[English translation] A description method, construction method, and medium for network access control rules (patent application CN109391590, 2017)

[wkrp]

This is another Chinese publication translated to English, like the previous #434, #435, #437. This time, it is a patent rather than a research paper.

---

一种面向网络访问控制的规则描述方法及构建方法、介质
A description method, construction method, and medium for network access control rules
刘庆云 (Liu Qingyun), 郑超 (Zheng Chao)
Institute of Information Engineering, Chinese Academy of Sciences

Online English HTML
English PDF
Original Chinese PDF
Google Patents (English)

This patent application describes MAAT, a way of describing network access control rules; e.g. firewall rules. The application doesn't demonstrate a concrete syntax, but abstractly describes a way of constructing rules according to a specific hierarchy of three levels called "configurations" (配置). The three levels of a MAAT rule are ([0008]):

• Compilation configuration (编译配置)
  • Grouping configuration (分组配置)
    • Range configuration (域配置)

A compilation configuration consists of one or grouping configurations (each grouping configuration optionally negated with a NOT), and is satisfied when all of its grouping configurations are satisfied. A grouping configuration consists of one or more range configurations and is satisfied with any of the range configurations is satisfied. A rule is thus an AND of ORs; i.e., a formula in conjunctive normal form (though the patent application does not use that term). Every configuration at every level additionally has its own "effective" flag so that it may be individually enabled or disabled ([0008], [0024]).

At the highest level, a compilation configuration is an AND of grouping configurations, each optionally negated: c = g₁ & !g₂ & !g₃ & … & g_n. A compilation configuration describes a strategy that should be executed when all the grouping configurations are matched. Examples of strategies include "allow", "block", "log", with configurable parameters ([0035]–[0038]).

At the intermediate level, a grouping configuration is an OR of range configurations: g = r₁ | r₂ | r₃ | … | r_n. One grouping configuration may be reused in many compilation configurations.

At the lowest level, a range configuration is a granular matching rule on a single network protocol field. It is a triple: (matching location, range type, matching content). Matching location names a protocol field, for example "HTTP host header", or "IP packet destination address". Range type specifies how the content is to be matched, for example by string equality, or IP network membership (more examples of range types appear below). Matching content is what to match against: for example a string, a range of integers, or a hash value. Put simply, a range configuration is predicate on a protocol field that can be flexibly defined. For unknown reasons, a given range configuration may appear in only one grouping configuration ([0013]).

Paragraphs [0042]–[0046] list examples of range configurations. (Confusingly, these paragraphs use the word "rule" (规则) to refer to a low-level range configuration. The same word "rule" is used elsewhere to refer to an entire hierarchy up to the highest level.)

[0042] 1. String rules to describe matching rules for strings; e.g., URLs or cookies that can be used to match HTTP traffic, or domain names in the DNS protocol. From the perspective of matching methods, the rules can be divided into single string matching (which may be subdivided into substring matching, right matching, left matching, and exact matching), AND expressions, regular expressions, and substring matching with offsets (i.e., rules that specify that a certain string appears in a certain position);

[0043] 2. IP address rules to match the transmission addresses of network data; e.g., detected TCP connections to harmful hosts. These include IPv4 addresses and IPv6 addresses, specifically described by information such as address type, source IP address, source IP mask, source port, source port mask, destination IP, destination IP mask, destination port, destination port mask, protocol (e.g., tcp or udp), and direction.

[0044] 3. Numerical rules to determine whether a numerical value, such as a file size, lies in a certain interval. These are described by two fields: numerical lower bound and numerical upper bound.

[0045] 4. Hash rules to match whether a file being transmitted is a match for a target, such as a Trojan horse, virus, or internal document. These determine whether the transmission data matches the rules based on the hash value. The hash values can be a cryptographic hash such as MD5 or SHA1 for an exact match, or a fuzzy hash for a similarity match.

[0046] 5. Other rules added as needed.

Paragraphs [0048]–[0058] give an example of the construction of a specific rule: "access to www.phishing-site.com and www.virus-site.com is blocked for the IP addresses 192.168.0.1 and 192.168.0.2, and an alert log is generated."

• c₁ = g₁ & g₂
  strategy = block, and generate an alert log
  • g₁ = r₁ | r₂
    • r₁ = (client IP address, IP address equality, 192.168.0.1)
    • r₂ = (client IP address, IP address equality, 192.168.0.2)
  • g₂ = r₃ | r₄
    • r₃ = (HTTP URL, substring match, "www.phishing-site.com")
    • r₄ = (HTTP URL, substring match, "www.virus-site.com")

The strategy of a compilation configuration, separate from the matching formula, is reminiscent of the formalization of Tschantz et al. Section IV-B: "Each step of an attack corresponds to some sort of detection, or an action taken based on a previous detection."

The HTTP user agent strings "Chrome" and "11.8.1" appear in paragraph [0010]. There never seems to have been a release of Chrome with that version number, but Chrome 11 first appeared in 2011. The HTTP domain name ".emodao.com" in paragraph [0011] was, according to the Wayback Machine, a pornography forum that operated between 2005 and 2010. It seems to have been defunct in 2017, when this patent application was filed. It had a sub-forum dedicated to censorship circumvention. The class-C network 202.118.101.* in paragraph [0012] belongs to Tsinghua University in CERNET.

The term "grouping configuration" (分组配置) is instead written "configuration group" (配置分组) in Figure 1. The inconsistency exists in the original Chinese as well.

[wkrp]

[0005] 针对现有技术中存在的技术问题，本发明的目的在于提供一种面向网络访问控制的规则描述方法及构建方法、介质。基于本发明描述的规则，可以实现高效、精确、灵活的访问控制，本发明的规则描述模型简称MAAT。

[0005] In view of the technical problems existing in the prior art, the purpose of the invention is to provide a description method, construction method, and medium for describing network access control rules. Based on the rules described in the invention, efficient, precise, and flexible access control can be realized. The rule description model of the invention is referred to as MAAT.

The string "MAAT" appears in just this one place. It is not explained what "MAAT" may stand for.

This patent application might be compared to the much earlier (and in fact now expired) patent CN1556627 from 2004 (媒体网站内容监管信息统一存储和交互方法 Medium network station content monitoring information unified storage and alternating method), which is about a uniform XML-based representation of network monitoring information, as well as a way of distributing that information using SOAP. Just as the MAAT patent doesn't shown any real syntax, CN1556627 doesn't show any real XML. The related patents CN1349190 (网络媒体安全中央监管系统 Central network medium safety monitoring system) and CN100466533 (网络媒体内容安全宏观监管方法 Network medium content safety macromonitoring method), from the same time period and the same inventors, talk about a hierarchical arrangement of "supervising centers" (监管中心) and the exchange of content security rules between them.

[wkrp]

Let's look at the inventors of the patent. The awardee organization is the Institute of Information Engineering (IIE, 中国科学院信息工程研究所), a large information security research organization, consisting of many subsidiary labs and teams.

刘庆云 (Liu Qingyun) (b. 1980) is a senior engineer in IIE. With 郑超 (Zheng Chao), he is one of the authors of the MVMP paper "A Flexible and Efficient Container-based NFV Platform for Middlebox Networking", previously discussed in #282.

• 刘庆云 (Liu Qingyun) homepage
• 刘庆云 (Liu Qingyun) Baidu Scholar profile
• 刘庆云 (Liu Qingyun) IEEE profile
• 刘庆云 (Liu Qingyun) ACM profile
• 刘庆云 (Liu Qingyun) LinkedIn

郑超 (Zheng Chao) (b. 1984) has appeared on this forum many times, most notably for his affiliation with Geedge Networks, reported to be the company responsible for implementing VPN blocks in Myanmar in 2024. With 刘庆云 (Liu Qingyun), he is one of the authors of "A Flexible and Efficient Container-based NFV Platform for Middlebox Networking", previously discussed in #282. He is also one of the authors of "Understanding the Network Traffic Constraints for Deep Packet Inspection by Passive Measurement", discussed in #275.

• 郑超 (Zheng Chao) homepage
• 郑超 (Zheng Chao) IEEE profile

[wkrp]

A footnote in the InterSecLab report about the Geedge Networks leak mentions Maat, the subject of this patent. Recall that 郑超 (Zheng Chao) is the CTO of Geedge Networks. Both 刘庆云 (Liu Qingyun) and 郑超 (Zheng Chao) are cofounders of MESA.

p.24

To extract these [AppSketch] fingerprints, Geedge and the Mesalab students use a modified version of the open-source tool tcpdump, which they call tcpdump_mesa. The fingerprint is subsequently transformed into a ruleset utilizing one of four systems for deep packet inspection: SAPP (Stream Analyze Process Platform), a C packet parsing and injection library; Stellar, a stateful firewall plugin platform that operates on a higher level of abstraction compared to SAPP; or Maat, a declarative system. Unlike SAPP and Stellar, Maat does not require programming knowledge for the development of new rules. Maat is capable of matching common connection fingerprints, including IP addresses, domain names, TLS Server Name Indications (SNI), JA3/JA4 fingerprints, specified in a JSON file. Maat rules are synchronized across nodes within a TSG cluster through the use of a Redis database, thereby ensuring consistency in the application of these rules.

For SAPP, see #471.

[wkrp]

The source code component of the Geedge Networks leak contains a number of repositories with "maat" in the name.

tango/maat
liuwentan/maat-rust-binding
zhangyang/maat_demo

[benwolin]

In the Geedge Networks leak, there is a readme file in the tango/maat repo which explains the name:

Maat was the goddness of harmony, justice, and truth in ancient Egypt. Her feather served as the measure that determined whether the souls of the departed would successfully reach the paradise of the afterlife. We use this meaning metaphorically to indicate whether the scanning hits an effective rule or not, which is the core function of Maat.