Policy Algebras for Hybrid Firewalls
نویسندگان
چکیده
Firewalls are a effective means of protecting a local system or network of systems from network-based security threats. In this paper, we propose a policy algebra framework for security policy enforcement in hybrid firewalls, ones that exist both in the network and on end systems. To preserve the security semantics, the policy algebras provide a formalism to compute addition, conjunction, subtraction, and summation on rule sets; it also defines the cost and risk functions associated with policy enforcement. Policy outsourcing triggers global cost minimization. We show that our framework can easily be extended to support packet filter firewall policies. Finally, we discuss special challenges and requirements for applying the policy algebra framework to MANETs.
منابع مشابه
A History and Survey of Network Firewalls
Firewalls are network devices which enforce an organization’s security policy. Since their development, various methods have been used to implement firewalls. These methods filter network traffic at one or more of the seven layers of the ISO network model, most commonly at the application, transport, and network, and data-link levels. In addition, researchers have developed some newer methods, ...
متن کاملFulp . Effects of Processing Delay on Function - Parallel Firewalls
Comprehensive security policies are an integral part of creating a secure network and commonly firewalls are used to accomplish this. Firewalls inspect and filter traffic arriving or departing a network by comparing packets to a set of rules and performing the matching rule action, which is accept or deny. Unfortunately, traffic inspection of this type can impose significant delays on traffic d...
متن کاملLocation Aware Self-Adapting Firewall Policies
Private access to corporate servers from Internet can be achieved using various security mechanisms. This article presents a network access control mechanism that employs a policy management architecture empowered with dynamic firewalls. With the existence of such an architecture, system and/or network administrators do not need to reconfigure firewalls when there is a location change in user s...
متن کاملHybrid Tree-rule Firewall for High Speed Data Transmission
Traditional firewalls employ listed rules in both configuration and process phases to regulate network traffic. However, configuring a firewall with listed rules may create rule conflicts, and slows down the firewall. To overcome this problem, we have proposed a Tree-rule firewall in our previous study. Although the Tree-rule firewall guarantees no conflicts within its rule set and operates fas...
متن کاملSpecification, Analysis and Resolution of Anomalies in Firewall Security Policies
Firewalls are essential components in network security solutions. Managers have to specify their organizational security policies using low level and order-dependent rules in firewalls. Furthermore, dependency of firewalls to the network topology, frequent changes in network topology and lack of an automatic method for analysis and verification of anomalies in specified security policy lead to ...
متن کامل