Directed Security Policies: A Stateful Network Implementation

Abstract

Large systems are commonly internetworked. A security policy describes the communication relationship between the networked entities. The security policy defines rules, for example that A can connect to B, which results in a directed graph. However, this policy is often implemented in the network, for example by firewalls, such that A can establish a connection to B and all packets belonging to established connections are allowed. This stateful implementation is usually required for the network's functionality, but it introduces the backflow from B to A, which might contradict the security policy. We derive compliance criteria for a policy and its stateful implementation. In particular, we provide a criterion to verify the lack of side effects in linear time. Algorithms to automatically construct a stateful implementation of security policy rules are presented, which narrows the gap between formalization and real-world implementation. The solution scales to large networks, which is confirmed by a large real-world case study. Its correctness is guaranteed by the Isabelle/HOL theorem prover.

Agile Network Access Control in the Container Age

“…But the policy does currently not permit packets to flow from the web frontend to the Internet. Therefore, using the specification of the security goals again, topoS can convert a security policy into a stateful policy [17]. The result is shown in Figure 6.…”

“…Their core functionality can also be reused as a library in further projects. In this article, we will not present the formal background [7], [12], [14], [15], [17], instead, we demonstrate applicability from an operator's point of view; not requiring a single formula.…”

Semantics-Preserving Simplification of Real-World Firewall Rule Sets

“…Unfolded Synology Firewall allows non-terminating rulesets; however, the only rulesets that are interesting for analysis are the ones actually accepted by the Linux kernel. 6 Since it rejects rulesets with loops, both our algorithm and the resulting ruleset are guaranteed to terminate. Corollary 1.…”

“…The ESTABLISHED rule essentially allows packet flows in the opposite direction of all subsequent rules [6]. Unless there are special security requirements (which is not the case in any of our analyzed scenarios), the ESTABLISHED rule can be excluded when analyzing the connection setup [6, Corollary 1].…”

Demonstrating topoS: Theorem-prover-based synthesis of secure network configurations

“…Note that a flow with the stateful attribute might allow packets in the opposite direction of the policy rule and thus potentially violate security invariants. Defining the following two consistency criteria, the stateful attributes can be computed automatically [9]: 1) No information flow violation must occur 2) No access control side effects must be introduced To compute the stateful policy, not only a single rule but a set S is to be upgraded to stateful rules. However, the interaction of the rules and answer paths of S must not introduce negative implications.…”