[main menu]

What's New, Fall 1999

Incarna (m.s.b)
View the architectural framework design draft for the analytic engine of Incarna, a traffic-parsing firewall.

[header] | [seasons - subjects]

Port Wars (beef!; a version of this article appeared in volume 4, issue 35, of the ACM magazine Ubiquity .)
As the operating system evolved, a large market emerged in add ons. Little programs such as word processors, defragmenters, image viewers, and so forth appeared. You bought the OS, then you needed to keep on buying.

When the firewall becomes a killer application (see Domain-Nation) , it will need add ons, too. In particular, it needs:

• Traffic analyzers to deliver corporate intelligence reports and knowledge management (hard skill: stream parsing for corporate intelligence);
• Log enhancers, so it can record a wide and adjustable (variable width and content type) swath of network traffic (hard skill: flexible, organic data structuring);
• Protocol port retainers to reserve and protect for custom use specific Internet ports. The architecture of TCP/IP leaves a 16-bit field to count ports, meaning there can be only 65,536 of them and they are strategic turf (hard skill: socket programming and war hacking).

Only the most modular firewall designs will survive because modularity makes them easily extensible, a necessity in the new environment. This is so because new services often need new ports (or squabble over existing ports) and the firewall must take this into account. Firewalls today are not modular and are hard to add pieces to. Like any monolithic design, pack on too much and it turns brittle, snapping. A firewall that cannot be updated to flexibly and rapidly reserve, protect, monitor, analyze, and release those valuable ports will be worthless.

The entities controlling and tweaking the master firewalls nearest the backbone are the governments, regulatory agencies, telcos, cable providers, and satellite bandwidth suppliers. They have the undisputed port bottlenecking power. They are censors delivering rivers of filtered information from the delta to segregated, internal communities.

Users further downstream will further screen the data with their own firewalls that other, sometimes smaller, service firms install and tweak. At the capillary nodes are parents and department bosses looking to protect their flock from the words "breast" and "thigh" and "job offer." Crackers will move in the trenches, attempt to hijack ports and place bugs, remote-control devices, and banner ads for competitors on them.

As media and entertainment firms and big consulting shops jump into the act, this data sanitizing bottlenecking and port combat will be passed off as content programming and rough-and-tumble business. The "NYTimesNetNewsProtocol" and the "AllNudeNewsProtocol" will battle for port use under the leadership of pointy-haired blowhards from Accenture and PricewaterhouseCoopers. Wealthy entities, then, will ask the telcos and cable providers et al. to tweak their firewalls; wealthier entities will contract to multiple firewall providers (using at least one for data security and the rest for the custom content only Disney and Time-Warner and the local house of worship can provide).

Small fry and home users will be on their own and they will see stickershock. The existing home-alarm and consumer-security firms will take to this market and consultants will move in to train and supply their staff. Eventually the home-alarm and consumer-security firms will consolidate into fewer, larger enterprises.

The porn industry will supply the amusement factor here, providing encrypted, fetish-tuned streams to dedicated IP ports within virtual communities of like-minded affectionate souls. You will turn on the news to learn of the newest court-battle over who is allowed to communicate using specific ports, whether a port can be privately owned, and whether these are Constitutional rights. Welcome to tomorrow.

[header] | [seasons - subjects]

Domain-Nation (beef!; a version of this article appeared in volume 1, issue 5, of the ACM magazine Ubiquity .)
Someday soon your home will be a network domain. Your appliances will have IP addresses and communicate with each other and over the Net with their manufacturer. You will control them remotely from, say, your Palm Pilot or cell phone (although, most likely you will prefer these as a single device).

Your home will be part of several larger domains, including your neighborhood association, your workplace(s), your professional societies, and the people you call your pals. Further, you will create domains as you need them, to establish ad hoc work groups or to explore common interests with other people. Part of the richness of your life will reside in the number of domains you inhabit.

There even will be architectural domains, for example, the Sears Tower or Comiskey Park, so these large engineered structures can be remotely administered from a single point. Cities and then nations will get on the domain bandwagon. It is not hard to imagine.

These entities will be called "dynamically generated domains" or "dynamically generated networks" or "virtual private domains." To keep snoops out during those moments when you are transferring strategic plans or love letters, you will encrypt the information you share on the Net in a way only your intended audience can decipher.

The killer application at the heart of this new form of socializing will be the lowly firewall. The tool rising to prominence is the one we rely on to keep bad people out of our computers (and networks) and bad programs in our computers (and networks) from jabbering to the rest of the world.

Your corporate domains already are firewalled. But your house will need a firewall, too. Do you want some cracker spoofing your refrigerator into shutting off, or turning your thermostat all the way down in the dead of Winter, or opening your garage door while you are not home? The same goes for the architectural domains. We do not want crackers shutting off the elevators in the Sears Tower.

To handle these new responsibilities, firewalls will have a fuller set of features. Firewalls need to control inbound and outbound traffic, of course, and do so at a tight granularity (down to the IP address and port). They do this using a file called a ruleset and each domain needs a different ruleset. As you interconnect and work on and disconnect from the various domains of your networked world, your firewall must refer to, or generate, the proper ruleset to maintain the level of security you require. These are the rulesets of your life and they will be important files that reveal much about you.

As a matter of fact, the firewall is the ideal point to establish your domain interconnections. It will function like a television tuner and you will move from channel to channel (domain to domain) as you exercise your daily activities over the Net. The firewall must be able to protect you properly when you are a member of several domains simultaneously.

So, too, is the firewall the ideal locus for encryption on each of your virtual domains. It must handle the passphrases and public keys that are the heart of cryptographic protocols. It must not divulge their secret elements.

Finally, the firewall is the ideal tool for traffic analysis of a domain, and for the knowledge management that implies. The information stream crossing a firewall is the definitive archive of interaction between systems. The logs kept by the firewall will be of even greater detail than those today, akin to how airplane flight data recorders collect much more information than models from 20 years ago, and the firewall should perform analysis on this data to tell you, for example, who in your company or association or group of pals uses the Net in the most similar ways and thus would make great companions.

As the Net pervades more of our lives we will need to be nodes on many more domains and we will need flexible protection from our firewalls on each of these domains. The architecture of IPv6, the new Internet, makes this all quite easy to do. There are only three slight clouds over this picture and they serve to mark the zones where many billions of dollars will be made.

First, privacy will be under tremendous pressure, since we can profile someone by their Web surfing, and corporations and governments will need to be held in check by strong legislation and social structures that limit their intrusion upon our personal selves.

Second, the issue of liability needs to be shaken out. Who, for example, is responsible when the firewall lets a cracker in who turns up your oven and burns your roast; who changes the settings on a hospital x-ray machine and administers a lethal dose to a patient; who cracks your encrypted message and changes your financial data and forces your corporation into litigation?

Finally, comes the task of making the complex configuration of firewalls easy and reliable for the end user. Homes will need firewalls but will John and Jane Doe want to build and maintain them? Who will construct and maintain the rulesets of our lives? The local security firm that installed our burglar alarms? Our insurance carrier? Our ISPs? Not everyone wants to be a network administrator and security specialist. Who will teach the person who installed your burglar alarm about the TCP/IP protocol and its services? What additional skills will be needed to protect the network that is your health club or the one that is your neighborhood?

In the end, as more bandwidth flows across that last mile of wire to the home and connects many more devices in many more ways, the question of what the Net is and what its sub-boundaries are will be a rich source of amusement, possibility, and prosperity in the days, months, and years to follow.