An application-layer based centralized information access control for VPN

INTRODUCTION AND BACKGROUND In the last decade, as the Internet becomes a popular low-cost backbone infrastructure, many or- ganizations and companies use it to establish their secure private network, which is known as VPN (Virtual Private Network) technology (Cohen, 2003). Generally, VPN implements confidentiality of data, message integrity and endpoint authentication by the security protocols (such as IPSec: IP Security (Kent and Atkinson, 1998) and TLS/SSL: Transport Lay…

An application-layer based centralized information access control for VPN

With the rapid development of Virtual Private Network (VPN), many companies and organizations use VPN to implement their private communication. Traditionally, VPN uses security protocols to protect the confidentiality of data, the message integrity and the endpoint authentication. One core technique of VPN is tunneling, by which clients can access the internal servers traversing VPN. However, the tunneling technique also introduces a concealed security hole. It is possible that if one vicious user can establish tunneling by the VPN server, he can compromise the internal servers behind the VPN server. So this paper presents a novel Application-layer based Centralized Information Access Control (ACIAC) for VPN to solve this problem. To implement an efficient, flexible and multi-decision access control model, we present two key techniques to ACIAC—the centralized management mechanism and the stream-based access control. Firstly, we implement the information center and the constraints/events center for ACIAC. By the two centers, we can provide an abstract access control mechanism, and the material access control can be decided dynamically by the ACIAC’s constraint/event mechanism. Then we logically classify the VPN communication traffic into the access stream and the data stream so that we can tightly couple the features of VPN communication with the access control model. We also provide the design of our ACIAC prototype in this paper. Project (No. 60373088) supported by the National Natural Science Foundation of China