Most internet gateways are not well secured. Security assumes if you have access to the network you are trusted. Edge routers, internal networks and more advanced IoT networking need fundamental innovation to address the security weakness. New architectures are needed for UI bootstrapping, key distribution, key storage, network segmentation, service discovery and addressing that will work as well at the edge as it does on the open internet.
Fully compatible with OpenWRT code base which is dominant router operating system.
Highly optimised code for foot print and efficiency. Necessary for networking capability.
Can be integrated via protobuf and endpoint controlled security for easy of integration.
Implements multiple methods of network control, including segmentation and device disable.
Embodies ManySecued D3 concepts, IETF MUD and targeting NIST onboarding.
Support toolsets for integrating via SPAN ports and PCAP exports for broader interoperability.
Network Management techniques are implemented at the WiFi level protocol. We are using the VLAN mechanism to segment the network of connected devices and consider two types of isolation:
- Internal: The internal isolation is based on subnets as depicted in the example diagram. There are five devices located in five separated subnets. The arrows indicate the bridge connection between devices. Note that device 1 can not communicate with devices 4 and 5, and vice-versa.
- External: The external isolation is based on denying a particular device access to the external network. Here devices 1, 2 and 3 can access the external network. However device 4 has no access.
The network capture service has the purpose of monitoring network traffic for each connected device. It can be configured to execute custom middlewares. The packet capture implements the actual network sniffing process.
Currently, it uses the libpcap library, however, it also allows interfacing with PF_RING or similar.
# absolute path to the capture SQLite db used by the middlewares
captureDbPath = “/path_to_capture/capture.sqlite”
# the capture filter for the libpcap library
# example filter=”src net 10.0 and dst net 10.0″
filter = “”
# libpcap options, see https://www.tcpdump.org/manpages/pcap.3pcap.html
# if true, captures all data on the LAN interface
promiscuous = false
# libpcap buffer timeout in milliseconds
bufferTimeout = 10
# enables libpcap immediate mode if true (disabled buffering)
# see https://www.tcpdump.org/manpages/pcap_set_immediate_mode.3pcap.html
immediate = false
- Secrets: id is the ID of the generated key, value is the value of the key, iv the initial value (IV) used to encrypt and decrypt the key and salt is the salt parameter. value, salt and iv are base64 encoded.
- Store: key is the key for the value, value is the value to be stored, id is the key id used to encrypt/decrypt the value and iv is the IV used to encrypt/decrypt the value. value and iv are base64 encoded.