Automated optimal firewall orchestration and configuration in virtualized networks

Abstract

Emerging technologies such as Software-Defined Networking and Network Functions Virtualization are making the definition and configuration of network services more dynamic, thus making automatic approaches that can replace manual and error-prone tasks more feasible. In view of these considerations, this paper proposes a novel methodology to automatically compute the optimal allocation scheme and configuration of virtual firewalls within a user-defined network service graph subject to a corresponding set of security requirements. The presented framework adopts a formal approach based on the solution of a weighted partial MaxSMT problem, which also provides good confidence about the solution correctness. A prototype implementation of the proposed approach based on the z3 solver has been used for validation, showing the feasibility of the approach for problem instances requiring tens of virtual firewalls and similar numbers of security requirements.

Short Paper

“…Later, formal verification techniques have been exploited to provide correctness assurance after the automated computation of firewall configurations ( [12], [5], [17], [22], [1]). Then, after the advent of softwarization in networking, this research path has found new relevance ( [20], [8], [9], [6]) and currently has become an important research trend in network security.…”

Automatic Firewalls’ Configuration Using Argumentation Reasoning

“…The most significant frameworks for automatic configuration of packets filtering firewalls based on policy refinement are FIRMATO [4], FACE [25], MI-RAGE [9], and VEREFOO [7]. Moreover, a refinement model that allows the translation of high-level security requirements into low-level configuration settings for the virtual network security functions was introduced in [5].…”

“…The first step is to understand which are the paths for a certain package to go from the source to the destination. For req 3 we have 1 // p is a policy rule 2 if configuration=="max" then Algorithm 2: Firewalls' population algorithm two paths: the first uses F w 1 7 and F w 3 and the second uses F w 2 ; for req 1 we have two paths: the first uses F w 1 and F w 3 and the second uses F w 2 ; and for req 4 we have two paths: the first uses F w 1 and the second uses F w 2 and F w 3 . req 3 should be applied in all paths, as it is an "allow " action, thus, it should be placed in all firewalls.…”

“…Since req 5 is more specific, then it has higher priority than req 4 , (req 5 > req 4 ); -Conflict 4 -redundancy: req 6 is included in req 4 and their actions are the same. Since req 6 is more specific and allows the traffic, then it is removed; -Conflict 5 -correlation: there is an intersection between the packets of req 7 and req 8 and their actions are different. Due to the resolution strategy employed, req 8 has higher priority than req 7 , (req 8 > req 7 ); -Conflict 6 -redundancy: req 10 is included in req 9 and their actions are the same.…”

Introducing programmability and automation in the synthesis of virtual firewall rules

“…In light of these observations, the challenge we propose to face is to effectively exploit the benefits provided by the virtual networking paradigms, minimizing the impact of their beforehand illustrated drawbacks. With this aim, we designed a framework based on the innovative methodology presented in [8], based on Maximum Satisfiability Modulo Theories (MaxSMT), and we integrated it in the context of Kubernetes. The proposed approach automatically configures virtual firewalls, where a consistent number of configuration errors are traditionally performed.…”