1. How to extend Intranet security to the home
Home Workers Node
How to extend Intranet security to the home

2. Requirements
Secure enough to be acceptable by intranet security officers
intrusion
denial of service
Convenient enough to be acceptable by employees
intranet should feel local at home
full internet access

3. System overview Client (e.g. PC) e-box ISP Firewall Resource
Evil spouse
Client
(e.g. PC)
Local net
e-box
Evil ISP
employee
Access net
ISP
Evil hacker
Internet
Firewall
Who cares
Intranet
Resource
(e.g. Web)

4. Universe splitter DNS requests are intercepted
Intranet names are assigned a local private range IP address
Name + IP nr. registered at guard
Packages with these addresses are forwarded to guard
Guard tunnels packages if profile allows
NAT used for Internet access

5. Logical view Client (e.g. PC) Guard DNS Proxy device Guard Firewall
? people.ericsson.se ?
Client
(e.g. PC) !
Guard
DNS !
DNS ? !
? GET
=people.ericsson.se
e-box
Proxy
device
Guard
? GET
? Ab%$12AnC^6as*mS (SSL)
www.
apple.
com
Firewall
proxy
people.
ericsson. se
? GET
Profiles

6. Spouse attack Only defined local clients can access guard services
Profile at firewall defines limited resource access
Auditing
Login can be strengthened by SMS login

7. ISP attack
Eavesdropping impossible due to SSL link between guard and firewall
Denial of service can be prevented with multiple ISPs

8. Hacker attack
Private IP range used for intranet aliases are skipped by every router
e-box does not allow remote login
No forwarding of external packets via guard
Only access is from client on local net. This requires physical access (e-box alarm system?)

9. Guard DNS Act as DNS server for local net
Detect requests for intranet services
Assign private IP number as alias
Inform guard of assignment
If not known, forward to system DNS
Simple package, can be written in Java (IBM has done it)

10. Proxy device Intercept IP packets in guard range Push packets to Guard
Very simple Linux device driver. Many examples available
Written in C

11. Guard Create an SSL tunnel over the internet to the firewall
Authenticate secure
Inform firewall of private aliases
Forward packets both ways
SSL software freely available

12. Firewall Accept tunnels from guards Authenticate
Forward packets if they are allowed by the profile of the e-box
Manage the profiles of the employee
Certificates
Self care Company policies
Standard solutions?

13. Strengths Allows any type of client Offers full internet access
PCs
Web pads
Offers full internet access
games, LDAP, applets
Allows multiple intranets if e-box is trusted
No special cards

14. Weaknesses Local net is not fully secure No standard software
New concept, requires convincing security officers