Application access control at network level

ABSTRACT

This paper describes an access control mechanism that enforces at the network level an access control decision that is taken at the application level. The mechanism is based on the pre-computation of encrypted counters called tickets. An access enforcement device verifies the existence of a valid ticket in each packet that is subject to access control and kills unauthorized packets. Tickets are not computed as a function of the user data. Due to the timing constraints of shared media LANs the presence of a valid ticket in a packet proves that the operation implied by the user data has been authorized. The access control mechanism is elaborated for Internet protocols over Ethernet and we discuss its properties for internetworking and multicasting.

REFERENCES

• 1: Estrin, D., Mogul, J.C., Tsudik, G., Anand, K., "Visa Protocols for Controlling Inter-Organizational Datagram Flow: Extended Description," USC TR 88- 50, 1988.
• 2: '~Data Encryption Standard", FIPS 46, NBS, Jan 77.
• 3: Rivest, R., "The MD5 Message Digest Algorithm Draft," July 1991.
• 4: Gene Tsudik, Message authentication with one-way hash functions, Proceedings of the eleventh annual joint conference of the IEEE computer and communications societies on One world through communications (Vol. 3), p.2055-2059, May 1992, Florence, Italy
• 5: Reynolds, J., Postel, J., "Assigned Numbers", Network Working Group, Request for Comments: 1340, July 1992.
• 6: Rtitsche, E., "Multimedia Communication Subsystems: Architectures, Interfaces and Implementation," Ph.D. Thesis ETH Ziirich, Nr. 10228, VDI Verlag, Reihe 10, Nr. 257, Dtisseldorf 1993, pp. 129 -134.
• 7: Cryptech, "DES PROCESSOR," Cryptech, DOC 00552008E-ED01, 1989.
• 8: Cheswick, B., 'T)esign of a Secure Interact Gateway", Proceedings of the USENIX Summer 1990 Conference, Anaheim, CA, June 1990, pp. 233-237.
• 9: Treese, G.W., Wolman, A., "X Through the Firewall and Other Application Relays," DEC CRL, 93/10, May 1993.
• 10: S inah, A., Path, R., "An Introduction to Network Programming Using the Netbios Interface", Microsoft Systems Journal, Mar, 1992
• 11: Stephen E. Deering , David R. Cheriton, Multicast routing in datagram internetworks and extended LANs, ACM Transactions on Computer Systems (TOCS), v.8 n.2, p.85-110, May 1990 [doi>10.1145/78952.78953]

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

General Terms:
Design, Security, Theory