Midpoints Versus Endpoints: From Protocols to Firewalls

  • Authors:
  • Diana Bidder-Senn;David Basin;Germano Caronni

  • Affiliations:
  • ETH Zürich, 8092 Zürich, Switzerland;ETH Zürich, 8092 Zürich, Switzerland;Google Inc., Mountain View,

  • Venue:
  • ACNS '07 Proceedings of the 5th international conference on Applied Cryptography and Network Security
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Today's protocol specifications only define the behaviour of principals representing communication endpoints. But in addition to endpoints, networks contain midpoints, which are machines that observe or filter traffic between endpoints. In this paper, we explain why midpoints should handle protocols differently from endpoints and thus midpoint specifications are needed. With a case study, using the TCP protocol and three different firewalls as midpoints, we illustrate the consequences of the current lack of protocol specifications for midpoints, namely that the same protocol is implemented differently by the different firewalls. We then propose a solution to the problem: We give an algorithm that generates a midpoint automaton from specifications of endpoint automata. We prove that the resulting midpoint automata are correct in that they forward only those messages that could have resulted from protocol-conform endpoints. Finally, we illustrate the algorithm on the TCP protocol.