Abstract
Firewall is one of the most commonly used techniques to protect a network, it limits or provides access to specific network segments based on a set of filtering rules that should be configured with respect to the global security policy. Nevertheless, the security policy (SP) changes frequently due to business or application needs, and this change often impact firewall configurations by generating new conflicts between different rules. Therefore, discovering and removing automatically the configuration errors is a serious and an unavoidable task. This problem has been addressed through a variety of approaches from firewalls rules analysis to firewall configuration verification, but existent solutions have, essentially, three drawbacks: First, most of them did not analyze all relations between all rules in such a way, some classes of configuration errors could be uncharted. Second, the distinction between syntactic intentional anomalies and effective misconfigurations is not generally highlighted. Third, although anomalies resolution is a tedious and error prone task, it is generally done manually by the network administrator. In this paper, we address this problem using a data structure (FDD: Firewall Decision Diagram). We propose a new approach to detect and correct automatically misconfigurations in a distributed environment. We demonstrate the applicability and scalability of our method by the use of a Satisfiability Solver. The first results we obtained are very promising.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Abbes, T., Bouhoula, A., Rusinowitch, M.: Detection of firewall configuration errors with updatable tree. Int. J. Inf. Secur. 15, 1–17 (2015)
Adiseshu, H., Suri, S., Parulkar, G.M.: Detecting and resolving packet filter conflicts. In: Proceedings IEEE INFOCOM 2000, Tel Aviv, Israel, 26–30 March 2000, pp. 1203–1212 (2000)
Al-Shaer, E.S., Hamed, H.H.: Modeling and management of firewall policies. IEEE Trans. Netw. Serv. Manag. 1(1), 2–10 (2004)
Bera, P., Ghosh, S.K., Dasgupta, P.: Policy based security analysis in enterprise networks: a formal approach. IEEE Trans. Netw. Serv. Manag. 7(4), 231–243 (2010)
Bera, P., Ghosh, S.K., Dasgupta, P.: Integrated security analysis framework for an enterprise network - a formal approach. IET Inf. Secur. 4(4), 283–300 (2010)
Bouhoula, A., Trabelsi, Z., Barka, E., Benelbahri, M.A.: Firewall filtering rules analysis for anomalies detection. IJSN 3(3), 161–172 (2008)
Chomsiri, T., Pornavalai, C.: Firewall rules analysis. In: Security and Management, pp. 213–219 (2006)
Cuppens, F., Cuppens-Boulahia, N., Alfaro, J.G.: Detection and removal of firewall misconfiguration. In: CNIS IASTED, Phoenix, AZ, USA, November 2005
Eppstein, D., Muthukrishnan, S.: Internet packet filter management and rectangle geometry. CoRR, cs.CG/0010018 (2000)
Etopen ruleset (2016)
Alfaro, J.G., Cuppens, F., Cuppens-Boulahia, N.: Analysis of policy anomalies on distributed network security setups. In: Gollmann, D., Meier, J., Sabelfeld, A. (eds.) ESORICS 2006. LNCS, vol. 4189, pp. 496–511. Springer, Heidelberg (2006). doi:10.1007/11863908_30
Gouda, M.G., Liu, A.X.: Structured firewall design. Comput. Netw. J. (Elsevier) 51(4), 1106–1120 (2007)
Hall, S., Ngoup, L., Villemaire, R., Cherkaoui, O.: Distributed firewall anomaly detection through LTL model checking. In: 2013 IFIP/IEEE International Symposium on Integrated Network Management (IM 2013), pp. 194–201, May 2013
Hu, H., Ahn, G.-J., Kulkarni, K.: Detecting and resolving firewall policy anomalies. IEEE Trans. Dependable Secur. Comput. 9(3), 318–331 (2012)
Limboole sat solver (2016)
Liu, A.X.: Formal verification of firewall policies. In: ICC, pp. 1494–1498 (2008)
Liu, A.X., Gouda, M.G.: Diverse firewall design. IEEE Trans. Parallel Distrib. Syst. (TPDS) 19(8), 1237–1251 (2008)
Matsumoto, S., Bouhoula, A.: Automatic verification of firewall configuration with respect to security policy requirements. In: CISIS, pp. 123–130 (2008)
Mukkapati, N., Bhargavi, Ch.V.: Detecting policy anomalies in firewalls by relational algebra, raining 2D-box model. IJCSNS Int. J. Comput. Sci. Netw. Secur. 13(5), 94–99 (2013)
Yazidi, A., Bouhoula, A.: On assisted packet filter conflicts resolution: an iterative relaxed approach. In: 41st IEEE Conference on Local Computer Networks, LCN 2016, Dubai, United Arab Emirates, 7–10 November 2016, pp. 35–42 (2016)
Yuan, L., Mai, J., Su, Z., Chen, H., Chuah, C.-N., Mohapatra, P.: Fireman: a toolkit for firewall modeling and analysis. In: Proceedings of the 2006 IEEE Symposium on Security and Privacy, Washington, DC, USA. IEEE Computer Society (2006)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2017 Springer International Publishing AG
About this paper
Cite this paper
Saâdaoui, A., Ben Youssef Ben Souayeh, N., Bouhoula, A. (2017). A New FDD-Based Method for Distributed Firewall Misconfigurations Resolution. In: Themistocleous, M., Morabito, V. (eds) Information Systems. EMCIS 2017. Lecture Notes in Business Information Processing, vol 299. Springer, Cham. https://doi.org/10.1007/978-3-319-65930-5_30
Download citation
DOI: https://doi.org/10.1007/978-3-319-65930-5_30
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-65929-9
Online ISBN: 978-3-319-65930-5
eBook Packages: Computer ScienceComputer Science (R0)