Capability-Based Egress Network Access Control for Transferring Access Rights

Abstract

In conventional egress network access control (NAC) using access control lists (ACLs), modifying ACLs is a heavy task for administrators. To enable rapid configuration without a large amount of effort by administrators, we introduce capabilities to egress NAC. In our egress NAC, a user can transfer his/her access rights (capabilities) to other persons without asking administrators. To realize capability-based egress NAC, we use DNS messages and IP options to carry capabilities. A resolver of the client sends the user name, domain name, and service name as DNS query messages to a DNS cache server, which issues capabilities according to a policy and sends them as DNS answer messages to the client. The client kernel includes these capabilities in the IP options of packets and sends them to the router. The router checks the capabilities of the packets to determine whether to pass or block them. In this paper, we describe the design and implementation of our method in detail. Experimental results show that our method does not reduce the router's performance.

Capability-based egress network access control by using DNS server

“…In the paper Suzuki et al (2005), we have described a method that uses an operating system kernel to manage capabilities. In this paper, we use a utility program called capability-agent to manage capabilities outside the kernel.…”

“…To carry capabilities, we have extended the DNS message format and defined a new IP option (Suzuki et al, 2005).…”

“…To reduce the network administrator's burden, we introduce capabilities into egress NAC (Suzuki et al, 2005). We call such an egress NAC capability-based egress NAC.…”

Design and implementation of client agent in the Network Admission Control

“…Client agent playing a very important role is at the forefront of the system. If there is no clear definition of its function or the improper design, client agent can not perform its function, and the entire NAC namely only exists [5]. So it is very essential to study the client agent in-depth.…”

TNC-compatible NAC System implemented on Network Processor

“…Network Access Control (NAC) is defined as some control mechanisms which are enforced by network administrators at routers or proxies as to authenticate users and machines to authorize them to access the network [1]. Network access control technology plays an increasingly important role in computer network security, especially against security challenges brought by ubiquitous applications on the heterogeneous networks.…”