To implement the Network Security Architecture in ns3 has needs to generate the simulation where numerous security mechanisms are combined into the network and contain firewalls, intrusion detection systems (IDS), encryption, and authentication mechanisms. The given below is the procedure on how to implement the simple network security architecture in ns3:
Step-by-Step Implementation:
Step 1: Set Up ns3 Environment
- Install ns3: Install the ns3 in the computer.
- Familiarize yourself with ns3: Read through the ns3 seminar to know the basic concepts and structure of ns3 simulations.
Step 2: Define the Network Topology
- Create a Secure Network Topology: To describe the network topology that embrace security devices such as firewalls and IDS nodes and contains to creating multiple nodes, setting up channels, and configuring IP addresses. We’ll use a simple topology with a client, server, firewall, and IDS.
Step 3: Implement Security Mechanisms
To implement basic network security architecture, we can use the following strategies:
- Firewall: Implement packet filtering based on predefined rules.
- Intrusion Detection System (IDS): Monitor traffic for suspicious activity.
- Encryption: Encrypt data before transmission.
- Authentication: Implement authentication mechanisms for access control.
This is an sample to execute the simple network security architecture:
C++ Code for ns3 Simulation (main.cc)
#include “ns3/core-module.h”
#include “ns3/network-module.h”
#include “ns3/internet-module.h”
#include “ns3/point-to-point-module.h”
#include “ns3/applications-module.h”
#include <iostream>
#include <fstream>
using namespace ns3;
class FirewallApp : public Application
{
public:
FirewallApp() {}
virtual ~FirewallApp() {}
void Setup(Address address, uint16_t port)
{
m_peerAddress = address;
m_peerPort = port;
}
private:
virtual void StartApplication()
{
m_socket = Socket::CreateSocket(GetNode(), TypeId::LookupByName(“ns3::UdpSocketFactory”));
m_socket->Bind();
m_socket->Connect(InetSocketAddress(m_peerAddress, m_peerPort));
// Set up the receive callback
m_socket->SetRecvCallback(MakeCallback(&FirewallApp::ReceivePacket, this));
}
virtual void StopApplication()
{
if (m_socket)
{
m_socket->Close();
m_socket = 0;
}
}
void ReceivePacket(Ptr<Socket> socket)
{
Ptr<Packet> packet = socket->Recv();
// Simple firewall rule: drop packets containing “malicious”
uint8_t buffer[1024];
packet->CopyData(buffer, packet->GetSize());
std::string receivedMessage((char *)buffer, packet->GetSize());
if (receivedMessage.find(“malicious”) != std::string::npos)
{
std::cout << “Packet dropped by firewall: ” << receivedMessage << std::endl;
}
else
{
std::cout << “Packet allowed by firewall: ” << receivedMessage << std::endl;
ForwardPacket(packet);
}
}
void ForwardPacket(Ptr<Packet> packet)
{
m_socket->Send(packet);
}
Ptr<Socket> m_socket;
Address m_peerAddress;
uint16_t m_peerPort;
};
class IDSApp : public Application
{
public:
IDSApp() : m_packetsReceived(0) {}
virtual ~IDSApp() {}
void Setup(Address address, uint16_t port)
{
m_peerAddress = address;
m_peerPort = port;
}
private:
virtual void StartApplication()
{
m_socket = Socket::CreateSocket(GetNode(), TypeId::LookupByName(“ns3::UdpSocketFactory”));
m_socket->Bind();
m_socket->Connect(InetSocketAddress(m_peerAddress, m_peerPort));
// Set up the receive callback
m_socket->SetRecvCallback(MakeCallback(&IDSApp::ReceivePacket, this));
}
virtual void StopApplication()
{
if (m_socket)
{
m_socket->Close();
m_socket = 0;
}
}
void ReceivePacket(Ptr<Socket> socket)
{
Ptr<Packet> packet = socket->Recv();
m_packetsReceived++;
// Simple IDS rule: log packets containing “suspicious”
uint8_t buffer[1024];
packet->CopyData(buffer, packet->GetSize());
std::string receivedMessage((char *)buffer, packet->GetSize());
if (receivedMessage.find(“suspicious”) != std::string::npos)
{
std::cout << “Suspicious packet detected by IDS: ” << receivedMessage << std::endl;
}
else
{
std::cout << “Normal packet received by IDS: ” << receivedMessage << std::endl;
}
}
Ptr<Socket> m_socket;
Address m_peerAddress;
uint16_t m_peerPort;
uint32_t m_packetsReceived;
};
class SecureApp : public Application
{
public:
SecureApp() {}
virtual ~SecureApp() {}
void Setup(Address address, uint16_t port)
{
m_peerAddress = address;
m_peerPort = port;
}
private:
virtual void StartApplication()
{
m_socket = Socket::CreateSocket(GetNode(), TypeId::LookupByName(“ns3::UdpSocketFactory”));
m_socket->Bind();
m_socket->Connect(InetSocketAddress(m_peerAddress, m_peerPort));
// Schedule the first packet transmission
Simulator::Schedule(Seconds(1.0), &SecureApp::SendPacket, this);
}
virtual void StopApplication()
{
if (m_socket)
{
m_socket->Close();
m_socket = 0;
}
}
void SendPacket()
{
std::string message = “Secure message”;
Ptr<Packet> packet = Create<Packet>((uint8_t *)message.c_str(), message.size());
m_socket->Send(packet);
// Schedule the next packet transmission
Simulator::Schedule(Seconds(5.0), &SecureApp::SendPacket, this);
}
void ReceivePacket(Ptr<Socket> socket)
{
Ptr<Packet> packet = socket->Recv();
// Print received message (for demonstration purposes)
uint8_t buffer[1024];
packet->CopyData(buffer, packet->GetSize());
std::string receivedMessage((char *)buffer, packet->GetSize());
std::cout << “Received message: ” << receivedMessage << std::endl;
}
Ptr<Socket> m_socket;
Address m_peerAddress;
uint16_t m_peerPort;
};
int main(int argc, char *argv[])
{
NodeContainer nodes;
nodes.Create(5); // Example: 5 nodes (1 client, 1 server, 1 firewall, 1 IDS, 1 router)
PointToPointHelper pointToPoint;
pointToPoint.SetDeviceAttribute(“DataRate”, StringValue(“1Gbps”));
pointToPoint.SetChannelAttribute(“Delay”, StringValue(“2ms”));
NetDeviceContainer devices1 = pointToPoint.Install(nodes.Get(0), nodes.Get(4)); // Client to Router
NetDeviceContainer devices2 = pointToPoint.Install(nodes.Get(4), nodes.Get(3)); // Router to Firewall
NetDeviceContainer devices3 = pointToPoint.Install(nodes.Get(3), nodes.Get(2)); // Firewall to Server
NetDeviceContainer devices4 = pointToPoint.Install(nodes.Get(4), nodes.Get(1)); // Router to IDS
InternetStackHelper stack;
stack.Install(nodes);
Ipv4AddressHelper address;
address.SetBase(“10.1.1.0”, “255.255.255.0”);
Ipv4InterfaceContainer interfaces1 = address.Assign(devices1);
address.SetBase(“10.1.2.0”, “255.255.255.0”);
Ipv4InterfaceContainer interfaces2 = address.Assign(devices2);
address.SetBase(“10.1.3.0”, “255.255.255.0”);
Ipv4InterfaceContainer interfaces3 = address.Assign(devices3);
address.SetBase(“10.1.4.0”, “255.255.255.0”);
Ipv4InterfaceContainer interfaces4 = address.Assign(devices4);
Ipv4GlobalRoutingHelper::PopulateRoutingTables();
uint16_t port = 9;
Ptr<SecureApp> clientApp = CreateObject<SecureApp>();
clientApp->Setup(InetSocketAddress(interfaces2.GetAddress(1), port), port);
nodes.Get(0)->AddApplication(clientApp);
clientApp->SetStartTime(Seconds(2.0));
clientApp->SetStopTime(Seconds(60.0));
Ptr<FirewallApp> firewallApp = CreateObject<FirewallApp>();
firewallApp->Setup(InetSocketAddress(interfaces3.GetAddress(1), port), port);
nodes.Get(3)->AddApplication(firewallApp);
firewallApp->SetStartTime(Seconds(1.0));
firewallApp->SetStopTime(Seconds(60.0));
Ptr<IDSApp> idsApp = CreateObject<IDSApp>();
idsApp->Setup(InetSocketAddress(interfaces4.GetAddress(1), port), port);
nodes.Get(1)->AddApplication(idsApp);
idsApp->SetStartTime(Seconds(1.0));
idsApp->SetStopTime(Seconds(60.0));
Ptr<SecureApp> serverApp = CreateObject<SecureApp>();
serverApp->Setup(InetSocketAddress(Ipv4Address::GetAny(), port), port);
nodes.Get(2)->AddApplication(serverApp);
serverApp->SetStartTime(Seconds(1.0));
serverApp->SetStopTime(Seconds(60.0));
Simulator::Run();
Simulator::Destroy();
return 0;
}
Explanation
- Network Topology:
- The network consists of 5 nodes: a client, a server, a firewall, an IDS, and a router.
- The client connects to the router, which forwards packets through the firewall and IDS to the server.
- FirewallApp Class:
- This application filters packets based on predefined rules.
- Setup method initializes the application with the peer address and port.
- StartApplication method sets up the socket connection and receives callback.
- ReceivePacket method filters packets and forwards allowed packets.
- IDSApp Class:
- This application monitors traffic for suspicious activity.
- Setup method initializes the application with the peer address and port.
- StartApplication method sets up the socket connection and receives callback.
- ReceivePacket method logs suspicious packets.
- SecureApp Class:
- This application sends and receives secure messages.
- Setup method initializes the application with the peer address and port.
- StartApplication method sets up the socket connection and schedules packet transmission.
- SendPacket method sends a message to the peer node.
- ReceivePacket method receives and prints messages.
- Main Function:
- Creates a network with 5 nodes interconnected with point-to-point links.
- Sets up IP addresses for the nodes.
- Initializes the SecureApp, FirewallApp, and IDSApp applications on the respective nodes.
- The client sends secure messages, the firewall filters packets, the IDS monitors traffic, and the server receives messages.
Compile and Run
- Compile the Code: Compile the ns3 simulation code using the following command:
g++ -std=c++11 -o ns3-network-security main.cc `pkg-config –cflags –libs ns3-dev`
- Run the Simulation: Execute the compiled program:
./ns3-network-security
As we discussed earlier about how the network security architecture will perform in ns3 simulation tool and we help to provide further information about how the network security architecture will adapt in diverse simulation. If you need more help with implementing Network Security Architecture in the ns3 program, feel free to reach out to us. We have a lot of project ideas in this area, so share your details with us for extra support.