SPINACH Research Page

Introduction

Our main research goal  is to find security mechanisms how networks can be secured against unauthorized access in a way that is both user friendly and scales to large number of users and organizations. SPINACH was built as a proof of concept and to gain insight on user behaviour with such systems. If you have questions please contact Guido Appenzeller <appenz@cs.stanford.edu>.

Publications

Spinach was originally designed by Elliot Poger and Mema Roussopoulos and Mary Baker.

Guido Appenzeller, Mema Roussopoulos, and Mary Baker, "User-Friendly Access Control for Public Network Ports". Proceedings of IEEE INFOCOM '99, March 1999.
Postscript Version (letter)

Elliot Poger and Mary Baker, "Secure Public Internet Access Handler (SPINACH)" Proceedings of the USENIX Symposium on Internet Technologies and Systems, December 1997.
HTML Version and Postscript File (letter, 268 kbyte)
 

The current Web version was mainly written by Guido Appenzeller. An article on it was submitted to INFOCOM'99 and will be online soon.

Related Technology and Links

Spinach uses technology from several other sources:  

WebLogin- This is the stanford campus wide secure login facility for web-based applications.
Technical Details on Weblogin - explain some of the basic principles how WebLogin works.
Stanford Web Security Service Proposal - contains the specifications and ideas behind WebLogin.
Tim Torgenrud - One of the principle designers of WebLogin. His home page contains lots of useful information on the technology.

SUNetID - The SUNetID is the principal login and password for all Stanford Personel.
Identification and Authentication Systems Policy - describes policies and technology for the SUNetID.

LDAP - The Light Directory Access Protocol.
Stanford Directory Services - Describes Stanford's current efforts on building a new directory structure.
Jeff Hodges - He is one of the principal architects of the Stanford LDAP architecture.

JAVA - The main language SPINACH is written in.
www.blackdown.org - Information about the Java port to Linux.

Linux - The Operating System SPINACH runs on.
Firewall HOWTO - How the Linux firewall works.

DCC Distributed System Consultants are the task force that builds most of Stanford's network infrastructure.
 

Basic Design

The description below is only an overview over SPINACH's features. For moe detailed information check the publications above or contact Guido Appenzeller.

The basic design of SPINACH's netwokr is shown below. All public network ports (and the wireless bridges) are installed on a protected subnet called the prisonwall net. The SPINACH router acts as a gateway that blocks access from these ports to the departmental network until the host has authenticated itself successfully.
 


 

The internal design of SPINACH is shown below. SPINACH consists of a web-server that handles user requests and takes care of encrypting the channel. If a user has successfully authenticated himself it notifies the SPINACH server through a socket. The SPINACH server keeps a list of users that currently use the system. When a user is added it opens the firewall. It regularily checks which user's id's have expired, removes those people from the list and closes the firewall for them. The ARP cache takes care of verifying that the hardware adresses correspond to the right IP addresses.
 



© MosquitoNet: The Operating Systems and Networking Group, spinach-admin@spinach.stanford.edu