AFei,
You used the phrase ‘enforce security’ but that might be a bit too vague.
It seems that you are trying to provide some kind of access control to a set
of services. The access control is based on having ‘your software’
installed on a host accessing those services.
It also seems that you are interested in privacy (and integrity) since you
seem to be planning to implement encryption of packets between the
endpoints. If simply possessing your IM driver is the only requirement to
enable communication with these services that might not meet your true
security requirements.
If you use encryption of some kind, you will need to address how to
distribute keys to the endpoints to use in the encryption. This is often a
much more difficult problem and more critical to the overall ‘security’ of
the system. IPSec systems typically use the IKE protocol to accomplish
this.
As for your question about how to control which packets to process (encrypt)
I encourage you to look at the policy database mechanisms that a typical
IPSec implementation includes. The SPD and SAD ‘databases’ provide the
mechanism to specify what endpoints, networks, etc. are allowed/required to
communicate with some level of security and to specify the acceptable
security mechanisms.
If you are implementing an IPSec encapsulation mechanism as an IM driver,
you might consider also implementing the IPSec policy and configuration
mechanism to control it. The mechanism is rich and expressive and
completely capable of specifying whatever sort of access policy your servers
(services, really) require.
If you need to trigger your security enforcement mechanism (the IM driver)
based on individual user applications (instead of just the network traffic),
you might consider using a WSock Layered Service Provider (LSP) to know when
the user application has started and attempted to communicate with the
network. The LSP could then ‘provision’ the security policy in the IM
driver appropriately.
Lastly I encourage you to look at the native IPSec implementation in
Windows. It may already be able to support your needs (unless your needs
are IPSec-like and not true IPSec).
Good Luck,
Dave Cattley
Consulting Engineer
Systems Software Development
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of AFei
Sent: Thursday, June 02, 2005 6:05 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Detect WWW access in NDIS IM driver?
Hi Michal, thanks for your reply. Actually I’m just using the IPSec concept
here, the purpose of this driver is to enforce the security for some network
servers, except all the internal endpoints, only the clients which installed
my driver should be able to use the services on these servers. There might
be some other ways to do this of course. I can achieve this by encrypting
the external packets. For the implementation point of view, there’s no
difference between encrypting a range of IPs and encrypting all the external
IPs. As you said, seems the NDIS driver sits too low to get some network
configurations, it might be better to let the user mode application detect.
Thanks a lot,
AFei