Security

Protected Connection

To stop questionable traffic from making its way onto the network, learn how a standards-based NAC approach works.

Lisa Lorenzin is principal solutions architect for Juniper Networks.

The Trusted Computing Group has developed an open architecture and standards for Network Access Control called Trusted Network Connect. TNC is vendor-neutral, offering strong security through trusted computing.

TNC defines an architecture and interface that allows interrogation of an endpoint to determine its integrity and compliance with security policies. The architecture starts with three primary components:

Access Requestor: An AR is a device requesting access to the network (such as an endpoint).
Policy Enforcement Point: A PEP is a device controlling access to the network by assimilating and enforcing policy decisions. Some examples include an 802.1X-enabled switch or access point, or a firewall or VPN gateway).
Policy Decision Point: A PDP is a device that makes policy decisions and provisions them to the PEP.

(Figure 1: Basic NAC Architecture)

TNC interfaces standardize communication between these components at the network, transport and application layers. This enables a PDP to interrogate an endpoint, determine user identity and endpoint integrity, and make an access control decision based on the resulting information. The PDP sends a policy decision to the PEP, telling it whether to permit access, deny access or quarantine the endpoint.

Integrating Other Security Devices

The TNC specifications include an interface, IF-MAP, which extends the TNC architecture to allow data sharing across a variety of security and networking systems. The Metadata Access Point, or MAP, is a central clearinghouse for endpoint metadata.

MAP clients can publish, search for and subscribe to notifications about that metadata. This extends the traditional NAC architecture to include additional network and security components, such as intrusion prevention systems (IPSes), vulnerability scanners, Dynamic Host Configuration Protocol (DHCP) servers and application servers. These components can act as sensors adding data to the MAP and act upon information received from other components.

(Figure 2: NAC Architecture with MAP Integration)

In a typical IF-MAP-enabled environment, when a PDP authenticates an endpoint to the network, it publishes endpoint metadata (ranging from user identity and role to endpoint MAC address and network location) to the MAP and subscribes to information on that session. A DHCP server then publishes metadata, mapping the endpoint MAC address to an IP address; an IPS detects unauthorized activity by that IP address and publishes metadata on the violation. The MAP notifies the PDP of changes to the metadata for that session. Because the endpoint has sent unauthorized traffic, the PDP dynamically changes its policy to limit the endpoint’s access control privileges, and the PEP implements the access control restrictions.

TPM: Hardware-Based Security

The Trusted Platform Module is a hardware security component based on open specifications developed by the Trusted Computing Group. Uniquely bound to a single platform, each TPM’s functions and storage are isolated from other components of the device, and the chip resists physical tampering and software attacks.

Applications for the TPM include strong user and machine authentication, secure storage and trusted boot. TPMs are included in almost all enterprise notebook and desktop systems, as well as many servers and a variety of TPM-enabled products. For example, Microsoft’s BitLocker, providing full-disk encryption, can leverage a TPM for key storage and optional integrity measurements.

A TPM provides security capability similar to a smart card but embedded into the platform. The TPM chip itself is the central hardware security device that handles trusted operations and cryptographic functions. A standardized high-level application programming interface provides the operating system and applications access to the functions of the TPM. Finally, the Core Root of Trust for Measurement (CRTM) is a set of instructions executed at the start of each boot process, before the OS is available, to achieve secure startup. These are the first instructions executed during the boot of the platform; trust in any integrity measurements depends on trust in CRTM.

Disabled by default, a TPM can be activated to support multiple security functions, including measurement, recording and reporting of integrity metrics; the protection and storage of keys and other small data; and providing verifiable evidence of all of these items. TPM chips use RSA cryptography for key signing and encryption/decryption.

A key capability of the TPM is remote attestation, the process of vouching for the accuracy of information. This feature is essential to preventing the lying-endpoint problem. Short of physically tapping into the motherboard connection, the only way to reset the data stored in the TPM is by a hard reboot, so if an endpoint is compromised, that will be reflected in the integrity measurements stored in the TPM.

The full set of TNC specifications is available for free. Manufacturers have been shipping TNC-based products for more than three years.

The Trusted Computing Group, an industry standards organization, comprises more than 100 members, including large and small vendors, enterprises and government organizations. To learn more, go to trustedcomputinggroup.org.