A stateful CSG-based distributed firewall architecture for robust distributed security

1st International Conference on Communication Systems and Networks and Workshops, COMSNETS 2009

Volumn , Issue , 2009, Pages

  Ramsurrun, V ^a  

^a UNIVERSITY OF MAURITIUS   (Mauritius)

Author keywords

Distributed cluster security; Distributed firewall; Layer 2 per packet load balancing; stateful CSG architecture

Indexed keywords

BOTTOM UP APPROACH; CLUSTER SECURITY; CONVERGENCE TIME; DISTRIBUTED CLUSTER SECURITY; DISTRIBUTED FIREWALL; DISTRIBUTED SECURITY; END USERS; FIREWALL POLICIES; HOST-BASED; LAYER 2 PER-PACKET LOAD BALANCING; NETWORK ADMINISTRATOR; NETWORK LOAD; REAL-TIME SECURITY; STATEFUL CSG ARCHITECTURE; TAMPER RESISTANCE; X.509 CERTIFICATES;

COMMUNICATION SYSTEMS; COMPUTER VIRUSES; GATEWAYS (COMPUTER NETWORKS);

COMPUTER SYSTEM FIREWALLS;

EID: 66549092515     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/COMSNETS.2009.4808875     Document Type: Conference Paper

References (31)

1. V. Ramsurrun, and K. M. S. Soyjaudah, "Efficient cluster security gateway architecture for per-packet load balanced IP filtering on switched clusters," in 2006 Proc. CSNDSP '06 Conf., pp. 256-261.
2. S. M. Bellovin, "Distributed firewalls," ;login: magazine, special issue on security, 1999.
3. S. Ioannidis, A. D. Keromytis, S. M. Bellovin, and J. M. Smith, "Implementing a distributed firewall," in Proc. 7th ACM Conf. Computer and communications security, Athens, 2000, pp. 190-199. (Pubitemid 32393918)
4. M. Blaze, J. Feigenbaum, J. Ioannidis, and A. Keromytis, "The KeyNote Trust-Management System Version 2," RFC (Informational) 2704, Internet Engineering Task Force, 1999.
5. Y. Bartal, A. Mayer, K. Nissim, and A. Wool, "Firmato: A Novel Firewall Management Toolkit," in Proc. IEEE Symposium Security and Privacy, 1999, pp. 17-31.
6. M. Gangadharan, and K. Hwang, "Micro-firewalls for dynamic network security with distributed intrusion detection," in IEEE Int. Symposium Network Computing and Applications (NCA 01, 2001.
7. W. Li (2000). Distributed Firewall [Online]. Available: http://citeseer.ist.psu.edu/liOOdistributed.htrnl
8. M. Gangadharan, and K. Hwang, "Intranet security with micro-firewalls and mobile agents for proactive intrusion response," in IEEE Int. Conf. Computer Networks and Mobile Computing, 2001.
9. W. Odom, "CCENT/CCNA ICND1 Official Exam Certification Guide," 2nd ed. Indianapolis, USA: Cisco Press, 2008, pp. 253-256.
10. W. R. Stevens, B. Fenner, and A. M. Rudoff, Unix Network Programming: The Sockets Networking API Volume 7,3rd ed., Addison- Wesley, 2004, pp. 595-598.
11. Keepalived website (2007). Keepalived for Linux-Linux High Availability [Online]. Available: http://www.keepalived.org/index.html
12. Ebtables website (2007). Who's behind Ebtables? [Online]. Available: http://ebtables.sourceforge,net/about,html#behind
13. Bridge website (2007). Bridge [Online]. Available: http://linux- net.osdl.org/index.php/Bridge
14. P. Hollenback (2005). Improving Network reliability with Keepalived [Online]. Available: http://www.linuxdevcenter.eom/lpt/a/6162
15. L. Ortega (2007). GNU Mac Changer [Online]. Available: http://www.alobbs.com/macchanger/
16. ClarkConnect website (2007). Howtos-Clustering with LVS [Online]. Available: http://www.clarkconnect.com/wiki/index.php?title=Howtos-Clustering- with-LVS
17. P. N. Ayuso (2007). conntrack-tools: Connection tracking userspace tools for Linux [Online]. Available: http://people.netfilter.org/pablo/conntrackd/
18. Cisco Systems Inc. (2005). Configuring Network Security with ACLs [Online]. Available: http://www.cisco.com/en/US/products/hw/switches/ps628/ products conf iguration guide chapter09186a00800d84c8.html
19. R. Spenneberg (2007). IPsec HOWTO (Revision 0.9.96) [Online]. Available: http://www.ipsec-howto.org/
20. M. Gates, A. Tirumala, J. Dugan, and K. Gibbs (2003). Iperf version 1.7.0: Iperf User Docs [Online]. Available: http://www.itl.ohiou.edu/iperf-doc/
21. K. U. Rommel (2005). NETIO-Network Benchmark, Version 1.26 [Online]. Available: http://www.ars.de/ars/ars.nsf/docs/netio
22. S. M. Specht, and R. B. Lee, "Distributed Denial of Service: Taxonomies of Attacks, Tools, and Countermeasures," in 2004 Proc. 17th Int. Conf. Parallel and Distributed Computing Systems, pp. 543- 550.
23. P. Ferguson, and D. Senie, "Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing," RFC 2827,2000.
24. A. D. Keromytis, S. Ioannidis, M. B. Greenwald, and J. M. Smith, "The STRONGMAN Architecture," in Proc. DARPA Information Survivability Conference and Exposition, vol.1,2003.
25. A. D. Keromytis, K. G. Anagnostakis, S. Ioannidis, M. B. Greenwald, and J. M. Smith, "Managing Access Control in Large-Scale Heterogeneous Networks," in Proc. NATO C3 Symposium Interoperable Networks for Secure Communications (INSC'03), 2003.
26. R. Rubin (2002). Smokey: A User-Based Distributed Firewall System [Online]. Available: http://www.cs.berkeley.edu/~daw/teaching/cs261- f02/reports/rubin.pdf
27. M. Hide, and W. H. Sanders, "Barbarians in the Gate: An Experimental Validation of NIC-based Distributed Firewall Performance and Flood Tolerance," in 2006 Proc. Int. Conf. Dependable Systems and Networks (DSN 2006, pp. 209-216.
28. rd DARPA Information Survivability Conf., vol.2, pp. 81-83.
29. C. Payne, and T. Markham, "Architecture and applications for a distributed embedded firewall," in Proc. 17th Annual Computer Security Applications Conference (ACSAC 2001), 2001, pp. 329-336.
30. rd DARPA Information Survivability Conf., vol.2, pp. 260-265.
31. T. Markham, and C. Payne, "Security at the network edge: A distributed firewall architecture," in 2001 Proc. 2nd DARPA Information Survivability Conference and Exposition (DISCEXII).