M-Guard

An M-Guard instance will sit between a pair of applications (producer and consumer), with XML messages flowing from producer to consumer. M-Guard, acting as an application level data diode, will validate messages and only pass through those that match configured criteria. These applications will be connected to the M-Guard appliance on separate networks.

M-Guard provides (optional) acknowledgement of transfer to enable reliable transfer from producer to consumer. There is no extra information included with the acknowledgement, to avoid creation of a covert channel.

When the producer application initiates a connection to M-Guard, then M-Guard will connect to the consumer application before accepting the inbound connection.

The protocol used by applications that communicate with M-Guard is the Guard Content eXchange Protocol (GCXP). Isode has published the GCXP protocol in Appendix B of the M-Guard Administration Guide. Isode has also provided a freely available C++ reference implementation of GCXP. Characteristics of GCXP:

• Transfers a stream of XML Messages.
• TLS is always used to protect the connection.
• Two way strong authentication is recommended to validate peers.
• M-Guard will always validate IP address of connecting application.
• Framing using RFC 7049 – Compact Binary Object Representation (CBOR).

Each guard instance is configured with an Application Profile, which enforces basis protocol compliance to the protocol used by the application.   The application profile also applies content normalization of the XML and Unicode to ensure only a single specified representation of the protocol is used. This guards against covert channels and attacks using encoding variants.

M-Guard allows import of application profiles and includes support of a generic XML profile and a profile for “Demo Protocol”. Demo Protocol provides a means to show a range of M-Guard capabilities, including support of security labels following XEP-0258 (Security Labels in XMPP) and NATO STANAG 4774/4778.

Application Profiles are discussed in more detail in the Isode whitepaper [XML Guard Application Profiles].

M-Guard can apply a set of rules to check XML messages. A key benefit of using XML is that there are a wide range of standardized mechanisms to check XML messages. M-Guard supports rules using the following standards:

1. XML Schema. Schema of the XML protocol.
2. Xpath. A mechanism useful for specifying generic checks.
3. Schematron. A flexible mechanism for specifying rules.
4. Relax NG. A modern XML specification mechanism.

An application will typically have a set of Rule Catalogs. Rule Catalogs can be loaded into an M-Guard Project, and then rules from these Catalogs can be enabled for each Guard. Applications using M-Guard are expected to provide an appropriate set of Rule Catalogs.

M-Guard supplies two Rule Catalogs with M-Guard Console that are shown above in the M-Guard Console UI:

1. Demo Protocol Rules. These can be used with the Test Producer and Test Consumer to demonstrate M-Guard capabilities using the Demo Protocol. These rules show parameterization, where the M-Guard configuration includes parameters to constrain the rules.
2. Rules for arbitrary XMP. These provide generic constraints, which can be used with arbitrary XML.

Rule may reference content catalogs, which are catalogs of arbitrary XML objects.    M-Guard provides built in support for catalogs of XEP-0258 Security Labels and STANAG 4774/4778 NATO Confidentiality Metadata Labels.

M-Guard provides a mechanism to limit the rate of messages being sent through M-Guard to a configured value. When rate limiting is enabled, the guard will limit the rate at which messages are sent through the guard. This control may be used to reduce covert channel risks and/or Denial of Service risks, noting that its application may increase Denial of Service risk.

Where M-Guard is used to separate Red and Black systems, there is sometimes a need to synchronize clocks through the guard. One example is taking black side time information (perhaps from GPS) and using this to set clocks on red side systems. Another example is using a management network clock to set the clocks on red side systems, M-Guard provides a means to achieve this using Network Time Protocol (NTP).

M-Guard is intended for environments where it will generally be required that the product used has undergone appropriate accreditation or assurance processes. M-Guard has been developed with processes and approaches to facilitate accreditation and assurance. It has undergone a UK assurance process.

GCXP connections always run over TLS and will usually use PKI verification. Each guard instance on an appliance will run in a FreeBSD Jail (to provide seperation from other guards) and will have a PKI identity. Checking certificate validity (using CRL or OCSP) would introduce too many security risks, so is not done. A consequence of this is that in the event of certificate compromise, the whole PKI needs to be replaced. This makes use of standard PKI impractical.

To address this, M-Guard Console includes a per-appliance Certification Authority (CA). This will issue a certificate for each guard on the appliance and using standard Certificate Signing Requests (CSR) will issue certificates for the applications that connect to M-Guard.

M-Guard instances run on a Guard Appliance, a single Appliance may run one or more Guard instances. A common set up is to have one M-Guard appliance running a pair of M-Guard instances (one in each direction). M-Guard is stateless, so that multiple M-Guards may be set up to provide a redundant configuration.

The Guard Appliance can be a virtual or physical device utilizing the NanoBSD variant of the FreeBSD operating system. NanoBSD is specifically designed for appliances and has been chosen for its small footprint and excellent security characteristics.

Virtual Appliance Platforms

Two platforms are currently supported, and others may be added:

1. Microsoft Hyper-V
2. Oracle VirtualBox

Physical Appliance Platforms

The guard appliance is intended for diskless hardware and is currently targeted for Intel Atom processor based appliances. The reference hardware is the Netgate 6100, we support the following versions:

• Netgate 6100 BASE PFSENSE
• Netgate 6100 MAX PFSENSE

We currently do not support the Netgate 6100 MAX TNSR.

We are happy to work with partners to support other hardware platforms.