
pages="329-339",
|
||||
}
|
||||
|
||||
@ARTICLE{Lom92,
|
||||
author={V. I. Lomonosov},
|
||||
title={On {Real} {Invariant} {Subspaces} of {Bounded} {Operators} with
|
||||
{Compact} {Imaginary} {Part}},
|
||||
journal={Proc. Amer. Math. Soc.},
|
||||
volume=115,
|
||||
number=3,
|
||||
month=jul,
|
||||
year=1992,
|
||||
pages="775-777",
|
||||
}
|
||||
|
||||
@ARTICLE{dB59,
|
||||
author={L. de Branges},
|
||||
title={The {Stone}-{Weierstrass} {Theorem}},
|
||||
journal={Proc. Amer. Math. Soc.},
|
||||
volume=10,
|
||||
year=1959,
|
||||
pages="822-824",
|
||||
}
|
||||
|
||||
@ARTICLE{dB93,
|
||||
author={L. de Branges},
|
||||
title={A construction of invariant subspaces},
|
||||
journal={Math. Nachr.},
|
||||
volume=163,
|
||||
year=1993,
|
||||
pages="163-175",
|
||||
}
|
||||
|
||||
@ARTICLE{AAB95,
|
||||
author={Y. A. Abramovich and C. D. Aliprantis and O. Burkinshaw},
|
||||
title={Another Characterization of the Invariant Subspace Problem},
|
||||
journal={Operator Theory in Function Spaces and Banach Lattices.
|
||||
{\em The A.C.\,Zaanen Anniversary Volume},
|
||||
Operator Theory: Advances and Applications},
|
||||
volume={75},
|
||||
year={1995},
|
||||
pages={15-31},
|
||||
note={Birkh\"auser Verlag},
|
||||
}
|
||||
|
||||
@ARTICLE{LM65,
|
||||
author={Ju. I. Ljubi\v{c} and V. I. Macaev},
|
||||
title={On Operators with a Separable Spectrum},
|
||||
journal={Amer. Math. Soc. Transl. (2)},
|
||||
volume={47},
|
||||
year={1965},
|
||||
pages={89-129},
|
||||
}
|
||||
|
||||
% ------------------------------------------------------------------------
|
||||
|
||||
@MASTERSTHESIS{Sim90,
|
||||
author={A. Simoni\v{c}},
|
||||
title={Grupe Operatorjev s Pozitivnim Spektrom},
|
||||
school={Univerza v Ljubljani, FNT, Oddelek za Matematiko},
|
||||
year={1990},
|
||||
}
|
||||
|
||||
@UNPUBLISHED{Sim91,
|
||||
author={A. Simoni\v{c}},
|
||||
title={Notes on {Subharmonic} {Functions}},
|
||||
note={Lecture Notes, Dalhousie University,
|
||||
Department of Mathematics, Statistics, \& Computing Science},
|
||||
year={1991},
|
||||
}
|
||||
|
||||
@ARTICLE{Sim92,
|
||||
author={A. Simoni\v{c}},
|
||||
title={Matrix {Groups} with {Positive} {Spectra}},
|
||||
journal={Linear Algebra Appl.},
|
||||
volume={173},
|
||||
year={1992},
|
||||
pages={57-76},
|
||||
}
|
||||
|
||||
@PHDTHESIS{Sim94,
|
||||
author={A. Simoni\v{c}},
|
||||
title={An {Extension} of {Lomonosov's} {Techniques} to {Non}-{Compact}
|
||||
{Operators}},
|
||||
school={Dalhousie University,
|
||||
Department of Mathematics, Statistics, \& Computing Science},
|
||||
year={1994},
|
||||
}
|
||||
|
||||
@ARTICLE{Sim96a,
|
||||
author={A. Simoni\v{c}},
|
||||
title={A {Construction} of {Lomonosov} {Functions} and
|
||||
{Applications} to the {Invariant} {Subspace} {Problem}},
|
||||
journal={Pacific J. Math.},
|
||||
volume={175},
|
||||
pages={257-270},
|
||||
year={1996},
|
||||
}
|
||||
|
||||
@ARTICLE{Sim96b,
|
||||
author={A. Simoni\v{c}},
|
||||
title={An extension of {Lomonosov's} {Techniques} to non-compact
|
||||
{Operators}},
|
||||
journal={Trans. Amer. Math. Soc.},
|
||||
volume={348},
|
||||
pages={975-995},
|
||||
year={1996},
|
||||
}
|
||||
|
||||
% ------------------------------------------------------------------------
|
||||
|
||||
@article{noauthor_typesafely_nodate,
|
||||
title = {{TypeSafely} - {A} {Secure} {USB} {Keyboard}},
|
||||
url = {https://www.cl.cam.ac.uk/teaching/projects/archive/2019/hbgj2-dissertation.pdf},
|
||||
}
|
||||
|
||||
@article{noauthor_zeromq_nodate,
|
||||
title = {A {ZeroMQ} {Implementation} for {MirageOS}},
|
||||
url = {https://www.cl.cam.ac.uk/teaching/projects/archive/2019/hz326-dissertation.pdf},
|
||||
}
|
||||
|
||||
@article{noauthor_implementation_nodate,
|
||||
title = {An implementation and evaluation of {Loopix}, an anonymous communication system},
|
||||
url = {https://www.cl.cam.ac.uk/teaching/projects/archive/2018/jsc81-dissertation.pdf},
|
||||
}
|
||||
|
||||
@inproceedings{donenfeld_wireguard_2017,
|
||||
address = {San Diego, CA},
|
||||
title = {{WireGuard}: {Next} {Generation} {Kernel} {Network} {Tunnel}},
|
||||
isbn = {978-1-891562-46-4},
|
||||
shorttitle = {{WireGuard}},
|
||||
url = {https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/wireguard-next-generation-kernel-network-tunnel/},
|
||||
doi = {10.14722/ndss.2017.23160},
|
||||
abstract = {WireGuard is a secure network tunnel, operating at layer 3, implemented as a kernel virtual network interface for Linux, which aims to replace both IPsec for most use cases, as well as popular user space and/or TLS-based solutions like OpenVPN, while being more secure, more performant, and easier to use. The virtual tunnel interface is based on a proposed fundamental principle of secure tunnels: an association between a peer public key and a tunnel source IP address. It uses a single round trip key exchange, based on NoiseIK, and handles all session creation transparently to the user using a novel timer state machine mechanism. Short pre-shared static keys—Curve25519 points—are used for mutual authentication in the style of OpenSSH. The protocol provides strong perfect forward secrecy in addition to a high degree of identity hiding. Transport speed is accomplished using ChaCha20Poly1305 authenticated-encryption for encapsulation of packets in UDP. An improved take on IP-binding cookies is used for mitigating denial of service attacks, improving greatly on IKEv2 and DTLS’s cookie mechanisms to add encryption and authentication. The overall design allows for allocating no resources in response to received packets, and from a systems perspective, there are multiple interesting Linux implementation techniques for queues and parallelism. Finally, WireGuard can be simply implemented for Linux in less than 4,000 lines of code, making it easily audited and verified.},
|
||||
language = {en},
|
||||
urldate = {2020-11-19},
|
||||
booktitle = {Proceedings 2017 {Network} and {Distributed} {System} {Security} {Symposium}},
|
||||
publisher = {Internet Society},
|
||||
author = {Donenfeld, Jason A.},
|
||||
year = {2017},
|
||||
file = {Donenfeld - 2017 - WireGuard Next Generation Kernel Network Tunnel.pdf:/home/jake/Zotero/storage/6MEQYC9J/Donenfeld - 2017 - WireGuard Next Generation Kernel Network Tunnel.pdf:application/pdf},
|
||||
}
|
||||
|
||||
@misc{noauthor_2018_2018,
|
||||
title = {2018 {United} {Kingdom} {Speedtest} {Market} {Snapshot}},
|
||||
shorttitle = {Ookla {Speedtest} {Market} {Snapshot}},
|
||||
url = {http://www.speedtest.net/reports/united-kingdom/},
|
||||
abstract = {Based on millions of Speedtest results, the 2018 United Kingdom Market Snapshot is the comprehensive guide to fixed broadband and mobile internet speeds in the UK.},
|
||||
urldate = {2020-11-19},
|
||||
journal = {Ookla},
|
||||
year = {2018},
|
||||
file = {Snapshot:/home/jake/Zotero/storage/49UCNVCV/united-kingdom.html:text/html},
|
||||
}
|
||||
|
||||
BIN
thesis.pdf
BIN
thesis.pdf
Binary file not shown.
Loading…
Reference in New Issue
Block a user