Multi-factor network segmentation
Implementation(s) for multi-factor network segmentation are described. A plurality of packets at a higher layer of a network stack is processed, where at least one packet of the plurality of packets was previously determined, as part of processing the at least one packet at lower layers of the network stack, to be authorized to be processed by the higher layer. Specifically, responsive to successful authentication of a cryptographic certificate received during the handshake process, a second service is identified from the cryptographic certificate. It is determined, based on a security policy, that the second service is authorized to access the first service. Responsive to the determination, a configuration is caused such that packets sent using the source address are now authorized to be processed by the higher layer.
1. A non-transitory machine-readable storage medium that provides instructions that, if executed by a set of one or more processors in one or more electronic devices, are configurable to cause the performance of operations, comprising:
processing a plurality of packets at a higher layer of a network stack,
wherein at least one packet of the plurality of packets was previously determined, as part of processing the at least one packet at lower layers of the network stack, to be authorized to be processed by the higher layer based on a determination that the at least one packet is associated with a handshake process to establish an encrypted connection, wherein the at least one packet is destined for a destination address associated with an instance of a first service, wherein the at least one packet was sent using a source address, wherein packets sent using the source address are otherwise configured to be unauthorized to be processed by the higher layer, and
wherein the processing at the higher layer includes:
responsive to successful authentication of a cryptographic certificate received during the handshake process, identifying from the cryptographic certificate a second service, wherein an instance of the second service is associated with the source address; and
determining, based on a security policy that defines the first and second service as being respectively within a first and second segment of a network, that the second service is authorized to access the first service; and
responsive to the determination, causing a configuration such that packets sent using the source address are now authorized to be processed by the higher layer.
2. The non-transitory machine-readable storage medium of claim 1 , wherein the lower layers and higher layer of the network stack are implemented on one electronic device within the first segment of the network.
3. The non-transitory machine-readable storage medium of claim 1 , wherein the lower layers of the network stack are implemented on a first electronic device within the first segment of the network, wherein a part of the higher layer of the network stack is implemented on a second electronic device within the first segment of the network, and wherein the configuration is implemented on the first electronic device.
4. The non-transitory machine-readable storage medium of claim 1 , the operations further comprising:
receiving a subsequent packet sent using the source address; and
responsive to the subsequent packet, authorizing, based on the configuration, the subsequent packet to be processed by the higher layer.
5. The non-transitory machine-readable storage medium of claim 1 , wherein the determination that the at least one packet being associated with a handshake process includes determining that the at least one packet is a first packet of the handshake process, and wherein the operations further comprising:
responsive to the determination that the at least one packet is the first packet of the handshake process, storing a data record for the network connection associated with the handshake process; and
responsive to receiving a first subsequent packet sent using the source address, determining that the stored data record exists and, in response, authorizing the first subsequent packet to move further in the lower layers of the network stack.
6. The non-transitory machine-readable storage medium of claim 5 , the operations further comprising:
responsive to determining that the handshake process fails, removing the stored data record; and
responsive to receiving a second subsequent packet sent using the source address, determining that there is no data record for an existing network connection associated with the handshake process and, in response, denying the second subsequent packet further movement in the lower layers of the network stack.
7. The non-transitory machine-readable storage medium of claim 1 , wherein the handshake process uses mutual authentication.
8. A method for network segmentation, implemented by one or more electronic devices, the method comprising:
processing a plurality of packets at a higher layer of a network stack,
wherein at least one packet of the plurality of packets was previously determined, as part of processing the at least one packet at lower layers of the network stack, to be authorized to be processed by the higher layer based on a determination that the at least one packet is associated with a handshake process to establish an encrypted connection, wherein the at least one packet is destined for a destination address associated with an instance of a first service, wherein the at least one packet was sent using a source address, wherein packets sent using the source address are otherwise configured to be unauthorized to be processed by the higher layer, and
wherein the processing at the higher layer includes:
responsive to successful authentication of a cryptographic certificate received during the handshake process, identifying from the cryptographic certificate a second service, wherein an instance of the second service is associated with the source address; and
determining, based on a security policy that defines the first and second service as being respectively within a first and second segment of a network, that the second service is authorized to access the first service; and
responsive to the determination, causing a configuration such that packets sent using the source address are now authorized to be processed by the higher layer.
9. The method of claim 8 , wherein the lower layers and higher layer of the network stack are implemented on one electronic device within the first segment of the network.
10. The method of claim 8 , wherein the lower layers of the network stack are implemented on a first electronic device within the first segment of the network, wherein a part of the higher layer of the network stack is implemented on a second electronic device within the first segment of the network, and wherein the configuration is implemented on the first electronic device.
11. The method of claim 8 , the method further comprising:
receiving a subsequent packet sent using the source address; and
responsive to the subsequent packet, authorizing, based on the configuration, the subsequent packet to be processed by the higher layer.
12. The method of claim 8 , wherein the determination that the at least one packet being associated with a handshake process includes determining that the at least one packet is a first packet of the handshake process, and wherein the method further comprising:
responsive to the determination that the at least one packet is the first packet of the handshake process, storing a data record for the network connection associated with the handshake process; and
responsive to receiving a first subsequent packet sent using the source address, determining that the stored data record exists and, in response, authorizing the first subsequent packet to move further in the lower layers of the network stack.
13. The method of claim 12 , the method further comprising:
responsive to determining that the handshake process fails, removing the stored data record; and
responsive to receiving a second subsequent packet sent using the source address, determining that there is no data record for an existing network connection associated with the handshake process and, in response, denying the second subsequent packet further movement in the lower layers of the network stack.
14. The method of claim 8 , wherein the handshake process uses mutual authentication.
15. A set of one or more electronic devices configured for network segmentation, the set of electronic devices comprising:
a set of one or more processors; and
a set of one or more non-transitory machine-readable storage mediums that provide instructions that, if executed by the set of processors, are configurable to cause the set of electronic devices to perform operations comprising:
processing a plurality of packets at a higher layer of a network stack,
wherein at least one packet of the plurality of packets was previously determined, as part of processing the at least one packet at lower layers of the network stack, to be authorized to be processed by the higher layer based on a determination that the at least one packet is associated with a handshake process to establish an encrypted connection, wherein the at least one packet is destined for a destination address associated with an instance of a first service, wherein the at least one packet was sent using a source address, wherein packets sent using the source address are otherwise configured to be unauthorized to be processed by the higher layer, and
wherein the processing at the higher layer includes:
responsive to successful authentication of a cryptographic certificate received during the handshake process, identifying from the cryptographic certificate a second service, wherein an instance of the second service is associated with the source address; and
determining, based on a security policy that defines the first and second service as being respectively within a first and second segment of a network, that the second service is authorized to access the first service; and
responsive to the determination, causing a configuration such that packets sent using the source address are now authorized to be processed by the higher layer.
16. The set of electronic devices of claim 15 , wherein the lower layers and higher layer of the network stack are implemented on one electronic device within the first segment of the network.
17. The set of electronic devices of claim 15 , wherein the lower layers of the network stack are implemented on a first electronic device within the first segment of the network, wherein a part of the higher layer of the network stack is implemented on a second electronic device within the first segment of the network, and wherein the configuration is implemented on the first electronic device.
18. The set of electronic devices of claim 15 , the operations further comprising:
receiving a subsequent packet sent using the source address; and
responsive to the subsequent packet, authorizing, based on the configuration, the subsequent packet to be processed by the higher layer.
19. The set of electronic devices of claim 15 , wherein the determination that the at least one packet being associated with a handshake process includes determining that the at least one packet is a first packet of the handshake process, and wherein the operations further comprising:
responsive to the determination that the at least one packet is the first packet of the handshake process, storing a data record for the network connection associated with the handshake process; and
responsive to receiving a first subsequent packet sent using the source address, determining that the stored data record exists and, in response, authorizing the first subsequent packet to move further in the lower layers of the network stack.
20. The set of electronic devices of claim 19 , the operations further comprising:
responsive to determining that the handshake process fails, removing the stored data record; and
responsive to receiving a second subsequent packet sent using the source address, determining that there is no data record for an existing network connection associated with the handshake process and, in response, denying the second subsequent packet further movement in the lower layers of the network stack.
21. The set of electronic devices of claim 15 , wherein the handshake process uses mutual authentication.