LISA '07 – Abstract
Pp. 17–26 of the Proceedings
Inferring Higher Level Policies from Firewall Rules
Alok Tongaonkar, Niranjan Inamdar, and R. Sekar, Stony Brook University
Abstract
Packet filtering firewall is one of the most important mechanisms
used by corporations to enforce their security policy. Recent years
have seen a lot of research in the area of firewall management.
Typically, firewalls use a large number of low-level filtering rules
which are configured using vendor-specific tools. System administrators
start off by writing rules which implement the security policy of
the organization. They add/delete/change order of rules as the
requirements change. For example, when a new machine is added to
the network, new rules might be added to the firewall to enable
certain services to/from that machine. Making such changes to the
low-level rules is complicated by the fact that the effect of a
rule is dependent on its priority (usually determined by the position
of the rule in the rule set). As the size and complexity of a rule
set increases, it becomes difficult to understand the impact of a
rule on the rule set. This makes management of rule sets more error
prone. This is a very serious problem as errors in firewall
configuration mean that the desired security policy is not enforced.
Previous research in this area has focused on either building
tools that generate low-level firewall rules from a given security
policy or finding anomalies in the rules, i.e., verifying that the
rules implement the given security policy correctly. We propose a
technique that aims to infer the high-level security policy from
lowlevel representation. The first step in our approach is that of
generating flattened rules, i.e., rules without priorities,
which are equivalent to the given firewall rule set. Removal of
priorities from a rule set enables us to merge a number of rules
that have a similar effect. Our rule merging algorithm reduces the
size and complexity of the rule set significantly by grouping the
services, hosts, and protocols present in these
rules into various (possibly overlapping) classes. We have built a
prototype implementation of our
approach for iptables firewall rules. Our preliminary
experiments indicate that the technique infers security policy that
is at a sufficiently high level of abstraction to make it understandable
and debuggable.
- View the full text of this paper in HTML and PDF.
Listen to the presentation in
MP3 format.
Until November 2008, you will need your USENIX membership identification in order to access the full papers.
The Proceedings are published as a collective work, © 2007 by the USENIX Association. All Rights Reserved. Rights to individual papers remain with the author or the author's employer. Permission is granted for the noncommercial reproduction of the complete work for educational or research purposes. USENIX acknowledges all trademarks within this paper.
|
