Source-linked AI summary
Breaking Ambient Trust: In-Network Per-Process Access Control Against Lateral Movement
Osama Bajaber, Bo Ji, Peng Gao
TL;DR
Enterprise defenses often cannot track process identity as users move across hosts, allowing compromised hosts to confer ambient trust during lateral movement. NetZone binds lightweight AccessScopes to processes, propagates them with traffic, and validates them using programmable switches and eBPF. It prevents a wide range of advanced attacks while adding 140 ns enforcement latency and reaching 99.9 Gbps on a 100 Gbps-per-port switch.
Problem
Existing network defenses use coarse host- and network-level information and cannot preserve process-level permissions as users move across hosts.
Method
NetZone binds each process to an AccessScope encoding authorized hosts, propagates it across hosts, and enforces it through programmable switches and eBPF.
Results
140 ns enforcement latency and 99.9 Gbps throughput on a 100 Gbps-per-port switch were reported, alongside prevention of a wide range of advanced attacks.
Takeaways & Limitations
Process-bound, persistent access scopes eliminate ambient host-level trust and confine users to their authorized hosts during lateral movement.
Takeaways & Limitations
NetZone does not detect attackers who steal user credentials and authenticate to the IAM system to obtain the victim’s access scope.
Abstract
from arXiv · showhide
Enterprise networks remain vulnerable to Advanced Persistent Threats (APTs), where adversaries gain an initial foothold and move laterally across the network, accumulating access permissions hop by hop to reach critical targets. Existing network defenses cannot track user movement at the process level across the network; instead, they grant ambient trust to all processes within a host. As a result, once a host is compromised, malicious processes inherit the victim's permissions, thereby expanding the attacker's access scope and enabling further lateral movement. To address this gap, we present NetZone, an in-network access control that confines each user process to a fixed access scope that persists as the user moves across the network. NetZone introduces a new abstraction, called AccessScope, which represents a lightweight access capability bound to the user's processes. Each AccessScope encodes the set of hosts a user identity is authorized to access and is embedded in the process's outgoing network traffic for validation before reaching its destination. As users pivot across hosts, AccessScope propagates with their traffic, rebinds to the receiving process, and persists across hosts. This ensures that regardless of network location, the user's processes are consistently governed by their bound AccessScope and their access permissions remain unchanged. To handle the high volume of network traffic generated by processes, we develop a data-plane co-design that integrates programmable switches with eBPF. NetZone employs a set of in-network optimizations and lightweight AccessScope persistence techniques to inspect the embedded AccessScope on the fly, enabling line-rate processing of high traffic volumes with negligible latency overhead. Our extensive evaluations show that NetZone can effectively defend against sophisticated attack scenarios without introducing noticeable overhead.
1 Introduction
NetZone addresses lateral movement by replacing host-level ambient trust with process-bound access scopes that persist as users move across hosts. Its programmable-switch and eBPF design propagates and validates these scopes at scale with low overhead.
- Problem: APT attackers accumulate permissions laterally because existing defenses cannot track user processes across hosts or enforce consistent permissions.Coarse IP- and port-based controls allow malicious processes on compromised hosts to inherit legitimate users’ permissions.
- Approach: NetZone binds each process to an AccessScope encoding the hosts its user identity may access.The scope is embedded in outgoing packets, propagated across hosts, and rebound to recipient processes.
- Security effect: Process-bound scopes eliminate ambient host trust, preventing malicious processes from inheriting legitimate processes’ permissions during lateral movement.A compromised host can contain processes with different access scopes: Bob’s malicious process remains restricted while Alice’s legitimate process retains authorized access.
- Implementation: NetZone combines programmable switches and eBPF to generate, propagate, inspect, and enforce AccessScopes in high-volume traffic.Programmable switches inspect custom packet headers at line rate, while eBPF traces processes and attaches or extracts scopes from packets.
- Evaluation: 140 ns latency is added for on-the-fly AccessScope enforcement, while throughput reaches 99.9 Gbps on a 100 Gbps-per-port switch.The evaluation also reports 3-9 μs added to monitored kernel events and 27-60x faster policy enforcement than centralized identity-based solutions.
2 Background
Background systems provide network or capability-based control, but they generally trust hosts or remain confined to single-host resources. NetZone targets the resulting gap by enforcing process-level permissions across network movement.
- Network access control: Traditional firewalls enforce IP- and port-based rules, so every process on a permitted host inherits that host’s network permissions.This host-level trust enables attackers who land on permitted hosts to abuse inherited permissions for lateral movement.
- Network access control: Signature-based firewalls add deep packet inspection, but encryption limits identity visibility and host-level trust remains unaddressed.DPI can also require dedicated CPU or GPU resources, creating performance overhead.
- Network access control: Role- and attribute-based SDN systems incorporate user identity into policies but ultimately install IP-based data-plane rules that trust hosts rather than processes.Their enforcement does not preserve process-level distinctions after a user moves across hosts.
- Research gap: NetZone’s background gap is the absence of a solution that eliminates ambient trust with process-level scopes persisting across lateral network movement.Its design extends capability enforcement from single-host protection to remote-host access.
- Capability-based systems: Capability systems enforce fine-grained permissions by requiring processes to present tokens, but many operate only within OS boundaries and regulate local resources.Distributed capability systems may regulate remote resources while still assuming ambient trust for processes sharing a host.
3 System Overview
NetZone distributes compact, subnet-specific AccessScopes, propagates them with process traffic, and enforces them at destination switches. Its workflow separates policy distribution, cross-host persistence, and packet-level authorization.
- AccessScope design: NetZone partitions permissions into per-subnet AccessScopes so each user carries only the scope for the current subnet.A destination-subnet scope replaces the current scope when the user moves across subnet boundaries.
- Initialization: During initialization, administrators define identity-centric policies, the control plane encodes them into per-subnet scopes, and tagging switches receive the generated scopes.The user’s UID is retrieved from the operating system and sent to the control plane to trigger scope generation and distribution.
- Propagation: When a process connects across hosts, eBPF attaches its AccessScope to outgoing packets, and the receiving host binds the extracted scope to the receiving process and its descendants.New processes and threads inherit the received scope, preserving permissions across host transitions.
- Enforcement: At subnet boundaries, tagging switches replace scopes using the user identity and destination subnet, while enforcement switches forward or drop packets based on authorization.The switch looks up the destination-subnet scope, then verifies whether it permits access to the destination host.
- Security behavior: In the motivating attack, NetZone blocks Bob’s malicious process while allowing Alice’s legitimate process to reach the private server.The two processes receive different destination-subnet scopes even when they originate from the same compromised host.
4 Decentralized AccessScope Architecture
NetZone organizes per-user permissions into compact, subnet-specific AccessScopes and distributes them through tagging switches for enforcement switches to apply at line rate. Its custom packet formats and request-response coordination address switch-memory and packet-overhead constraints while preserving policy consistency across changing network states.
- 4.1 AccessScope Abstraction: AccessScope encodes a user’s permitted hosts within one subnet, using UID, Subnet_ID, and a permission bit string.Each bit identifies a host; set bits allow access and unset bits block it.
- 4.1 AccessScope Abstraction: A user’s network-wide policy is the union of per-subnet AccessScopes, with the scope for the destination subnet selected before entry.Connections are blocked when the destination host is absent from that subnet’s permissions.
- 4.2 AccessScope Distribution: Per-subnet scopes avoid carrying irrelevant permissions or preloading every switch with all users’ scopes, reducing transmission and on-chip-memory demands.NetZone assigns gateway switches as tagging switches and distributes stored scopes to them for later attachment to user traffic.
- 4.2 AccessScope Distribution: NetZone attaches an AccessScope header only to the initial packet, then caches the resulting allow-or-block decision for subsequent packets in the connection.This avoids repeating the same header while preserving the connection’s security decision.
- 4.4 On-the-Fly AccessScope Replacement: When a new-subnet packet arrives, requestReg records its UID and destination Subnet_ID, while matching stored scopes write the response into responseReg keyed by connection and scope identifiers.The user packet is recirculated until the matching stored AccessScope is resolved.
5 Enforcing and Persisting AccessScopes
NetZone enforces each process’s AccessScope on packets and propagates that scope through host process creation and cross-host communication. Programmable switches perform line-rate validation, while eBPF binds incoming scopes to processes and attaches outgoing scopes to traffic.
- 5 Enforcing and Persisting AccessScopes: NetZone enforces the encoded access scope at line rate and preserves it as users move within a subnet.The AccessScope is carried into the subnet and governs subsequent access decisions.
- 5.1 In-Network Enforcement: Enforcement switches inspect the embedded AccessScope header and use bitwise permission checks against destination-host mappings.The switch maps each destination IP to a permission bitmask and validates the corresponding bit.
- 5.1 In-Network Enforcement: After inspecting an initial AccessScope header, NetZone stores the connection decision in DecisionTable and applies it to later packets lacking the header.The table is indexed by the connection’s 5-tuple and stores allow or block values.
- 5.2 Cross-Host AccessScope Persistence: eBPF propagates AccessScopes across processes and hosts without kernel-source changes by attaching programs to system-call and network-event hooks.This provides the mechanism for tracking identity context as processes and threads are created.
- 5.2 Cross-Host AccessScope Persistence: Incoming AccessScopes are extracted at XDP and bound to receiving processes through accept or receive system calls, while fork, clone, and execve propagate scopes to child contexts.Outgoing connect and sendto activity is mapped back to the caller’s AccessScope before egress attachment.
6 Handling Practical Requirements
NetZone addresses adversarial manipulation, state exhaustion, packet loss, switch failure, and policy change through authentication, rate limiting, control-plane recovery, and dynamic AccessScope updates. These mechanisms preserve enforcement while policy updates typically propagate network-wide within 2-10 ms.
- Adaptive adversaries: Unique OS-enforced PIDs prevent a victim-host attacker from obtaining another process’s AccessScope through PID spoofing.The paper describes this as a failed attack against NetZone’s process binding.
- Adaptive adversaries: Keyed hashing and a lightweight MAC prevent attackers from forging or tampering with AccessScopes in transit.Switches verify the MAC inline and drop packets with invalid authentication codes.
- Adaptive adversaries: Per-UID rate limiting mitigates switch-register exhaustion from large numbers of legitimate connections, while data-plane processing resists connection-flooding DoS attacks.The paper evaluates the DoS defense in Section 7.4.
- Failure handling: ACKs provide reliable delivery of AccessScope packets, and the control plane retransmits unacknowledged scopes.This mechanism handles packet loss during AccessScope distribution.
- Failure handling: After a tagging-switch failure, the control plane repopulates the switch with AccessScopes recorded from earlier acknowledgments.The paper states that this adds negligible control-plane storage overhead.
- Updating AccessScope: NetZone updates and revokes permissions through control-plane-generated AccessScope packets, with policy changes typically propagating network-wide within 2-10 ms.Updates are distributed to relevant switches and synchronized with hosts.
7 Evaluation
NetZone was evaluated on a physical Tofino testbed, real-world datasets, and representative enterprise topologies. Across these evaluations, it blocked attacks, scaled to realistic workloads, and maintained low latency and resource use.
- Evaluation Setup: NetZone was implemented on a physical Tofino testbed and evaluated with three real-world datasets and three representative network topologies.The topologies covered social media, media streaming, and Stanford’s backbone network, alongside DARPA OpTC, Yatesbury, and LANL Unified Host and Network datasets.
- Defense Effectiveness: NetZone blocked all seven tested attacks across five communication channels, reducing attacker throughput to 0 MB/sec while retaining 99.9% of benign throughput.Without NetZone, the attacker reached the server and sustained throughput across all attack variants.
- Capacity and Performance: NetZone supported up to 16K AccessScopes and 200K concurrent connections while maintaining line-rate performance.Its eBPF programs added 2-7 μs per system call, and memory use remained about 130MB for the evaluated configuration.
- Overhead Impact: NetZone added only 140 ns for in-network enforcement and less than 110 μs for first-packet tagging, while subsequent packets incurred only 130 ns.The data-plane design avoids controller processing, and later packets are forwarded without modification.
- Switch Resources: NetZone used 17-21% SRAM and 0.1% TCAM, retaining sufficient switch resources to coexist with other complex P4 programs.The tagging and enforcement programs made minimal use of VLIW and hash units.
8 Discussion
NetZone's eBPF foundation has security limitations, and the system does not address attackers who steal user credentials. These boundaries motivate complementary protections for kernel integrity and suspicious authentication.
- eBPF security: Recent eBPF zero-day vulnerabilities can enable arbitrary memory reads and writes, potentially compromising BPF-map integrity.Existing safety-verification efforts can reduce exploitable eBPF vulnerabilities and strengthen the security of NetZone's programs.
- Stolen user credentials: NetZone does not detect attackers who steal user credentials and authenticate to the IAM system using the victim's access scope.The paper points to network-wide login-activity analysis as a complementary way to identify suspicious authentication attempts.
9 Related Work
Existing in-network defenses address attack types such as covert channels, denial-of-service, data leakage, and privacy threats, but they do not enforce per-user, process-level access scopes.
- In-network programmability: Existing in-network defenses target covert channels, distributed denial-of-service, data leakage, link flooding, privacy threats, and RDMA vulnerabilities.These defenses demonstrate broad use of programmable networking for attack mitigation.
- In-network programmability: None of the surveyed in-network defenses enforce per-user, process-level access scopes at the network level.This leaves NetZone addressing a distinct access-control gap within the related-work landscape.
10 Conclusion
NetZone is an in-network, fine-grained defense against lateral movement that binds access permissions to individual processes and preserves them as users move across hosts.
- Conclusion: NetZone enforces per-user access scopes to secure enterprise network access against lateral movement.Its design targets fine-grained control rather than ambient host-level trust.
- Conclusion: AccessScope is a lightweight, process-bound credential that encodes permissions, propagates across hosts, and is enforced at line rate using programmable data planes.Binding permissions to processes keeps access scopes persistent as users move through the network.
- Conclusion: NetZone eliminates ambient host-level trust by binding permissions to individual processes and persisting them across user movement.The conclusion frames process-bound persistence as the system's central defense against lateral movement.