With the growing digitalization of their activities, companies increasingly use cloud solutions to store a large part of their activity, whether private data, certain personal data, and sometimes also, inadvertently, sensitive data.

As digital information flows intensify and accumulate day after day, this implies an increase in the consumption of IT resources to process all of these information flows, and consequently, it implies reviewing their networks in order to optimize and secure them.

To meet this type of need, companies can:
– take advantage of a SDN¹ software-defined network platform, and simultaneously,
– reduce the complexity of this solution by using a SD-WAN² overlay.

SDN (or Software Defined Networking) is a network architecture model defined and managed by software
SD-WAN (or Software-Defined Wide-Area Network) is literally a software-defined wide area network, and more precisely, a software technique aimed at making wide area networks smarter and more flexible.

What are the innovation drivers of our Next Generation Firewall Asguard?

If new networks appear, new network security flaws will appear with them.

Appearing in 2018, third-generation SD-WAN computer networks make it possible to meet companies’ growing needs, and represent a major evolution in telecommunication systems.

It was upon noticing that there was no European B2B security solution optimized for SD-WAN networks, and that companies were forced to use security solutions that had become unsuitable, that we started more than 3 years ago our project to develop the first optimized and interoperable European security solution adapted to the SD-WAN network.

The main types of attacks on SD-WAN networks

Regarding the global subject of securing SD-WAN networks, it has been identified that attacks by international commercial groups come from several sources:

• Flooding a network to prevent it from functioning;
• Disrupting connections, preventing access to services;
• Obstructing access to a service;
• Sending billions of bytes to an internet box, for example.

For the vast majority, antivirus software and next-generation firewalls (NGFW) secure software-defined networks (SDN). The latter combine the capabilities of traditional firewalls (packet filtering, NAT address translation, URL blocking and VPN) with quality of service management features, and characteristics generally absent from firewalls.

This notably covers intrusion prevention, SSL and SSH inspection, deep packet inspection (DPI), reputation-based malware detection, or application awareness. Next-generation firewalls are able to detect and block sophisticated attacks such as DoS (Denial of Service) mentioned above by applying security rules at the application level, as well as at the level of the port or communication protocol.

Today, with the increase in filtering rules, in the consumption of IT resources and in the complexity of network configuration and management, the number of cyber attacks is rising on networks and particularly on third-generation networks, SD-WAN.

Appearing in 2018, their novelty makes them a perfect playground for hackers because the NGFW-type security techniques used until now are not adapted to this technology.

After more than three years of R&D dedicated to securing the SD-WAN architecture, we seized the opportunity to include high-level network security services by developing a next-generation firewall (NGFW) called Asguard.

What is Asguard?

As a next-generation firewall, the Asguard solution will protect the client company from the risks of attack, by interposing itself between the client network and the internet, whatever the access method (from the company’s offices, or through a remote client, even mobile).

This latest-generation firewall (NGFW) makes it possible to secure SD-WAN networks in an optimized and interoperable way.

What are the security features of the Next Generation Firewall | Asguard?

Thanks to its R&D work carried out over several years, the company NUMERYX Technologies has been able to develop a lightweight and high-performance security solution, now patented: double mask IP filtering. The solution is protected by a patent filed in 2015.

• The Level 4 Firewall: Double Mask IP Filter

The double mask IP filter is an innovative IP matching technique that provides more flexibility as well as a secure and efficient deployment of security policies. The IP filter comprises a first mask, adapted to express a first set of authorized IP addresses and a second mask adapted to express a second set of IP addresses to be excluded from the first set of authorized IP addresses. This technology allows a clear compression of filtering rules, which can reach more than 80%. With this patented technology, we will now be able to generate well-formatted access control lists, more compact and at lower cost for network equipment.

• The Virtual Private Network (VPN)

Allows end-to-end encryption of information flows between the client and their internal or external contact.

VPNs are known for their ability to secure the connection by encrypting the traffic entering and leaving your device, making access to your web data more difficult. In addition, even if a malicious person were to seize information about you, they could not exploit it because VPN software uses very powerful encryption algorithms. VPNs therefore protect all of your personal data (passwords, bank details, websites visited…).

• Intrusion Detection and Prevention (IPS and IDS)

Allows you to be alerted to a flaw or weakness in your system before any intrusion attempt, to identify and locate it, then automatically to organize a defense against an intrusion or attack, whether proven or not.

An IPS is characterized by the fact that it must be completely stealthy. This implies that the probe’s interfaces must not be visible (no IP address, no MAC address) and that the equipment must not behave as a proxy or implement address manipulation mechanisms (such as NAT, for example).

The IPS analyzes all packets in transit, from the network layers up to the application level.

• Asguard perfectly provides the web proxy function:

Based on Squid, it filters in cache or pass-through mode and supports multiple interfaces. It allows an internet connection to be shared between several users with a single connection, and also offers a request caching mechanism that makes it possible to access data using local resources instead of the web and thus reduces access time and bandwidth. It also logs users’ access to the sites they have visited.

SQUID offers the following services:

1. User authentication
2. Access filtering
3. Request logging
4. Cache proxy
5. Reverse Proxy
6. The transparent proxy

• The ClamAV antivirus

Designed to scan files quickly with real-time protection (Linux only), the scanning daemon supports on-access scanning, including the ability to block access to files until a file has been scanned.

It detects more than a million viruses, worms and Trojan horses, including Microsoft Office macro viruses, mobile malware and other threats.

Signed signature databases guarantee that ClamAV will only run approved signature definitions.

ClamAV scans archives and compressed files, but also protects against archive bombs. Its built-in archive extraction capabilities include Zip, RAR, and 7 Zip.

• Reporting & monitoring

The reporting offered by the Asguard solution lets you view the activity of your networks as well as intrusion attempts on them.

Monitoring gives you real-time access to a complete visualization of your network(s), and lets you observe their state at any given moment.

• An attractive user portal

The user portal made available to each client allows them to quickly and intuitively view their network statistics and extract reports.

It allows all features to be managed from a common and unique interface in a homogeneous way, with the ability to customize all settings without needing code. The portal relies on Role Based Access technology that makes it possible to differentiate user roles and privileges.

To what extent does Asguard secure SD-WAN networks?

The technological breakthrough driven by NUMERYX has all the success factors to achieve success, that of reducing if not eliminating the security flaws of large companies in a lasting way and in line with the evolution of communication networks.

The long-term objective is thus to obtain an innovative next-generation firewall, specialized in new technologies and environments (SASE, 5G, SDN…).

Caption: The Secure Access Service Edge (SASE) platform, to which NUMERYX Technologies’ technology is adapted

The Asguard solution can also adapt to other network technologies such as 5G radio networks or SDN networks (Metro Ethernet). Indeed, 5G networks bring the concept of “network slice” or “virtual networks” (Virtual Network Embedding) to provide differentiated services to their users. Each network slice makes it possible to provide an end-to-end service, composed of different network components and virtual systems based on a shared infrastructure.

Qualifications & Partnerships

Supported since our beginnings in the Asguard adventure and the world of Cybersecurity, in filing our patents or on R&D, from supporting our work to the development of our company, we do not fail to mention the partners and major players in our success:

INRIA :

NUMERYX Technologies’ work notably focuses on developing a filtering technology distributed in these slices to better distribute filtering rules across switches and network functions. The company developed algorithms in partnership with INRIA to distribute these rules across the different equipment, so as to balance the load on the tables, allow upstream filtering of malicious packets and make sharing of these tables possible for the slices created by service providers. The proposed technique is also applicable in environments such as the cloud and the Datacenter.

INPI :

A patent was filed in 2015 at the national level: Bouhoula, A., and Ben, N.N. (2015). “Filtre Ip a Double Masques,” FR3011705 (A1). The Asguard innovation project is based on this patented technology.

ANSSI :

Convinced of the commercial impact of such a certification, the company NUMERYX is aiming for the First Level Security Certification (CSPN), set up by ANSSI.

This certification makes it possible to estimate the product’s resistance to moderate-level attacks. Subsequently, the company is considering a qualification with a security visa, thereby allowing it to access regulated French and European markets. The certification and qualification will provide a competitive advantage over players in the French and international cybersecurity markets.

The Systematic competitiveness cluster :

Which labeled Asguard as an innovative project

La French Tech Paris-Saclay :

Our partner and our support in the development of NUMERYX since its beginnings and its incubation at SQYcub.

Currently, three offers are proposed by NUMERYX in order to address the different client contexts:

• Offer 1 : Integration of Asguard on physical equipment (CPE9);

• Offer 2 : Integration of Asguard as a “white box” on virtual equipment (virtual machine, vCPE10 on classic hosting);
• Offer 3 : Integration of Asguard in the cloud on virtual equipment (virtual machine, vCPE hosted in the cloud). This offer concerns both private and public clouds.

Value proposition

Asguard offers a differentiating value proposition that is therefore based on a solution that is at once:

– Secure perfectly adapted to the specificities of SD-WAN networks

– Compatible with market standards

– Optimized thanks to a high compression rate

– And interoperable thanks to the APIsation of the solution

The APIsation of the solution makes it universal, which is a major advantage compared to other players, who provide specific and locked solutions for a precise network technology.

Thanks to the development of an API, the solution can therefore be integrated by all vendors and integrators on the market.