Volume 10, Number 14, November 2020

Network Defense in an End-to-End Paradigm

  Authors

William R. Simpson and Kevin E. Foltz, The Institute for Defense Analyses (IDA), USA

  Abstract

Network defense implies a comprehensive set of software tools to preclude malicious entities from conducting nefarious activities. For most enterprises at this time, that defense builds upon a clear concept of the fortress approach. Many of the requirements are based on inspection and reporting prior to delivery of the communication to the intended target. These inspections require decryption of packets when encrypted. This decryption implies that the defensive suite has access to the private keys of the servers that are the target of communication. This is in contrast to an end-to-end paradigm where known good entities can communicate directly with each other. In an end-to-end paradigm, maintaining confidentiality through unbroken end-toend encryption, the private key resides only with the holder-of-key in the communication and on a distributed computation of inspection and reporting. This paper examines a formulation that is pertinent to the Enterprise Level Security (ELS) framework.

  Keywords

Appliance, end-to-end security model, ELS, network defenses, web server handlers.