Process Identity-Based Firewalling

In this paper we introduce DAF, a distributed application firewall capable of filtering traffic based on process identity. The process identity is inferred from local-system level knowledge of processes and their access to specific sockets, without needing to examine the user data. In order to ensure its reliable operation in microservice-rich environments, we extend the process identification capabilities to function across namespaces, thus allowing seamless runtime container inspection. Additionally, individual instances of DAF are able attach proof of compliance to the locally configured firewall ruleset by annotating packets with HMACs as IP options. In an effort to reduce the difficulty of integrating our solution with existing software stacks, we offer iptables and snort3 extensions that are capable of ascertaining the compliance of intercepted traffic with said ruleset.