SANE: A Protection Architecture For Enterprise Networks

In a relatively short period, enterprise networks have evolved from small-sized LANs with simple architectures, to present day large networks with very complex architectures. Their topologies now include combinations of Local Area Networks (LANs), Wireless access networks, Metropolitan Area Networks (MANs), Wide Area Networks (WANs) and Virtual Private Networks (VPNs) that often span across multiple continents. Sustaining these highly interconnected, but also more dynamic and complex architectures currently occurs through the implementation of complex routing and switching protocols. Nevertheless, the increased network connectivity and higher availability have still not been sufficiently balanced by improved security. Threats from Viruses, worms, trojan horses and DoS attacks are still persistent, with rising tendencies in their sophistication and ability to spread. Mechanisms such as ACL, packet filters, firewalls, IDS and IPS, etc, put in place to curb these increased levels of threats and attacks have also caused the network to become inflexible, fragile and difficult to manage. This paper addresses issues such as trust, access control, complex routing and switching, and other forms of attacks that affect present day enterprise networks. It evaluates and analyzes current methods used to resolve these issues, points out their limitations and then proposes a new approach in dealing with the fundamental problem. It presents a newly designed protection architecture (SANE) for the enterprise network. This architecture is based on a single, logically centralized protection layer that is used to setup, secure and control all connectivities within the network.