Enhancing HPC Security with a User-Based Firewall

TL;DR

This paper introduces a user-based firewall for HPC systems that automates network security rules at the OS level, eliminating the need for user or developer intervention and maintaining system usability.

Contribution

It presents a novel Linux netfilter-based firewall that automatically enforces security policies in HPC environments without impacting user experience.

Findings

Firewall rules are effective in securing HPC internal networks.

Implementation is transparent to users, preserving usability.

System does not require user or developer configuration.

Abstract

HPC systems traditionally allow their users unrestricted use of their internal network. While this network is normally controlled enough to guarantee privacy without the need for encryption, it does not provide a method to authenticate peer connections. Protocols built upon this internal network must provide their own authentication. Many methods have been employed to perform this authentication. However, support for all of these methods requires the HPC application developer to include support and the user to configure and enable these services. The user-based firewall capability we have prototyped enables a set of rules governing connections across the HPC internal network to be put into place using Linux netfilter. By using an operating system-level capability, the system is not reliant on any developer or user actions to enable security. The rules we have chosen and implemented are crafted to not impact the vast majority of users and be completely invisible to them.