Skip to content
SkiMasque
Sign InGet Started

Security starts with reducing what needs to be trusted.

SkiMasque's security model is based on minimizing standing network access.

Security layers

  1. IDENTITYwho is asking
  2. POLICYwhat they may reach
  3. SESSIONfor how long
  4. GATEWAYthe path in
  5. NETWORKyour private network
Security is layered: identity, policy, session, gateway and network each rest on the layer below.

No standing access

Instead of a permanent credential that opens the network, an identity is checked against policy, receives a temporary session, and the session expires.

Standing access

  1. Credential
    standing access
  2. Private network
A stored credential gives standing access to the network at all times.

No standing access

  1. Identity
    policycontrol plane
  2. Policy
    active
  3. Session ACTIVE
    expirespotential
  4. Session EXPIRED
An identity is checked against policy, receives a session, and the session expires.
A stored credential can keep working until it is revoked; a SkiMasque session expires.

Default deny

Only explicit matching access grants a session.
  1. REQUEST
  2. NO MATCH
    denied
  3. DENY
A request that matches no allow rule is denied.

Least privilege

Access can be constrained by:

  • identity
  • application
  • destination
  • protocol
  • port
  • duration
  • bandwidth

Bandwidth and connection limits apply to a whole policy, not to each session. The application name is session context, not proof: the gateway matches on it but does not treat it as authenticated, so policies are best written with the destination as the real constraint.

How the gateway enforces it

A valid tunnel credential alone does not open a tunnel. The gateway checks identity, application, destination, policy, and expiry itself, and all five must resolve to an allow.

Fail closed

Where authentication or authorization can't be established, no tunnel is created. A tunnel without a verifiable credential is refused, and a policy that fails to parse is ignored in favour of the last good one.

Checked in the gateway

Identity, application, destination, policy and expiry are evaluated by the gateway, not assumed because a control plane said so.

Destination address checks

Loopback, private, CGNAT, link-local (including the cloud metadata address) and multicast ranges are refused on the resolved address, so a hostname that resolves to one is still refused, unless a range was explicitly opted in.

Keeps working during an outage

A control-plane outage is designed to degrade management, not enforcement. The gateway keeps enforcing its cached policy while the control plane is unreachable, and verifies credentials locally.

Short-lived credentials

Managed CI/developer credentials default to 15 minutes and are capped at 1 hour; standalone gateway credentials default to 1 hour. Clients refresh supported credentials. Agent sessions default to 30 minutes and are capped at 4 hours or a lower organisation limit. A copied bearer token can be used until expiry or applicable revocation; policy max_duration is not an enforced gateway timeout.

SkiMasque is pre-1.0 and has not had an independent security review. It should not yet be the only control in front of production infrastructure.

Read the security modelRead the threat model

Customer firewall

SkiMasque does not eliminate the customer's network boundary.

For customer-operated gateways:

  1. SKIMASQUE GATEWAY
    active
  2. CUSTOMER FIREWALL
    active
  3. PRIVATE SERVICE
Traffic leaves the SkiMasque gateway, crosses the customer's firewall, then reaches the private service.

Customers can continue to enforce their own network-level controls. The firewall decides what the gateway can reach at all; SkiMasque decides who may use that.

Compartmentalisation

Each workload is granted the destinations its policy names. Everything else is denied.

Job A

Job A
  • allowedactive
    Databasedb.prod:5432
  • everything elsedenied
    DenyDENY
Job A may reach one destination; everything else is denied.

Job B

Job B
  • allowedactive
    Internal APIapi.internal:443
  • everything elsedenied
    DenyDENY
Job B may reach one destination; everything else is denied.
Each job is allowed one destination; anything else is denied by policy.

Auditability

Every access decision is designed to carry enough context to answer:

WHO
the verified identity
WHAT
the application
WHERE
the destination
WHEN
the time of the decision
WHICH POLICY
the policy and rule that decided
WHICH GATEWAY
the gateway that enforced it (identified by the stream it ships on)
RESULT
allow or deny, with a reason

A gateway can write one JSON line per decision. A control-plane deployment ingests each gateway's hash-chained stream and rejects a break in the chain.