An Axiomatic Approach to Firewall Rule Update

A firewall administrator often needs to update a given firewall, to take account of evolving security requirements or to correct a wrongly classified packet. We look at the problem of firewall update, mainly from an axiomatic viewpoint. An axiom for firewall update is a property which any reasonable method of updating should fulfill. We propose a number of such axioms. We also give some simple examples of firewall update algorithms and check them against the axioms.