Enhancing Security with Identity-Based Network Access Control

Identity-Based Network Access Control for Non-Human Identities

In a world where machines and automated processes are becoming increasingly vital, understanding how to protect these non-human identities is essential. Identity-based network access control (ibac) is a key method used to manage and secure network access for devices that don’t have human users. Let’s break it down into simple steps and examples.

What are Non-Human Identities?

Non-human identities refer to any digital identity that does not belong to a person. This includes:

• Machines: Servers, routers, and IoT devices.
• Applications: Software that operates independently.
• Workloads: Tasks running on cloud platforms or servers.

Why Use Identity-Based Network Access Control?

Identity-based network access control (ibac) provides a framework to manage who or what can access network resources. Here’s why it matters:

• Security: Protects sensitive data from unauthorized access by ensuring only authenticated identities can connect.
• Efficiency: Streamlines access management for automated processes, reducing administrative burdens.
• Compliance: Helps organizations meet regulatory requirements by controlling access to critical systems.

How Does It Work?

ibac operates through several steps:

1. Authentication: Verifying the identity of a non-human entity. For machines and applications, this often involves technologies like:
   • mTLS (Mutual Transport Layer Security): Where both the client (e.g., an application) and the server present digital certificates to authenticate each other.
   • API Keys: Unique secret keys issued to applications or services to grant them access to specific resources or functionalities.
   • Service Accounts: Dedicated accounts with specific privileges, often used by applications or automated processes to interact with cloud services or other systems.
   • Tokens: Such as JSON Web Tokens (JWTs) or OAuth tokens, which carry claims about the identity and permissions of the non-human entity.
2. Authorization: Granting access based on predefined policies. This determines what resources the identity can access. For non-human identities, this might look like:
   • OAuth 2.0 Scopes: Defining granular permissions for applications, like "read-only access to user profiles" or "write access to specific data sets."
   • Network Segmentation Policies: Restricting network traffic based on the identity of the source or destination, ensuring only authorized machines can communicate with specific services.
   • Attribute-Based Access Control (ABAC): Policies that consider various attributes of the identity (e.g., device type, security posture, location) and the resource being accessed to make dynamic access decisions.
3. Audit: Keeping track of access attempts to ensure compliance and facilitate troubleshooting.

Example of IBAC in Action

Imagine a company that uses a cloud service to host its applications. Each application has its own identity that must be authenticated before accessing data. This could be happening within a cloud provider's secure network environment.

• The application, acting as a non-human identity, sends a request with its identity token (perhaps a JWT issued by the cloud provider's identity service).
• The cloud network's access control system checks if the token is valid, verifies its signature, and examines the claims within the token to determine what permissions the application's identity has.
• If the token is valid and the associated permissions allow it, the application gains access to the necessary cloud resources, like a database or storage bucket.

Types of Identity-Based Network Access Control

There are several types of ibac mechanisms that can be utilized, and how they apply to non-human identities:

• Role-Based Access Control (RBAC): Permissions are assigned based on the role of the identity. For machines, this means a server might have a "web-server" role granting it access to port 80/443, while a database server might have a "database-server" role allowing it to listen on port 5432. An application might have a "reporting-app" role that only allows it to read data from specific tables.
• Attribute-Based Access Control (ABAC): Decisions are made based on attributes of the identity and the context. For a machine, this could mean a server in a specific "production" environment can access sensitive data, but the same server in a "staging" environment cannot, even if it has the same identity. An application might only be allowed to access an api during business hours and from a specific subnet.
• Policy-Based Access Control: Access is managed according to specific policies set by the organization, often combining rbac and abac principles. For example, a policy might state that "any device with the 'iot-sensor' role, running firmware version 2.1 or higher, and connected from a trusted network segment, is allowed to send telemetry data to the data ingestion endpoint."

Real-Life Example: Securing IoT Devices

Consider a smart home system where various devices like thermostats, cameras, and lights are connected. Each device has a non-human identity:

• Authentication: Each device needs to authenticate itself to the home network. This often uses secure tokens like X.509 certificates embedded during manufacturing, or sometimes pre-shared keys (psks) for simpler devices. Protocols like MQTT authentication might be used if the devices communicate via an MQTT broker.
• Authorization: Depending on the device type, only certain functions are allowed. For example, a camera might only be able to stream video but not control other devices. This is enforced by policies tied to the device's identity.
• Audit: The system logs all access attempts, providing a trail for any issues.
• Credential Management: Securely managing these device identities is crucial. This involves secure provisioning of credentials during manufacturing, mechanisms for rotating credentials periodically to limit exposure if compromised, and robust revocation processes for devices that are lost, stolen, or decommissioned.

Process Flow Diagram

Here is a visual representation of how identity-based network access control functions:

Conclusion

By implementing identity-based network access control, organizations can not only improve their security posture but also ensure efficient management of their non-human identities. This means tasks like onboarding new devices or applications, revoking access for decommissioned equipment, or updating access policies across a fleet of machines become much simpler and more consistent. As we continue to rely on machines and automated systems, focusing on secure access will be crucial.