home workers node how to extend intranet security to the home

Home Workers Node

How to extend Intranet security to the home

Requirements

• Secure enough to be acceptable by intranet security officers– intrusion– denial of service

• Convenient enough to be acceptable by employees– intranet should feel local at home– full internet access

System overview

Client (e.g. PC)

Evil spouse

Evil ISPemployee

Evil hacker

Local net

e-boxAccess net

ISPInternet

FirewallIntranet

Resource(e.g. Web)

Who cares

Universe splitter

• DNS requests are intercepted • Intranet names are assigned a local private

range IP address• Name + IP nr. registered at guard• Packages with these addresses are forwarded to

guard• Guard tunnels packages if profile allows• NAT used for Internet access

Logical view

Client (e.g. PC)

GuardDNS

Proxydevice

Guard

Firewallproxy

people.ericsson.

se

www.apple.com

? people.ericsson.se

DNS10.0.0.14 !

? Ab%$12AnC^6as*mS (SSL)

? 195.16.78.12 GET

Profiles

? www.apple.com17.254.0.91 !

? www.apple.com17.254.0.91 !

? 10.0.0.14 GET

? 1

7.2

54

.0.9

1 G

ET 10.0.0.14=people.ericsson.see-box

Spouse attack

• Only defined local clients can access guard services

• Profile at firewall defines limited resource access

• Auditing• Login can be strengthened by SMS login

ISP attack

• Eavesdropping impossible due to SSL link between guard and firewall

• Denial of service can be prevented with multiple ISPs

Hacker attack

• Private IP range used for intranet aliases are skipped by every router

• e-box does not allow remote login• No forwarding of external packets via guard• Only access is from client on local net. This

requires physical access (e-box alarm system?)

Guard DNS

• Act as DNS server for local net• Detect requests for intranet services

– Assign private IP number as alias– Inform guard of assignment

• If not known, forward to system DNS• Simple package, can be written in Java (IBM

has done it)

Proxy device

• Intercept IP packets in guard range• Push packets to Guard• Very simple Linux device driver. Many

examples available• Written in C

Guard

• Create an SSL tunnel over the internet to the firewall

• Authenticate secure• Inform firewall of private aliases• Forward packets both ways• SSL software freely available

Firewall

• Accept tunnels from guards• Authenticate• Forward packets if they are allowed by the

profile of the e-box• Manage the profiles of the employee

– Certificates– Self care Company policies

• Standard solutions?

Strengths

• Allows any type of client– PCs– Web pads

• Offers full internet access– games, LDAP, applets

• Allows multiple intranets if e-box is trusted• No special cards

Weaknesses

• Local net is not fully secure• No standard software• New concept, requires convincing security

officers