A formal logic approach to firewall packet filtering analysis and generation

Abstract

Recent years have seen a significant increase in the usage of computers and their capabilities to communicate with each other. With this has come the need for more security and firewalls have proved themselves an important piece of the overall architecture, as the body of rules they implement actually realises the security policy of their owners. Unfortunately, there is little help for their administrators to understand the actual meaning of the firewall rules. This work shows that formal logic is an important tool in this respect, because it is particularly apt at modelling real-world situations and its formalism is conductive to reason about such a model. As a consequence, logic may be used to prove the properties of the models it represents and is a sensible way to go in order to create those models on computers to automate such activities. We describe here a prototype which includes a description of a network and the body of firewall rules applied to its components. We were able to detect a number of anomalies within the rule-set: inexistent elements (e.g. hosts or services on destination components), redundancies in rules defining the same action for a network and hosts belonging to it, irrelevance as rules would involve traffic that would not pass through a filtering device, and contradiction in actions applied to elements or to a network and its hosts. The prototype produces actual firewall rules as well, generated from the model and expressed in the syntax of IPChains and Cisco's PIX.

IO: An Interconnected Asset Ontology in Support of Risk Management Processes

“…Creating a visual representation of the connections between switches and routers is a common step in any structure analysis process. Topological interconnection represented by formal graphs is also often necessary for research in the domains of network modeling [32], [48] or attack graph generation [49], [37]. "A connection" between two switches, for example, is represented as a property chain between two individuals of the managed network component concept in the IO (see Listing 2).…”

Short Paper

“…The first works ( [2], [25], [13]) proposed firewall management methodologies which could be exclusively applied to networks where any security function was a hardware appliance. Later, formal verification techniques have been exploited to provide correctness assurance after the automated computation of firewall configurations ( [12], [5], [17], [22], [1]). Then, after the advent of softwarization in networking, this research path has found new relevance ( [20], [8], [9], [6]) and currently has become an important research trend in network security.…”

Introducing programmability and automation in the synthesis of virtual firewall rules

“…However, all these three works exclusively target traditional networks, and do not offer either optimality or formal verification. Formal mathematical models have been, instead, presented in [14] and [15], where formal methodologies are used to automatically compute firewall configuration. However, in both cases these techniques work only in specific cases, not related to virtualized networks: [14] follows the syntax of IPChains and Cisco's PIX, whereas [15]'s technique has been validated only with SCADA-firewall configuration.…”