On the safety and efficiency of firewall policy deployment

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2007, Pages 33-47

  Zhang, Charles C ^a   Winslett, Marianne ^a   Gunter, Carl A ^a  

^a UNIVERSITY OF ILLINOIS AT URBANA CHAMPAIGN   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER PROGRAMMING LANGUAGES; OPTIMIZATION; SECURITY OF DATA; THEOREM PROVING;

POLICY MANAGEMENT; POLICY SPECIFICATION;

COMPUTER SYSTEM FIREWALLS;

EID: 34548792398     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2007.32     Document Type: Conference Paper

References (38)

1. Check Point SmartCenter. http://www.checkpoint.com/products/smartcenter.
2. Cisco Firewall Service Module. http://www.cisco.com/en/US/products/hw/ modules/ps2706/ps4452/index.html.
3. Cisco PIX Firewall. http://www.cisco.com/en/US/products/hw/vpndevc/ ps2030.
4. Cisco Security Manager, http://www.cisco.com/en/US/products/ps6498/index. html.
5. Enterasys Matrix X Core Router. http://www.enterasys.com/products/ routing/x/.
6. Iptables Howto. http://www.netfilter.org/documentation/H0WT0/packet- filtering-H0WT0-7.html.
7. Juniper Networks JUNOSe Operating System, http://www.juniper.net/ techpubs/software/erx.
8. Juniper Networks NetScreen-Security Manager. http://www.juniper.net/ products/integrated/ns_sm.html.
9. Nokia IPSO. http://europe.nokia.com/A4153092.
10. ServGate EdgeForce. http://www.servgate.com/pdf/infosec_article.pdf.
11. S. Acharya, J. Wang, Z. Ge, T. F. Znati, and A. Greenberg. Traffic-aware firewall optimization strategies. In IEEE International Conference on Communications (ICC), Istanbul, Turkey, June 2006.
12. G. M. Adelson-Velskii and E. M. Landis. An algorithm for the organization of information. Soviet Math. Doclady, 3:1259-1263, 1962.
13. H. Adiseshu, S. Suri, and G. M. Parulkar. Detecting and resolving packet filter conflicts. In INFOCOM, pages 1203-1212, 2000.
14. E. S. Al-Shaer and H. H. Hamed. Firewall policy advisor for anomaly discovery and rule editing. In Integrated Network Management, pages 17-30, 2003.
15. F. Baboescu and G. Varghese. Fast and scalable conflict detection for packet classifiers. In IEEE International Conference on Network Protocols (ICNP), pages 270-279, 2002.
16. Y. Bartal, A. J. Mayer, K. Nissim, and A. Wool. Firmato: A novel firewall management toolkit. In IEEE Symposium on Security and Privacy, 1999.
17. S. M. Bellovin. Distributed firewalls.; login: magazine, special issue on security, November 1999.
18. M. Englund. Securing systems with host-based firewalls. Sun BluePrints OnLine, September 2001.
19. A. O. Freier, P. Karlton, and P. C. Kocher. Secure socket layer 3.0, IETF draft, November 1996.
20. Z. Fu, S. F. Wu, H. Huang, K. Loh, F. Gong, I. Baldine, and C. Xu. IPSec/VPN security policy: Correctness, conflict detection, and resolution. In POLICY Workshop, pages 39-56, 2001.
21. M. G. Gouda and X.-Y. A. Liu. Firewall design: consistency, completeness and compactness. In IEEE Int. Conf. Distributed Computing Systems (ICDCS), 2004.
22. H. Hamed and E. Al-Shaer. Dynamic rule-ordering optimization for high-speed firewall filtering. In ACM Symposium on Information, Computer and Communications Security (ASIACCS), March 2006.
23. D. S. Hirschberg. Algorithms for the longest common subsequence problem. J. ACM, 24(4):664-675, 1977.
24. J. W. Hunt and T. G. Szymanski. A fast algorithm for computing longest common subsequences. Commun. ACM, 20(5):350-353, 1977.
25. S. Ioannidis, A. D. Keromytis, S. M. Bellovin, and J. M. Smith. Implementing a distributed firewall. In ACM Conference on Computer and Communications Security, pages 190-199, 2000.
26. A. Keromytis. Strongman: A scalable solution to trust management in networks. PhD thesis, University of Pennsylvania, Philadelphia, 2001.
27. W. J. Masek and M. Paterson. A faster algorithm computing string edit distances. J. Comput. Syst. Sci., 20(1):18-31, 1980.
28. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver. The spread of the Sapphire/Slammer worm. Technical report, CAIDA, ICSI, Silicon Defense, UC Berkeley EECS and UC San Diego CSE, 2003.
29. E. W. Myers. An O(nd) difference algorithm and its variations. Algorithmica, 1(2):251-266, 1986.
30. N. Nakatsu, Y. Kambayashi, and S. Yajima. A longest common subsequence algorithm suitable for similar text strings. Acta Inf., 18:171-179, 1982.
31. J. Qian, S. Hinrichs, and K. Nahrstedt. ACLA: A framework for access control list (ACL) analysis and optimization. In Communications and Multimedia Security, 2001.
32. C. Roeckl. Stateful inspection firewalls. Juniper Networks White Paper, 2004.
33. I. Simon. Sequence comparison: some theory and some practice. In Electronic Dictionaries and Automata in Computational Linguistics, number 377, Saint Pierre d'Oléron, France, 1987.
34. J. D. Ullman, A. V. Aho, and D. S. Hirschberg. Bounds on the complexity of the longest common subsequence problem. J. ACM, 23(1): 1-12, 1976.
35. R. A. Wagner and M. J. Fischer. The string-to-string correction problem. J. ACM, 21(1):168-173, 1974.
36. A. Wool. A quantitative study of firewall configuration errors. IEEE Computer, 37(6):62-67, 2004.
37. T. Ylonen. SSH - secure login connections over the internet. In Proceedings of the 6th USENIX Security Symposium, Berkeley, CA, 1996.
38. L. Yuan, J. Mai, Z. Su, H. Chen, C.-N. Chuah, and P. Mohapatra. Fireman: A toolkit for firewall modeling and analysis. In IEEE Symposium on Security and Privacy (S&P'06), Oakland, CA, 2006.