NetCap: Data-Plane Capability-Based Defense Against Token Theft in Network Access

NetCap: Data-Plane Capability-Based Defense Against Token Theft in Network Access

Speakers: Osama Bajaber

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=YrbRTLc9zaU

Overview

Token theft remains one of the most exploited attack vectors in modern authentication systems, enabling attackers to impersonate legitimate users and bypass credential requirements entirely. This talk introduces NetCap, the first system to realize network-level capability-based defense against stolen access tokens. By cryptographically binding capabilities to specific process IDs and network service destinations using the SipHash algorithm running directly on programmable switches (Tofino), NetCap adds continuous per-request, per-process authentication that operates transparently across a wide range of communication protocols -- without modifying applications, kernel source code, or existing authentication protocols. The system blocked 100% of attack traffic from stolen tokens while maintaining negligible latency overhead of just 130 nanoseconds for data packets.

Background

▶ Watch: Token theft problem: stolen tokens enable impersonation (0:00)

In standard token-based authentication, after a client authenticates with credentials, the application server returns an access token that the client appends to all future requests. These tokens typically have long lifetimes ranging from hours to days, creating a large attack window. Attackers who compromise a victim's host -- through zero-day vulnerabilities, memory scraping, cross-site scripting, or network packet sniffing -- can steal these tokens and use them from any process or machine to access services without credentials.

The fundamental problem stems from two issues: access tokens are not bound to authorized processes (application servers have no visibility into which process is sending the token, forcing ambient trust to all processes on the host), and tokens have long lifetimes that give attackers extended windows to exploit stolen credentials.

Existing mitigations are either protocol-specific (not applicable broadly), operate at the device level (still granting ambient trust to all processes on the device), or rely on continuous biometric/behavioral authentication that doesn't provide process-level granularity. NetCap takes a different approach by extending capability-based access control -- traditionally limited to local memory access in operating systems -- to the network level.

Key Findings

▶ Watch: Rethinking access control: from ACLs to network capabilities (4:00)

Process-Level Network Capabilities: NetCap generates cryptographic capabilities that incorporate both process-level information (process ID) and network-level information (destination server address/port), creating a fine-grained binding that traditional capability systems and token-based authentication systems lack.

Zero Attack Traffic Forwarded: In testing with sophisticated attack scenarios across multiple communication protocols, NetCap blocked 100% of traffic from processes using stolen access tokens while maintaining network performance for legitimate traffic equivalent to the forwarding baseline.

Negligible Overhead: By processing capabilities directly in programmable switch hardware at line rate, data packets experience only 130 nanoseconds of additional latency. Sending capabilities as separate control packets rather than appending to every data packet eliminates per-packet overhead on the data stream.

Transparent Deployment: NetCap requires no modifications to application servers, communication protocols, client applications, or kernel source code. Client-side eBPF programs handle capability management transparently, and the programmable switch handles generation, validation, and refresh in the data plane.

Technical Deep Dive

▶ Watch: Programmable switches and eBPF as key enablers (8:00)

NetCap's architecture spans three components:

Programmable Switch (Tofino): The core enforcement point. When a client authenticates, a lightweight eBPF-based program on the server monitors authentication logs and signals the programmable switch that the client has been authenticated. The switch extracts the process ID and network-level information, then runs the SipHash algorithm (a lightweight cryptographic hash function) with a secret key, the process ID, destination network information, and a timestamp to generate the capability. This capability is sent back to the client.

For validation, when a process sends a request with its capability and PID, the switch regenerates the capability using the same inputs and secret key, comparing it against the carried capability. If they match, it checks whether the capability has expired based on the timestamp. Valid, non-expired capabilities are forwarded; expired ones trigger automatic refresh with a new secret key.

Client-Side eBPF Programs: Three eBPF functions operate transparently on the client machine:

1. Ingress function: Extracts incoming capabilities from packets
2. Capability map manager: Maintains an internal map linking capabilities to process IDs and authenticated servers
3. Egress function: Fetches the appropriate capability for outgoing packets based on the sending process ID and destination

Capability as Control Packets: Rather than appending capabilities to every data packet (which adds per-packet overhead), capabilities are sent as separate control packets. The data packet stream flows unmodified, maintaining baseline network performance.

PID Lifecycle Management: eBPF programs monitor process termination events. When a process exits, its capabilities are immediately removed from the capability map, preventing PID reuse attacks where a new process inherits a terminated process's PID.

Demo / Proof of Concept

▶ Watch: End-to-end authentication flow on Tofino switch (10:00)

The researchers evaluated NetCap on a physical Tofino switch test bed using real-world traces and datasets. Attack scenarios included:

• Attackers on the same victim machine stealing tokens through memory scraping and attempting to use them from a different process
• Attackers on different hosts within the network using stolen tokens
• Attacks across multiple communication protocols

Results showed NetCap successfully blocked all attack traffic while maintaining data throughput at the switch's maximum capacity and adding only 130 nanoseconds of latency for data packets. The system was also tested with real-world complex applications to validate transparent operation.

Defensive Implications

▶ Watch: Evaluation: 100% attack blocking with 130ns data packet latency (14:00)

NetCap advances zero trust architecture by providing continuous, per-request, per-process authentication at the network level:

Token Theft Mitigation: For organizations relying on token-based authentication (OAuth, JWT, session tokens, API keys), NetCap adds a layer that renders stolen tokens useless without the corresponding capability, which is cryptographically bound to the specific process that was authenticated.

Zero Trust Enablement: NetCap's continuous capability validation and automatic refresh implements zero trust principles at the network data plane level, with process-level granularity that goes beyond traditional network segmentation or device-level authentication.

Protocol Agnostic: Unlike protocol-specific mitigations (e.g., DPoP for OAuth), NetCap works across any communication protocol that traverses the programmable switch, providing a universal defense layer.

Deployment Considerations: Organizations need programmable switches (Tofino or similar P4-capable hardware) at network choke points and eBPF support on client machines. No changes to application servers, protocols, or operating system kernels are required, making deployment less invasive than many security solutions.

Future Directions: The researchers identify capability delegation (allowing processes to share capabilities with child processes or across hosts) with revocation support, eBPF-based memory access mediation, and offloading eBPF programs to SmartNICs for even faster packet modification as future research directions.

Key Takeaways

• NetCap is the first system to implement network-level capability-based defense against token theft, binding capabilities to specific process IDs and network destinations
• The SipHash-based capability generation and validation runs directly on programmable switches at line rate with only 130 nanoseconds overhead
• 100% of attack traffic from stolen tokens is blocked while legitimate traffic maintains baseline performance
• Client-side eBPF programs manage capabilities transparently without modifying applications, protocols, or kernel code
• Automatic capability refresh with short lifetimes limits the window for any potential capability compromise
• Process termination monitoring via eBPF prevents PID reuse attacks

About the Speaker(s)

Osama Bajaber recently completed his PhD at Virginia Tech and is currently an assistant professor at King Abdulaziz University in Saudi Arabia. The work was conducted jointly with Dr. Boji and Dr. Pinga at Virginia Tech. The research focuses on network security, programmable data planes, and extending capability-based access control from operating systems to network-level defense.