◇ OpenCyber Academy
Technical · Chapter 2 · English

Chapter 2 — Networks and protocols

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and protocols

Lesson map

Lesson 02 published. Map, example, EX005.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Protocols"]
  N2["2.2 TLS and segmentation"]
  N3["2.4 Signs of abuse"]
  N4["2.4b Documenting network settings"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX005"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Protocols"]
  N2["2.2 TLS and segmentation"]
  N3["2.4 Signs of abuse"]
  N4["2.4b Documenting network settings"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX005"]

[Learning outcomes]
    |
    v
[2.1 Protocols]
    |
    v
[2.2 TLS and segmentation]
    |
    v
[2.4 Signs of abuse]
    |
    v
[2.4b Documenting network settings]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX005]

Learning outcomes

You will (1) describe the protocols an AI service uses; (2) configure TLS and network segmentation; (3) set gateway limits; (4) recognise network signs of abuse.

2.1 Protocols

Customers reach HelpBot over HTTPS (HTTP over TLS); the orchestrator calls the vendor model API over HTTPS with an API key; internal services talk over HTTP or gRPC inside the private network; DNS resolves all names. Chat replies often stream, so connections stay open longer than ordinary requests.

Streaming affects security settings directly. A HelpBot reply can take 20 seconds to finish, so a gateway timeout tuned for ordinary page loads cuts answers off, and a timeout set too long lets one client hold hundreds of connections open. The vendor API call is the only connection that leaves Kestrel's network, and it carries the API key, so the egress rule for the orchestrator should allow that one host name and nothing else. DNS matters because a wrong resolution of the vendor host would send the key elsewhere.

2.2 TLS and segmentation

Use current TLS versions and valid certificates everywhere, including internal calls where possible. Segment networks: the router-management service should accept connections only from the tool service, not from the internet or the general office network. Firewall rules are written as allow-lists.

Segmentation is also what limits damage if the orchestrator is steered. Even with injected instructions in an article, the model can only ask the orchestrator for a tool; if the router-management service accepts connections only from the tool service, nothing else on the network can call it directly. Ana checked this by trying to reach the router-management port from the office network on the staging copy and recording that the connection was refused. A rule that was never tested is only a written intention.

2.3 Gateway limits

An API gateway enforces maximum request size, timeouts for streaming connections and rate limits per customer. Token-bucket limits allow normal bursts but cut floods. Limits protect availability and cost — OWASP LLM10 Unbounded Consumption.

"""Lab R: token-bucket limits against unbounded consumption (synthetic).
Simulates 60 seconds of requests from a normal client and a flooding client
against a model endpoint with a per-client token bucket."""
import random
rng = random.Random(4)
def simulate(rate_per_s, burst, reqs):
    tokens, last, ok = burst, 0.0, 0
    for t in reqs:
        tokens = min(burst, tokens + (t - last) * rate_per_s); last = t
        if tokens >= 1: tokens -= 1; ok += 1
    return ok
normal = sorted(rng.uniform(0, 60) for _ in range(90))
flood = sorted(rng.uniform(0, 60) for _ in range(3000))
for rate, burst in ((5, 20), (2, 10), (1, 5)):
    print(f"limit={rate}/s burst={burst:2d} normal_served={simulate(rate, burst, normal):3d}/90 "
          f"flood_served={simulate(rate, burst, flood):4d}/3000")

Expected output:

limit=5/s burst=20 normal_served= 90/90 flood_served= 319/3000
limit=2/s burst=10 normal_served= 90/90 flood_served= 129/3000
limit=1/s burst= 5 normal_served= 62/90 flood_served=  64/3000

The lab shows the trade-off in numbers. A limit of 5 per second with burst 20 served all 90 normal requests but let 319 of 3,000 flood requests through; 2 per second with burst 10 still served all 90 normal requests and cut the flood to 129; 1 per second with burst 5 cut the flood to 64 but served only 62 of 90 normal requests. The middle setting is the one Kestrel chose, because it costs customers nothing in the simulation. A daily token budget was added because a rate limit alone does not stop long messages.

2.4 Signs of abuse

Many requests from one account; many accounts from one address; traffic at odd hours; requests with very long inputs; sudden growth in tokens used. These are signals to investigate, not proof of attack.

Each signal has an innocent explanation as well. The account that sent 40,000 near-maximum messages over a weekend was clearly abnormal, but a family sharing one home router can produce many accounts from one address, and night-shift customers write at odd hours. Ana's rule is to combine at least two signals before escalating, and to check whether a leaked API key could explain the traffic before blaming a customer. The gateway logs must keep account ID, source address, message length and token count for these checks to be possible.

2.4b Documenting network settings

Record each firewall rule, gateway limit and certificate with its purpose and owner. When a limit is changed, record why. This helps the next technician understand settings during an incident.

A good entry is short. For the HelpBot gateway: "Per-account limit 2 requests/s, burst 10, daily token budget; purpose: stop single-account floods (the weekend bill spike); owner: service operations; changed after the 40,000-message incident; lab check: serves 90/90 normal, 129/3,000 flood." When a customer later complains of being throttled, the next technician can see why the limit exists before raising it, and can rerun the lab with the proposed values to see what the change would let through.

2.5 Worked example (synthetic Kestrel case)

HelpBot's vendor bill doubles in a weekend. Ana checks gateway logs: one customer account sent 40,000 messages, each near the maximum length. There was no per-account limit. She configures 2 requests per second with a burst of 10 and a daily token budget; in the lab analogue, that setting serves all 90 normal requests while admitting only 129 of 3,000 flood requests.

The numbers explain why the fix had two parts. A rate limit of 2 per second still allows over 170,000 requests a day from one account, so on its own it would have slowed the spike without capping the bill. The daily token budget caps the cost per account regardless of timing. Ana also checked that the account's API traffic came through the normal app login, ruling out a leaked vendor key, before recording the cause as a single abusive account.

2.6 Errors and limits

At Kestrel each of these would have defeated a control described in this chapter. If the router-management service were reachable from the office network, the ownership check in the tool service could be bypassed entirely. Without limits on streaming connections, one client can hold open hundreds of slow replies and exhaust the gateway even while staying under the request rate. Limits by IP address alone fail in both directions: one attacker can rotate addresses, and many genuine customers behind a shared mobile carrier address would be throttled together.

Exercises

Synthesis

Secure the protocols, segment the network so powerful tools are reachable only by their callers, and rate-limit AI endpoints to protect availability and cost.

Continue studying — chapter 02 of 18

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →

Worked answers

EX005. HTTPS/TLS (confidentiality and server authentication for customer chat), DNS (name resolution, to be protected from hijacking), internal HTTP/gRPC with mTLS (service-to-service), and the vendor API over HTTPS with a key (model calls).

EX006. Allow TCP 443 from the tool-service subnet or identity to router-management. Deny all other sources, including the office network and the internet. Log denied attempts.

EX007. 2/s with a burst of 10. It serves all 90 normal requests and admits only 129 of 3,000 flood requests. 1/s blocks legitimate users (62/90). 5/s lets 319 flood requests through.

EX008. Requests and tokens per account, input lengths, the time pattern, whether the vendor key was used from unexpected places (a leak), and new accounts created recently.