Specifications of a high-level conflict-free firewall policy language for multi-domain networks

Zhang, Bin; Al-Shaer, Ehab; Jagadeesan, Radha; Riely, James; Pitcher, Corin

doi:10.1145/1266840.1266871

Cited by 59 publications

(44 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The synthetic firewall policy (FPB) ranges in size from 100 to 1000. In this paper, like other firewall management techniques [3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20][21][22], we did not consider the stateful filters for experimental evaluation. The treatment of conflict detection in stateful firewalls is a topic for future work.…”

Section: Geometrymentioning

confidence: 99%

See 1 more Smart Citation

A Topology-Based Conflict Detection System for Firewall Policies using Bit-Vector-Based Spatial Calculus

Thanasegaran¹,

Yin²,

Tateiwa³

et al. 2011

IJCNS

View full text Add to dashboard Cite

Firewalls use packet filtering to either accept or deny packets on the basis of a set of predefined rules called filters. The firewall forms the initial layer of defense and protects the network from unauthorized access. However, maintaining firewall policies is always an error prone task, because the policies are highly complex. Conflict is a misconfiguration that occurs when a packet matches two or more filters. The occurrence of conflicts in a firewall policy makes the filters either redundant or shadowed, and as a result, the network does not reflect the actual configuration of the firewall policy. Hence, it is necessary to detect conflicts to keep the filters meaningful. Even though geometry-based conflict detection provides an exhaustive method for error classification, when the number of filters and headers increases, the demands on memory and computation time increase. To solve these two issues, we make two main contributions. First, we propose a topology-based conflict detection system that computes the topological relationship of the filters to detect the conflicts. Second, we propose a systematic implementation method called BISCAL (a bit-vector-based spatial calculus) to implement the proposed system and remove irrelevant data from the conflict detection computation. We perform a mathematical analysis as well as experimental evaluations and find that the amount of data needed for topology is only one-fourth of that needed for geometry.

show abstract

Section: Geometrymentioning

confidence: 99%

“…Various techniques have been developed to manage firewall policies [3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20][21][22]. Among these are firewall analysis tools [4,5] and techniques that focus on minimizing the firewall rules [6].…”

Section: Introductionmentioning

confidence: 99%

A Topology-Based Conflict Detection System for Firewall Policies using Bit-Vector-Based Spatial Calculus

Thanasegaran¹,

Yin²,

Tateiwa³

et al. 2011

IJCNS

View full text Add to dashboard Cite

show abstract

“…The rule sets in firewalls can become large when there is a combination of complex user requirements, diverse networked applications and need to combat increasingly sophisticated network based attacks [3]. A large rule set can have a detrimental effect on the performance of the firewall or require more expensive hardware that can cope with the large number of packet matches [4].…”

Section: Background/problemmentioning

confidence: 99%

A method for moving rules in a network with multiple packet filters

Mothersole

Reed

2011

2011 3rd Computer Science and Electronic Engineering Conference (CEEC)

View full text Add to dashboard Cite

In a network where multiple packet filtering firewalls exist, it can be beneficial to distribute the filtering rules in a certain way, for example, move all the rules towards the edge (main gateway) of the network, or to evenly distribute the rules over the firewalls. Configuring firewalls is a complex task and can be very error prone. To move rules between firewalls, many factors need to be considered to ensure the global security policy remains unchanged. In this paper we present a novel method which describes how to move rules between the firewalls and what, if any, changes need to be made to the rule(s). With this work we have also presented a generic network model which can be applied to any network topology and therefore allows the method for moving rules to be applied to any network topology (so long as it meets the criteria).Applications of the work include improving the network bandwidth utilisation, when unwanted traffic is filtered out early, and also improving the processing loads on each firewall, thus reducing delays and increasing traffic throughput. Factors to be considered when moving filtering rules include the relationships which can exist between filtering rules. Naive removal and insertion of filtering rules can alter inter-rule relationships and therefore also alter the security policy -the method we present ensures the security policy remains unchanged.

show abstract

“…FLIP [32] is a recently proposed firewall language which can also compile into several low-level ones. Their authors claim that ACLs expressed in FLIP are consistent.…”

Section: Rule Set Designmentioning

confidence: 99%