Test frameworks for network security devices

点击翻译按钮获取中文摘要

Along with the many benefits of the Internet come the well known dangers. Computers connected to the Internet face a steady stream of attacks. The first line of defense is the firewall. Home firewalls are available as PC software or inexpensive appliances sold as "home routers". Powerful commercial firewalls protect web servers and business LANs, as well as industrial networks used for manufacturing and power generation. Each firewall contains a set of filtering rules designed to permit legal Internet packets and to filter out all other packets. Unfortunately, it is difficult to develop rules which do this precisely. Today's Internet applications use complex protocols and hackers often make their attack packets look very similar to legal packets. As a result, firewall filtering rules are long and complex, and often contain errors. Systematic testing can help find the errors before the firewalls are installed. Voice over IP (VoIP) is an exciting new application: an Internet telephone service which is inexpensive and globally available. Unfortunately, the VoIP protocols are also complex. It is not yet understood how to modify existing filtering rules to allow VoIP traffic and still block illegal traffic. Without research in this area, the benefits of VoIP will come with significant security drawbacks. This research project will improve firewall effectiveness in two ways: (1) by developing software to automatically test filtering rules, revealing errors before the firewalls are installed, and (2) by developing and testing firewall filtering rules specifically aimed at the new VoIP protocols.