Cisco alums readying firewall killer

Five former Cisco engineers have co-founded a start-up called Rohati Systems whose products take dead aim at traditional perimeter firewalls.

A traditional firewall and its access control lists "is not capable of doing its job today from an access-control perspective," says CEO and President Shane Buckley. "Nowadays, your IP address just doesn't represent who you are."

Rohati will mark its debut this week with a network-based entitlement control device designed to limit access to applications, such as Microsoft's SharePoint collaboration suite, based on the user's authentication.

Called the Transaction Networking System (TNS), the appliance is intended to reside close to the data assets it protects, usually in the data center. It checks whether users should be permitted to access application data stored there based on user credentials that might include Kerberos, VPN SSL or Microsoft authentication protocol NTML.

TNS functions at the application layer to establish Layer 7 access-control lists to limit who has what access to data, Buckley says. Use of the TNS begins by putting the device in monitor mode to let it watch the users accessing the data, capturing all the transactions, such as opening and closing files.

"This way, the appliance is learning all the transactions in the network," Buckley says. This enables the appliance to build a policy that managers can refine, such as permitting or denying, or allowing reading, writing or deletion.

Now in beta and expected to ship in July, the appliance makes use of the OASIS standard called the eXtensible Access Control Markup Language (XACML) for the data-management policy.

"The appliance has a set of policies on who can have access to what based on directory attributes," Buckley says, adding that one advantage is that no changes to existing applications or new client software is required. TNS competes most directly with entitlement software from CA, Oracle, IBM Tivoli Software and Securent, which was acquired by Cisco last November for US$100 million.

Every time a user goes to access an application, a check for authorization will be made by TNS, but speed shouldn't be an issue, Buckley says, because the two models of the product, the TNS-100 and the TNS-500, scale between 4G and 40Gbps, are built on Infiniband technology and support as many as 6 million connections. In the future, the TNS is likely to be developed to do more than provide access control to applications.

"Because we control the application, this gives us the ability to do things like content cloaking, blocking out sensitive content to the viewer," Buckley says. Content filtering of various types could also be integrated into the basic architecture.

Rohati, which joined the Jericho Forum, the group dedicated to encouraging alternatives to traditional perimeter firewalls for e-commerce, is targeting TNS for organizations that allow business partners to share network resources with internal users.