Network Firewall Policy Tries ∗
نویسندگان
چکیده
Network firewalls remain the forefront defense for most computer systems. These critical devices filter traffic by comparing arriving packets to a list of rules, or security policy, in a sequential manner. Unfortunately packet filtering in this fashion can result in significant traffic delays, which is problematic for applications that require strict Quality of Service (QoS) guarantees. Furthermore, as network speeds and capacities continue to increase, the processing time associated with filtering only compounds these delays. Given this demanding environment, new methods are needed to increase network firewall performance. This paper introduces a new technique for representing a security policy in software that maintains policy integrity and provides more efficient processing. The policy is represented as an n-ary retrieval tree, also referred to as a trie. This structure is able to quickly reach decisions based on the security policy by simultaneously eliminating multiple rules with few comparisons. As a result, the worst case processing requirement for the policy trie is a fraction compared a list representation, which only consider rules individually (1/5 the processing for TCP/IP networks). Furthermore unlike other representations, the n-ary trie developed in this paper is proven to maintain policy integrity. The creation of policy trie structures is discussed in detail and their performance benefits are proven theoretically and validated empirically.
منابع مشابه
Firewall Management for to Resolve the Policy Anomalies
Firewall is a security system for network, that controls the network traffic based on firewall rules. Firewall depends on the policy configuration, but managing that firewall policy is complex. Existing policy analysis tools, such as Firewall Policy Advisor and FIREMAN, they can only detect the policy anomaly cannot resolve these anomalies, and detection time was also increased. Therefore, I re...
متن کاملA Matrix Model for Designing and Implementing Multi-firewall Environments
Firewalls are core elements in network security, the effectiveness of firewall security is dependent on configuring the firewall policy correctly. A firewall policy describes the access that will be permitted or denied from the trusted network. In a corporate network several firewalls are setup and administrated by different individuals. The consistency between those firewall policies is crucia...
متن کاملFirewall Policy Advisor for Anomaly Discovery and Rule Editing
Firewalls are core elements in network security. However, managing firewall rules, especially for enterprize networks, has become complex and error-prone. Firewall filtering rules have to be carefully written and organized in order to correctly implement the security policy. In addition, inserting or modifying a filtering rule requires thorough analysis of the relationship between this rule and...
متن کاملFirewall Analysis with Policy-based Host Classification
For administrators of large systems, testing and debugging a firewall policy is a difficult process. The size and complexity of many firewall policies make manual inspection of the rule set tedious and error-prone. The complex interaction of conflicting rules can conceal serious errors that compromise the security of the network or interrupt the delivery of important services. Most existing too...
متن کاملFirewall Policy Diagram: Structures for Firewall Behavior Comprehension
Communication security and regulatory compliance have made the firewall a vital element for networked computers. They provide the protections between parties that only wish to communicate over an explicit set of channels, expressed through protocols, traveling over a network. These explicit set of channels are described and implemented in a firewall using a set of rules. The firewall implements...
متن کامل