Limitation of Listed-Rule Firewall and the Design of Tree-Rule Firewall

Chomsiri, Thawatchai; He, Xiangjian; Nanda, Priyadarsi

doi:10.1007/978-3-642-34883-9_22

Cited by 10 publications

(18 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Chomsiri et al have further studied firewall rules' problems, and published their interesting findings in [3] and [4]. They proposed a Tree-rule firewall to overcome these problems.…”

Section: Background Of Tree-rule Firewallmentioning

confidence: 99%

See 1 more Smart Citation

Hybrid Tree-Rule Firewall for High Speed Data Transmission

Chomsiri¹,

He²,

Nanda³

et al. 2020

IEEE Trans. Cloud Comput.

Self Cite

View full text Add to dashboard Cite

Traditional firewalls employ listed rules in both configuration and process phases to regulate network traffic. However, configuring a firewall with listed rules may create rule conflicts, and slows down the firewall. To overcome this problem, we have proposed a Tree-rule firewall in our previous study. Although the Tree-rule firewall guarantees no conflicts within its rule set and operates faster than traditional firewalls, keeping track of the state of network connections using hashing functions incurs extra computational overhead. In order to reduce this overhead, we propose a hybrid Tree-rule firewall in this paper. This hybrid scheme takes advantages of both Tree-rule firewalls and traditional listed-rule firewalls. The GUIs of our Tree-rule firewalls are utilized to provide a means for users to create conflict-free firewall rules, which are organized in a tree structure and called 'tree rules'. These tree rules are later converted into listed rules that share the merit of being conflict-free. Finally, in decision making, the listed rules are used to verify against packet header information. The rules which have matched with most packets are moved up to the top positions by the core firewall. The mechanism applied in this hybrid scheme can significantly improve the functional speed of a firewall.

show abstract

“…Chomsiri et al have further studied firewall rules' problems, and published their interesting findings in [3] and [4]. They proposed a Tree-rule firewall to overcome these problems.…”

Section: Background Of Tree-rule Firewallmentioning

confidence: 99%

“…On the other hand, redundant rules cause latency in traffic processing and lower the throughput of a network due to the undesirable waste of time on verifying against these rules. The detailed discussion of these problems can be found in our previous work published in [3].…”

Section: Introductionmentioning

confidence: 99%

Hybrid Tree-Rule Firewall for High Speed Data Transmission

Chomsiri¹,

He²,

Nanda³

et al. 2020

IEEE Trans. Cloud Comput.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Users can select attributes that they want for each column before creating tree rules [9]. For example, if we focus the protection on servers inside our network, we should select Destination IP to be the root node [10,13].…”

Section: 1) Implementing a Tree-rule Firewall A) Tree-rule Firewallmentioning

confidence: 99%

The migration of the university IT infrastructure toward a secure IaaS Cloud

Idhammad

Afdel

Asimi

2015

2015 International Conference on Electrical and Information Technologies (ICEIT)

View full text Add to dashboard Cite

The appealing features of Cloud computing have been fueling its integration in many sectors; economy, industry and education. Thus, it become widely used for personal services and for entertainment. Since the arrivals of this paradigm and the providing of services through Internet, information technology live a radical shift in its adoption. The financial benefits and the informatics features of Cloud Computing makes it a necessity to maintain the development of many sectors, as well as education. However, its security weaknesses are the major barrier for its adoption. Over the years, the IT and financial needs of the university keep speedily growing with the increasing number of students. To overcome its requirements, university is called to adopt the Cloud Computing technologies. We propose in this paper a design of a private IaaS Cloud adopted for the university IT infrastructure. Also we propose two solutions to improve its security; especially the isolation of data in the IaaS Cloud, and the isolation of networks within the university by adopting the Tree-Rule Firewall approach.

show abstract

“…This method gives a low performance compared to other searching algorithms. Apart from the speed problem, the traditional firewalls suffer rule conflicts, caused by shadowed rules and redundant rules [4][5] [6] [7], especially the shadowed rules. A shadowed rule is a rule which cannot be matched with any packets because all packets are already matched with other rules above it.…”

Section: Introductionmentioning

confidence: 99%

A Stateful Mechanism for the Tree-Rule Firewall

Chomsiri

Nanda

et al. 2014

2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications

Self Cite

View full text Add to dashboard Cite

In this paper, we propose a novel connection tracking mechanism for Tree-rule firewall which essentially organizes firewall rules in a designated Tree structure. A new firewall model based on the proposed connection tracking mechanism is then developed and extended from the basic model of Netfilter's ConnTrack module, which has been used by many early generation commercial and open source firewalls including IPTABLES, the most popular firewall. To reduce the consumption of memory space and processing time, our proposed model uses one node per connection instead of using two nodes as appeared in Netfilter model. This can reduce memory space and processing time. In addition, we introduce an extended hash table with more hashing bits in our firewall model in order to accommodate more concurrent connections. Moreover, our model also applies sophisticated techniques (such as using static information nodes, and avoiding timer objects and memory management tasks) to improve its processing speed. Finally, we implement this model on Linux Cent OS 6.3 and evaluate its speed. The experimental results show that our model performs more efficiently in comparison with the Netfilter/IPTABLES.

show abstract

Limitation of Listed-Rule Firewall and the Design of Tree-Rule Firewall

Cited by 10 publications

References 4 publications

Hybrid Tree-Rule Firewall for High Speed Data Transmission

Hybrid Tree-Rule Firewall for High Speed Data Transmission

The migration of the university IT infrastructure toward a secure IaaS Cloud

A Stateful Mechanism for the Tree-Rule Firewall

Contact Info

Product

Resources

About