2‑3

2 Telecommunication Radio Broadcast

Tips of Allowlist Based Firewall Operation
for the Tokyo 2020 GamesOSAWA Yoshika

SASAKI Junichi

ASOU Takamichi

IWASA Isao

The data network for the Olympic and Paralympic Games Tokyo 2020 adopted the Allowlist firewall system as a
network‑level security measure After two and a half years of operating the access control lists (ACLs) on the firewalls
installed in the data network for the Games including the preparation period the total number of ACLs at the time of theGames was over 400 000 lines (up to 260 000 lines for a single FW) This article introduces the operations performed tokeep this huge number of ACLs consistent with the network policy without misconfiguration
Keywords：Tokyo 2020 Games Allowlist Firewall ACL Security policy

1．Introduction

extremely rare to be adopted in enterprises
However in case of the data network for the Olympic

The Allowlist scheme clarifies necessary communica-and Paralympic Games Tokyo 2020 (hereinafter re-tion information (IP addresses and port numbers) inferred to as “Tokyo 2020 Games”) we dared to take on

advance as communication requirements and blocks all

this challenge as the network infrastructure supporting acommunication that does not meet these requirements

mission‑critical international event and overcame a

While this method provides strong security it isnumber of problems through well designed workflow

complicated because the number of access control lists

operation and thorough auditing(ACLs) set in the firewall (FW : Firewall) is huge andThis article describes the efforts made for thethe FW settings must be added or deleted each time theoperation and management of FWs in the Games Data

communication requirements updated due to changes in

Network using the “Allowlist” method as described in

the environmentSection “2‑2 Architecture of Data Network for thesuch as installation of servers orconstruction of venues And complexity in operation canTokyo 2020 Games”

be prone to configuration errors So that this method is

2．ACL Management of FWs
OSAWA Yoshika
Technology Planning Department Nippon Telegraph and Telephone Corporation
E‑mail Yoshika osawa@ntt com
SASAKI Junichi
Network Business Headquarters Nippon Telegraph and Telephone EastCorporation
E‑mail j sasaki@east ntt co jp
ASOU Takamichi
New Business Development Headquarters Nippon Telegraph and Telephone
East Corporation
E‑mail Takamichi asou yv@east ntt co jp
IWASA IsaoNetwork Business Headquarters Nippon Telegraph and Telephone East
Corporation
E‑mail i iwasa@east ntt co jp

The Journal of The Institute of Electronics Information and Communication Engineers Vol 105 No 8 Supplement pp 32‑37 August 2022
© 2022 The Institute of Electronics Information and Communication Engineers32

FW is a device that increase security by controlling
network‑level connectivity and the configuration information for controlling them is called ACL
In the Games Data Network FWs were deployed inthe Data Centre where servers related to the Games
operation were deployed and in all the 57 venues wherethe Games Data Network was available
The information to create ACLs for the FWs wasmanaged by the communication requirements tables
submitted by each of the 52 Functional Areas (FAs) ofTHE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

the Organising Committees using the Games Data
Network The total number of ACLs at the beginning ofthe Tokyo 2020 Games exceeded 400 000 lines of all theFWs the one that set most ALCs was the FW installedin the Primary Data Centre (PDC) which had more than

3．Operation and Management of ACL
Configuration
31Development of ACL Configuration WorkflowRequests for ACL configuration changes in FWs weremanaged in work units called Service Requests (SRs)260 000 lines (Table 1)

Each FA filled out the communication requirement
tables with the requested information registered it in
the Document Management System (DMS)

andsubmitted the SR through the ticketing system (ITSM)
Table 1Venue
12

The FW setup team was responsible for the ACL

Number of ACLs for Major Venues
Equipment
PDC‑OIN‑FW

PDC(Primary Data Centre)

Number ofACLs
263 290

settings Since SRs were expected to be submitted inlarge volumes an ITSM manager was assigned tomanage the progress of the tickets

PDC‑SVMGMT‑FW

6 311

After receiving a work request from the ITSM

3PDC‑OTN‑FW

65 675manager the FW configuration team checked the work

4SDC‑OIN‑FW

124 167

content

determined the target FW and the ACL

688

content

coordinated schedule for the work date

SDC
SDC‑SVMGMT‑FW(Secondary Data Centre)
6SDC‑OTN‑FW
51 803

executed the work reviewed the results of the work

7International
Broadcasting Centre

IBC‑OIN‑UTM

4 113

updated the communication requirements tables and8

Main Press Centre

MPC‑OIN‑UTM

2 284

reported the work completion in the SR ticket After9Olympic Stadium

OLS‑OIN‑UTM

1 921

confirming the completion of the work by ITSM each

10

Technology Operation
CentreTOC‑OIN‑UTM

2 645

FA confirmed the communication and closed the SRticket (Figure 1)

Figure 1 FW Setting Workflow
The workflow from the FA issues the configuration request to confirm theresult of the work and closes the ticket A responsible person was assigned to each of the requester FA ticket
manager and FW team to prevent omissions

Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 2020

33

32

Maintenance of Communication Requirement
Tables

The communication requirement tables contained theID

work contents (setting request flag)

This process detected omissions in the configuration
request flags and prevented discrepancies between thesource

communication requirements tables and the configuration information to be applied to the equipment

information (name IP address protocol port number)and destination information (name IP address port332

Extraction of Communication Requirementsnumber) for each requirement Listing the work targets

for Each FW

by both name and IP address was to make it easier for

As described in Section 2

the total number ofthe requesting FA and for the approver to identify thecommunication requirement tables submitted by FAs

targets The communication requirement tables wereamounted to 172 But the communication requirement

updated by overwriting the same files and the versions

tables did not contain information of FWs to be worked

were managed by using DMS

on so communication requirements for each FW wereadded (Figure 2)

33
331

Preparation for FW Setting
Extraction of Work Contents

If the impact of the settings on the Games Data
Network for the competition was significant

theAfter the SR ticket was submitted the ITSM manager

configuration information was applied to the FWsinstructed the FW setup team to start the preliminary

prepared for verification and the correctness of the

preparations by downloading the communication re-settings and the operational status of the FWs werequirements tables for the SR from the DMS confirming

confirmedthat there were no discrepancies between the contentsof the SR and the communication requirements tables

34

and then checking the differences with the versions of

The requirement tables compiled for each FW was

the communication requirements tables received in thebatch‑registered to the FW management server

most recent SR using a tool for requirements compari-through the API using an in‑house batch installation toolson(Figure 3)

FW Configuration and Verification

Figure 2 Image of Extracting Requirements to Be Submitted to Each FW
The FWs to be worked on are allocated byeach requirement listed in the communication requirement table created by the requester FA and a requirement table foreach FW is created34

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

Figure 3 Image of using the Batch Installation Tool
The requirement list for each FW is registered inthe FW management server using the batch installation tool and then the configuration information isreflected in the individual FWs

Figure 4 Comparison of Differences Before and After Deployment
The configuration information
before and after reflecting ACL configuration information in FWs is compared and it is confirmed that theresult of the work is consistent with the desired result

The key to this process was to obtain the ACL settings

deployment the work was flagged as completed in theof the FW before deployment and to compare them with

communication requirement table and registered in thethe ACL settings after deployment in the post‑process-DMS A SR was issued to the ITSM indicating that theing step

work was completed
After receiving the SR from ITSM the requester FA

35

Post‑configuration Processing

confirmed the communication and closed the ticket

As a post‑processing check we created a tool tocheck the differences in ACLs before and after

4．ACL Audit

deployment and used it to confirm that the work
performed had the desired results (Figure 4)

The check processes described so far in the FW setup

After the post‑processing check was completed bywork are all procedures to correctly reflect thecomparing with the ACL settings before and after

communication requirements requested by the FA inSpecial Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 202035

Figure 5 Image of Path Audit
The communication policy states that communication between Internal and Untrusted is
No If all of setting conform to policy all paths will be drawn in green However in this example communication path isopened for TCP/22 between Internal and Untrusted then the path in red indicates the existence of an offending paththe target device In order to be more flawlessly thefatal policy violations were detected during the Tokyoaudit was conducted to check the ACL settings from the2020 Games period we were able to point out that thefollowing two perspectives :management documents had not been updated for theexceptionally permitted paths･

Comparison of the communication requirement･

Comparison of ACLs and routing informationtable and the ACLs of the FW
with communication policy (path auditing)

5．Conclusion
This article has described the process management
and auditing methods that enabled the operation of an41

Comparison of Communication Requirement

Allowlist‑type FW with more than 400 000 lines ofTable and ACLs

ACLs which achieved consistent network segmentation

In the FW configuration work we constructed a flow

without omissions even though configuration change

to ensure that the differences in the communication

requests were made almost every week for about two

requirement tables are set but we cannot eliminate theand a half years starting in March 2019

possibility that human error may be occurred during

This article focuses on the completed workflow at thelong‑term operation Therefore we made an in‑housetime when the operation was established to start thetool to compare the communication requirement table

Tokyo 2020 Games but the road to operational maturity

and ACL configuration informationand conducted

was not an easy one For example in the beginning theperiodic audits to ensure that all the contents of theunderstanding of the communication requirements

communication requirement tables were surely config-

among the parties concerned including FAs varied

ured in the FWthen changes to the format were sometimes unavoidable Even when format changes were decided upon

42

Path Auditing

careful explanation and adequate time were needed toPath auditing is used to verify the reachability ofensure that the need for such changes was understood

application level between segments of the network based

The number and timing of servers and other equipmenton the ACLs of FWs and routing information of network

installed by each FA varied and when the requests

devices and to confirm whether there are communica-

were concentrated the workload was more than wetion paths that violate the communication policy

could have expected

specified at the time of design (Figure 5)

During the Tokyo 2020 Games we observed approxi-

The audit targeted routers and FWs of the BON andmately 450 million security events and were able toCPN that were critical to the operation of the Tokyo 2020

properly handle and block all of them However theGames (PDC : 21 units Venue : 258 units) Although noAllowlist based micro‑segmentation we have created36

THE JOURNAL OF THE INSTITUTE OF ELECTRONICS INFORMATION AND COMMUNICATION ENGINEERS

ensures that even if attackers who wanted to launch
cyberattacks on the Tokyo 2020 Games were topenetrate deep into the network bypassing the manylayers of security measures it would not be easy forthem to conduct their activities(Received February 28 2022 ; Revised March 23 2022)

OSAWA Yoshika
Completed his masterʼs degree at the University of Tokyo Graduate School of Engineering in2015 He joined Nippon Telegraph and Telephone East Corporation in the same year andhas been engaged in the design construction
and operation of the FW deployed in the data
network for the Tokyo 2020 Games since 2018
Currently he works at the Technology Planning Division of Nippon Telegraph and Telephone CorporationASOU Takamichi
Completed his masterʼs degree at Gunma
University in 2007 He completed his masterʼscourse at the University of Information Security in 2013 He has been engaged in cybersecurity policy review and operation Currently he is the Manager in charge of Security
Services Business Development Division 3 at
Nippon Telegraph and Telephone East Corporation
IWASA Isao
Completed his masterʼs degree at Saitama
University in 1989 He joined Nippon Telegraphand Telephone Corporation in the same year
and has been with Nippon Telegraph andTelephone East Corporation since 2008 Since
then he has been engaged in service development and security‑related work for telecommunications services Currently he is the General
Manager of the Office of Network Security at
Nippon Telegraph and Telephone East Corporation

SASAKI Junichi
Completed his masterʼs degree in informationengineering at Muroran Institute of Technologyin 2000 He joined Nippon Telegraph andTelephone East Corporation in the same year
Since then he has been engaged in telecommunication services development of security
infrastructure and promotion of security
business Currently he is a chief of the Office of
Network Security at Nippon Telegraph andTelephone East Corporation㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇㍇Special Issue : Technology and Innovation in the Olympic and Paralympic Games Tokyo 202037