A Topology-Based Conflict Detection System for Firewall Policies using Bit-Vector-Based Spatial Calculus
A Topology-Based Conflict Detection System for Firewall Policies using Bit-Vector-Based Spatial Calculus
复制标题
DOI：
10.4236/ijcns.2011.411084
复制
发表时间：
2011-10
期刊：
影响因子：
--
通讯作者：
Subana Thanasegaran;Yi Yin;Y. Tateiwa;Y. Katayama;N. Takahashi
中科院分区：
文献类型：
--
作者：
Subana Thanasegaran;Yi Yin;Y. Tateiwa;Y. Katayama;N. Takahashi
防火墙使用包过滤，根据一组称为过滤器的预定义规则接受或拒绝包。防火墙构成了初始防御层，保护网络免受未经授权的访问。但是，维护防火墙策略始终是一项容易出错的任务，因为策略非常复杂。冲突是当数据包匹配两个或多个过滤器时发生的错误配置。防火墙策略中冲突的出现会使过滤器冗余或被遮蔽，从而导致网络不能反映防火墙策略的实际配置。因此，有必要检测冲突以保持过滤器的意义。尽管基于几何的冲突检测提供了一种详尽的错误分类方法，但是当过滤器和头的数量增加时，对内存和计算时间的需求也会增加。为了解决这两个问题，我们做出了两个主要贡献。首先，我们提出了一种基于拓扑的冲突检测系统，该系统通过计算滤波器的拓扑关系来检测冲突。其次，我们提出了一种称为BISCAL（基于位向量的空间微积分）的系统实现方法来实现所提出的系统，并从冲突检测计算中去除无关数据。我们进行了数学分析和实验评估，发现拓扑所需的数据量仅为几何所需的四分之一。
Firewalls use packet filtering to either accept or deny packets on the basis of a set of predefined rules called filters. The firewall forms the initial layer of defense and protects the network from unauthorized access. However, maintaining firewall policies is always an error prone task, because the policies are highly complex. Conflict is a misconfiguration that occurs when a packet matches two or more filters. The occurrence of conflicts in a firewall policy makes the filters either redundant or shadowed, and as a result, the network does not reflect the actual configuration of the firewall policy. Hence, it is necessary to detect conflicts to keep the filters meaningful. Even though geometry-based conflict detection provides an exhaustive method for error classification, when the number of filters and headers increases, the demands on memory and computation time increase. To solve these two issues, we make two main contributions. First, we propose a topology-based conflict detection system that computes the topological relationship of the filters to detect the conflicts. Second, we propose a systematic implementation method called BISCAL (a bit-vector-based spatial calculus) to implement the proposed system and remove irrelevant data from the conflict detection computation. We perform a mathematical analysis as well as experimental evaluations and find that the amount of data needed for topology is only one-fourth of that needed for geometry.