Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Securing an Application Layer Gateway: An Industrial Case Study

Carmine Cesarano, Roberto Natella

TL;DR

This paper addresses the gap in rigorous security testing for Application Layer Gateways (ALGs) in safety-critical domains by proposing a CWE-driven, four-step methodology (risk analysis, attack scenarios, virtual testing environment, and security testing). The approach links CVEs to CWEs to generate targeted attack scenarios and validates them in a simulated, open-source–based testing environment, demonstrated through an on-board railway network case study. Experimental results reveal both policy-enforcement successes and application-layer vulnerabilities, including HTTP Request Smuggling and ReDoS risks in HAProxy, alongside practical performance metrics. The work offers a generalizable framework for evaluating ALG security across network and application layers, with potential to support testing and certification in critical infrastructure deployments.

Abstract

Application Layer Gateways (ALGs) play a crucial role in securing critical systems, including railways, industrial automation, and defense applications, by segmenting networks at different levels of criticality. However, they require rigorous security testing to prevent software vulnerabilities, not only at the network level but also at the application layer (e.g., deep traffic inspection components). This paper presents a vulnerability-driven methodology for the comprehensive security testing of ALGs. We present the methodology in the context of an industrial case study in the railways domain, and a simulation-based testing environment to support the methodology.

Securing an Application Layer Gateway: An Industrial Case Study

TL;DR

This paper addresses the gap in rigorous security testing for Application Layer Gateways (ALGs) in safety-critical domains by proposing a CWE-driven, four-step methodology (risk analysis, attack scenarios, virtual testing environment, and security testing). The approach links CVEs to CWEs to generate targeted attack scenarios and validates them in a simulated, open-source–based testing environment, demonstrated through an on-board railway network case study. Experimental results reveal both policy-enforcement successes and application-layer vulnerabilities, including HTTP Request Smuggling and ReDoS risks in HAProxy, alongside practical performance metrics. The work offers a generalizable framework for evaluating ALG security across network and application layers, with potential to support testing and certification in critical infrastructure deployments.

Abstract

Application Layer Gateways (ALGs) play a crucial role in securing critical systems, including railways, industrial automation, and defense applications, by segmenting networks at different levels of criticality. However, they require rigorous security testing to prevent software vulnerabilities, not only at the network level but also at the application layer (e.g., deep traffic inspection components). This paper presents a vulnerability-driven methodology for the comprehensive security testing of ALGs. We present the methodology in the context of an industrial case study in the railways domain, and a simulation-based testing environment to support the methodology.
Paper Structure (14 sections, 2 figures, 3 tables)

This paper contains 14 sections, 2 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Related work
  3. Methodology
  4. CWE-driven risk analysis
  5. Attack scenarios definition
  6. Testing environment setup
  7. Security Testing
  8. Case study
  9. On-board Train Network
  10. ALG security policies
  11. Experimental Analysis
  12. Network and ALG Setup
  13. Experimental results
  14. Conclusion and Future Work

Figures (2)

  • Figure 1: On-board Train Network
  • Figure 2: On-board train network: simulation on GNS3