Design and implementation of Cross domain cooperative firewall Jerry Cheng, Hao Yang, Starsky H.Y. Wong, Petros Zerfos, Songwu Lu UCLA Computer Science Department, Los Angeles, CA 900951 Presented by david rodriguez 10/27/2016 What are they? They are firewalls at the entrance of an administrative network domain that work together to enable confidentiality and privacy for the users that cross domains by allowing or denying network traffic based its policy. They work in a cooperative, oblivious manner in that they share these policies with the external network firewall in order to protect themselves and the foreign network that the user is accessing. In the spirit of security, we must attempt to protect ourselves and the foreign network.

What’s wrong with using a normal firewall? Normally, when users are on foreign networks, they use an encrypted tunnel (Virtual Private Network) in order to communicate with their home network. This protects the information from Man in the Middle attacks. However, it also bypasses the foreign network firewall due to this encryption. The firewall can’t see into the encrypted tunnel. The firewall can’t enforce it’s policies.

Alternatives and Privacy issues * We could ask users not to encrypt their communication, but that defeats the whole purpose of a VPN. * We could also share our firewall policies with the foreign network so that they could implement independently. However, firewall policies can be used as inference regarding the internal network structure. Sharing could jeopardize our security and put us a further risk.

Keys to implementation The most important aspect of using a CDCF is that we can enforce each other’s firewall policies without knowing specifics about the policies. * We must be able to securely send firewall primitives across the network domains. * We must also perform oblivious membership verification.

How it works FOREIGN HOME Computer in foreign network starts a VPN connection. The VPN server authenticates the user using normal procedures.

How it works FOREIGN HOME Now CDCF takes over. By making changes to the VPN client and VPN server, the foreign network now knows to send a representative value for its Firewall policies. It encrypts them with it’s key and sends it to the home network.

How it works FOREIGN HOME The home network double-encrypts using its key and then sends it back to the foreign network.

How it works FOREIGN HOME The foreign network now has a doubly encrypted firewall rule set.

How it works FOREIGN HOME Now the client sends to the home network it’s connection descriptor that it encrypts with it’s key.

How it works FOREIGN HOME The home network encrypts again using it’s key and sends a representative value back to the foreign network.

How it works FOREIGN HOME Now, the foreign network has a double-encrypted rule set value and a doubly encrypted connection descriptor value.

How it works FOREIGN HOME These are double-encrypted to take advantage of the commutative properties of the cipher. Two parties can encrypt with two different keys and the cipher-text is not changed. This is not extremely secure, but it is quick enough and secure enough to transmit Firewall Rule sets. The cipher used in this paper was Polig-Hellman.

Commutative cipher “That is, when one uses the commutative cipher to apply two encryption operations on a message using two different keys, the order of these encryptions does not change the resulting cipher-text. Additionally, the order of the decryption does not affect the resulting plain text.” The cipher used in this paper was Polig-Hellman.

How it works FOREIGN HOME Now, the foreign network uses the oblivious comparison of singular values and the oblivious membership verification algorithms to match the doubly-encrypted connection descriptor with the doubly-encrypted rule set. Rule matching is done on the foreign network.

How it works FOREIGN HOME It compares and then sends the verdict to the home network.

How it works FOREIGN HOME The home network uses the verdict from the foreign network and enforces them via it’s firewall.

Note FOREIGN HOME Verification takes place on the foreign network. Enforcement takes place on the home network.

Note FOREIGN HOME * The verification comparison needs to take place in an oblivious manner so that the comparison is blind. The foreign network doesn’t know the firewall rules or connection descriptions. * Also, the verification/enforcement process only occurs once during the communication so that it does not interfere or slowdown traffic exchange.

ISSUES FOREIGN HOME *User connection privacy issues. The foreign performs the rule-matching. It is oblivious to the foreign network but inferences can be made based on the connections that are made. It can make inferences on the firewall rule set and the user connection descriptions based on behavioral/temporal analysis.

Privacy enhancements FOREIGN HOME Obfuscation: In order to increase privacy and decrease ease of analysis, dummy fields/rules and dummy connections are introduced in order to increase the degree of analysis. These result in an increase in difficulty of behavioral/temporal analysis and increase the data and the determination of data validity.

ISSUES FOREIGN HOME * Foreign Network Privacy: The foreign network rule set is sent in an encrypted form to the home network. However, a match must be made in order for the foreign network to send it’s validity check. The home network can probe the foreign network in order to reveal information about it’s network. The authors show that this is no more effective than a normal brute force probe and does not decrease the security of the foreign network.

Implementation Analysis As you can see in the graphs above, only the bootstrap phase of CDCF requires a significant about of overhead. This is due to the cross domain communication. This only occurs once during a communication.

conclusion The authors have proposed a novel process for mitigating foreign network risks associated with vpn interaction. Their proposal shows a process that increases privacy, decreases potential issues via encrypted channels, and does not substantially increase overhead or cost for their implementation.

Questions?