Formal correctness of conflict detection for firewalls

FMSE'07 - Proceedings of the 2007 ACM Workshop on Formal Methods in Security Engineering

Volumn , Issue , 2007, Pages 22-30

  Capretta, Venanzio ^a   Stepien, Bernard ^a   Felty, Amy ^a   Matwin, Stan ^a  

^a UNIVERSITY OF OTTAWA   (Canada)

Author keywords

Coq; Firewall

Indexed keywords

ACCESS RULES; CONFLICT DETECTION; CONFLICT DETECTION ALGORITHMS; COQ PROOF ASSISTANT; CORRECTNESS PROOFS; FORMAL CORRECTNESS; FORMAL DEFINITION; ONE-RULE; PROGRAM EXTRACTION; SET OF RULES;

ALGORITHMS; COMPUTER SYSTEM FIREWALLS;

FORMAL METHODS;

EID: 77952368110     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1314436.1314440     Document Type: Conference Paper

References (33)

1. Ehab Al-Shaer, Hazem Hamed, Raouf Boutaba, and Masum Hasan. Conflict classification and analysis of distributed firewall policies. IEEE Journal on Selected Areas in Communications, 23 (10):2069-2084, October 2005.
2. Ehab S. Al-Shaer and Hazem H. Hamed. Firewall policy advisor for anomaly discovery and rule editing. In IFIP/IEEE Eighth International Symposium on Integrated Network Management, pages 17-30, 2003.
3. Ehab S. Al-Shaer and Hazem H. Hamed. Discoveryof policy anomalies in distributed firewalls. In Proceedings of IEEE Infocom, volume 4, pages 2605-2626, 2004.
4. Florin Baboescu and George Varghese. Fast and scalable conflict detection for packet classifiers. In Tenth IEEE International Conference on Network Protocols, pages 270-279, 2002.
5. Yair Bartal, Alain Mayer, Kobbi Nissim, and Avishai Wool. Firmato: A novel firewall management toolkit. ACM Transactions on Computer Systems, 22 (4):381-420, November 2004.
6. Yves Bertot and Pierre Castéran. Interactive Theorem Proving and Program Development. Coq'Art: The Calculus of Inductive Constructions. Springer, 2004.
7. James Boney. CISCO IOS in a Nutshell. O'Reilly, first edition, 2001.
8. F. Cuppens, N. Cuppens-Boulahia, and J. García-Alfaro. Detection and removal of firewall misconfiguration. In IASTED International Conference on Communication, Network, and Information Security, 2005.
9. P. Dybjer. Comparing integrated and external logics of functional programs. Science of Computer Programming, 14:59-79, 1990.
10. David Eppstein and S. Muthukrishnan. Internet packet filter management and rectangle geometry. In Twelfth Annual ACM-SIAM Symposium on Discrete Algorithms, pages 827-835, 2001.
11. Pasi Eronen and Jukka Zitting. An expert system for analyzing firewall rules. In 6th Nordic Workshop on Secure IT Systems, pages 100-107, 2001.
12. J.-Y. Girard. Linear logic and parallelism. In Mathematical Models for the Semantics of Parallelism, volume 280 of Lecture Notes in Computer Science, pages 166-182. Springer-Verlag, 1986.
13. Joshua D. Guttman. Filtering postures: Local enforcement for global policies. In IEEE Symposium on Security and Privacy, pages 120-129, 1997.
14. Joshua D. Guttman and Amy L. Herzog. Rigorous automated network security management. International Journal of Information Security, 2003. To appear.
15. Hazem Haded and Ehab Al-Shaer. Taxonomy of conflicts in network security policies. IEEE Communications Magazine, 44 (3):134-141, March 2006.
16. Adiseshu Hari, Subhash Suri, and Guru Parulkar. Detecting and resolving packet filter conflicts. In Proceedings of IEEE Infocom, volume 3, pages 1203-1212, 2000.
17. W. A. Howard. The formulae-as-types notion of construction. In J. P. Selding and J. R. Hindley, editors, To H. B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism, pages 479-490. Academic Press, 1980.
18. Pierre Letouzey. A new extraction for Coq. In Types for Proofs and Programs, Second International Workshop, volume 2646 of Lecture Notes in Computer Science, pages 200-219. Springer-Verlag, 2003.
19. Alex X. Liu and Mohamed G. Gouda. Complete redundancy detection in firewalls. In Data and Applications Security, volume 3654 of Lecture Notes in Computer Science, pages 196-209. Springer-Verlag, 2005.
20. Mahdi Mankai. Vérification et analyse des politiques de contrôle d'accès: Application au langage XACML. Master's thesis, Université du Québec en Outaouais, January 2005.
21. Mahdi Mankai and Luigi Logrippo. Access control policies: Modeling and validation. In K. Adi, D. Amyot, and L. Logrippo, editors, 5th NOTERE Conference (Nouvelles Technologies de la Répartition), pages 85-91, Gatineau, Canada, 2005.
22. Per Martin-Löf. Intuitionistic Type Theory. Bibliopolis, 1984. Notes by Giovanni Sambin of a series of lectures given in Padua, June 1980.
23. Alain Mayer, Avishai Wool, and Elisha Ziskind. Fang: A firewall analysis engine. In IEEE Symposium on Security and Privacy, pages 177-187, 2000.
24. Christine Paulin-Mohring. Extracting F (omega)'s programs from proofs in the calculus of constructions. In Proceedings of the 16th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pages 89-104, 1989.
25. Jiang Qian, Susan Hinrichs, and Klara Nahrstedt. ACLA: A framework for access control list (ACL) analysis and optimization. In Proceedings of Communications and Multimedia Security, 2001.
26. Jeff Sedayao. Cisco IOSAccess Lists. O'Reilly, June 2001.
27. Morten Heine B. Sørensen and P. Urzyczyn. Lectures on the Curry-Howard Isomorphism. Elsevier Science, 2006.
28. Sun Microsystems. A brief introduction to XACML. http://www.oasis-open. org/committees/-download.php/2713/-Brief-Introduction-to-XACML.html, 2003.
29. The Coq Development Team. LogiCal Project. The Coq Proof Assistant. Reference Manual. Version 8. INRIA, 2004. Available at the web page http://pauillac.inria.fr/coq/coq-eng.html.
30. Tomás E. Uribe and Steven Cheung. Automatic analysis of firewall and network intrusion detection system configurations. In ACM Workshop on Formal Methods in Security Engineering, pages 66-74, 2004.
31. Avishai Wool. Architecting the Lumeta firewall analyzer. In 10th USENIX Security Symposium, 2001.
32. Lihua Yuan, Jianning Mai, Zhendong Su, Hao Chen, Chen-Nee Chuah, and Prasant Mohapatra. FIREMAN: A toolkit for firewall modeling and analysis. In IEEE Symposium on Security and Privacy, 2006.
33. Charles C. Zhang, Marianne Winslett, and Carl A. Gunter. On the safety and efficiency of firewall policy deployment. In IEEE Symposium on Security and Privacy, pages 33-50, 2007.