Start-up Trusted Network Technologies is preparing an upgrade to its unique authentication and access-control offering that could prompt businesses to rethink their use of firewalls.

TNT's Identity consists of an agent called I-Host that runs on PCs and servers, an appliance called I-Gateway that enforces authentication and access policies, and software dubbed I-Manager with which administrators set access policies.

Identity works by setting and enforcing policies that link users to network assets. I-Host embeds in each packet a unique identifier based on users' identities and the identity of the machine being used. I-Gateway sits on the network in the traffic stream, reads the identifiers and enforces policies to allow or deny sessions as they are requested. I-Manager is browser-based software with a graphical user interface for setting policies and managing and gathering activity audits.

All this is done within standard TCP/IP packets without adding overhead or altering network infrastructure, the company says.

An I-Gateway placed in front of a firewall can block unauthorized traffic before it reaches the firewall, says TNT CTO David Shay.

The University of Georgia College of Pharmacy in Athens is considering Identity to protect key administration applications in its network, says John Anderson, management information specialist. The two-factor identification tied to a specific person and a specific machine is potentially less vulnerable to spoofing attempts than a firewall, Anderson says. IP addresses are susceptible to spoofing if a hacker within an organization puts a legitimate IP address on a nearby machine on the same network to exploit internal firewalls, he says.

He is concerned that the Identity system is vulnerable to session hijacking, in which a hacker takes over an established session after I-Gateway has let it be set up.

Shay says I-Host monitors the state of established sessions to prevent hijacking.

I-Gateway also protects networks from hackers by dropping the unauthorized session requests they use to probe networks, says TNT CEO Steve Gant. When hackers get no response, they interpret that as having probed an empty network segment, says Gant, a former vice president at Internet Security Systems.