Single Packet Authorization in a Multi-Layered Security Architecture

Single Packet Authorization (SPA) is a concealment method that hides the open ports, devices, and network components behind a firewall. SPA suffers from a known weakness i.e., the SPA client, and if the SPA client gets compromised by an attacker, the attacker can find his way to the SPA server. This paper explores the possible attacks from the SPA client with the focus on the implementation of SPA in multilevel security architecture such as Industrial Control Systems (ICS). It identifies the limitations of SPA on cascading the authorization packet in multiple security levels and proposes to combine SPA with access control. It is shown in the paper that the security of the whole SPA architecture can be improved by adding some features to the SPA server.