OpenSPA - An Open and Extensible Protocol for Single Packet Authorization

Applications are vulnerable. Opening such applications to the Internet creates a big attack surface for potential exploit. The use of common network defenses such as firewalls helps mitigate the risks, however possibility of a secure scalable system that assigns network access to a service purely by identifying a device by a static IP address is a delusion. Firewalls need to improve to support dynamic allocation of device access. Such a technique would allow services to be hidden to the general public, unauthorized to access them, but would at the same time allow authorized users global connectivity. Single Packet Authorization (SPA) is an approach, building on firewall functionality which hides services from unauthorized users and helps mitigate common network attacks such as Distributed Denial of Service (DDoS) attacks by stopping them earlier in the network stack. In this paper we introduce OpenSPA, a SPA protocol suitable for deployment in various complex networking environments and enabling flexibility to support different network policies. With support for IPv6 as well as extensible support for custom user programmable authentication, authorization and firewall logic.