2nd International ICST Conference on Security and Privacy in Comunication Networks

Research Article

Leveraging IPsec for Mandatory Per-Packet Access Control

  • @INPROCEEDINGS{10.1109/SECCOMW.2006.359530,
        author={Trent  Jaeger and David H. King and Kevin R.  Butler and Serge Hallyn and Joy Latten and Xiaolan  Zhang},
        title={Leveraging IPsec for Mandatory Per-Packet Access Control},
        proceedings={2nd International ICST Conference on Security and Privacy in Comunication Networks},
  • Trent Jaeger
    David H. King
    Kevin R. Butler
    Serge Hallyn
    Joy Latten
    Xiaolan Zhang
    Year: 2007
    Leveraging IPsec for Mandatory Per-Packet Access Control
    DOI: 10.1109/SECCOMW.2006.359530
Trent Jaeger1,*, David H. King1,*, Kevin R. Butler1,*, Serge Hallyn2,*, Joy Latten2,*, Xiaolan Zhang3,*
  • 1: Systems and Internet Infrastructure Lab, Pennsylvania State University
  • 2: IBM Linux Technology Center
  • 3: IBM T.J. Watson Research Center
*Contact email: tjaeger@cse.psu.edu, dhking@cse.psu.edu, butler@cse.psu.edu, serue@us.ibm.com, latten@us.ibm.com, cxzhang@us.ibm.com


Mandatory access control (MAC) enforcement is becoming available for commercial environments. For example, Linux 2.6 includes the Linux security modules (LSM) framework that enables the enforcement of MAC policies (e.g., type enforcement or multi-level security) for individual systems. While this is a start, we envision that MAC enforcement should span multiple machines. The goal is to be able to control interaction between applications on different machines based on MAC policy. In this paper, we describe a recent extension of the LSM framework that enables labeled network communication via IPsec that is now available in mainline Linux as of version 2.6.16. This functionality enables machines to control communication with processes on other machines based on the security label assigned to an IPsec security association. We outline a security architecture based on labeled IPsec to enable distributed MAC authorization. In particular, we examine the construction of a xinetd service that uses labeled IPsec to limit client access on Linux 2.6.16 systems. We also discuss the application of labeled IPsec to distributed storage and virtual machine access control