FT-FW: A cluster-based fault-tolerant architecture for stateful firewalls

Computers and Security

Volumn 31, Issue 4, 2012, Pages 524-539

  Ayuso, Pablo Neira ^a   Gasca, Rafael M ^a   Lefevre, Laurent ^b  

^a UNIVERSITY OF SEVILLE   (Spain)

^b UNIVERSITÉ DE LYON   (France)

Author keywords

Access control; Computer networks; Computer security; Fault tolerance; Stateful firewall

Indexed keywords

CLUSTER-BASED; EVALUATION EXPERIMENTS; FAULT-TOLERANT; NETWORK SERVICES; RESEARCH EFFORTS; SINGLE POINT; STATEFUL FIREWALLS;

ACCESS CONTROL; CLUSTER COMPUTING; COMPUTER NETWORKS; COMPUTER OPERATING SYSTEMS; FAULT TOLERANCE; INTERNET PROTOCOLS; NETWORK ARCHITECTURE; NETWORK PERFORMANCE; SECURITY OF DATA;

COMPUTER SYSTEM FIREWALLS;

EID: 84861098483     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2012.01.011     Document Type: Article

References (48)

1. E. Al-Shaer, and H. Hamed Taxonomy of Conflicts in network security policies IEEE Communications Magazine 44 3 2006
2. E. Al-Shaer, H. Hamed, R. Boutaba, and M. Hasan Conflict Classification and Analysis of distributed firewall policies IEEE Journal on Selected Areas in Communications (JSAC) 23 10 2005
3. G. Attebury, and B. Ramamurthy Router and firewall redundancy with openbsd and carp Bf ICC '06 IEEE International Conference on communications vol. 1 2006 146 151 (Pubitemid 351575303)
4. A. Avizienis, and J. Kelly Fault tolerance by design diversity: concepts and experiments Computer 17 1984 67 80 (Pubitemid 14601079)
5. N. Ayari, D. Barbaron, L. Lefevre, and P. Primet T2CP-AR: a system for transparent TCP active replication AINA '07: Proceedings of the 21st international conference on advanced networking and applications 2007 648 655 (Pubitemid 47430939)
6. N. Ayari, D. Barbaron, L. Lefèvre, and P. Vicat-Blanc Primet Fault tolerance for highly available internet services: concepts, approaches, and issues IEEE Communications Surveys and Tutorials 10 2 Jul. 2008 34 46
7. Y. Bartal, A. Mayer, K. Nissim, and A. Wool Firmato: a novel firewall management toolkit ACM Transactions on Computer Systems 22 4 Nov. 2004 381 420 (Pubitemid 40009830)
8. A. Cassen Keepalived: health checking for LVS & high availability 2002 http://www.linuxvirtualserver.org
9. Cisco Systems Inc. Cisco asa 5500 series configuration guide: information about high availability 2011 http://www.cisco.com/en/US/docs/security/asa/ asa82/configuration/guide/ha-overview.html
10. Free Software Foundation GnuTLS - GNU transport layer security library 2011 http://www.gnutls.org
11. A. Gorti A faul tolerant VoIP implementation based on Open Standards IEEE Proceedings EDCC-6 Oct. 2006 35 38 (Pubitemid 47159801)
12. M. Gouda, and A. Liu A model of stateful firewalls and its properties Proceedings of the International conference on Dependable Systems and Networks (DSN) Jun. 2005 128 137 (Pubitemid 41538228)
13. D. Gwynne Redesign of the pfsync protocol 2009 http://www.undeadly.org/ cgi?action=article&sid=20090220014805
14. Hartmeier, D., 2001. http://www.benzedrine.cx/pf-paper.html. http://www.benzedrine.cx/pf-paper.html.
15. Hemminger, S., 2005. Network Emulation with NetEm. Linux Conf Australia.
16. J.N. Herder, H. Bos, B. Gras, P. Homburg, and A.S. Tanenbaum Construction of a highly dependable operating system Proc. 6th European dependable computing Conf 2006
17. R. Hinden RFC 3768: Virtual Router Redundancy Protocol (VRRP) Apr. 2004
18. J. Maloy TIPC: transparent Inter protocol communication protocol May 2006
19. M. Marwah, S. Mishra, and C. Fetzer TCP server fault tolerance using connection migration to a backup server Proc. IEEE Intl. Conf. on Dependable Systems and Networks (DSN) Jun. 2003 373 382
20. R. McBride Pfsync: firewall failover with pfsync and CARP 2004 http://www.countersiege.com/doc/pfsync-carp/
21. A.B. Nagarajan, F. Mueller, C. Engelmann, and S.L. Scott Proactive fault tolerance for hpc with xen virtualization ICS '07: proceedings of the 21st annual international conference on Supercomputing 2007 ACM New York, NY, USA 23 32 (Pubitemid 47281603)
22. P. Narasimhan, T.A. Dumitras, A.M. Paulos, S.M. Pertet, C.F. Reverte, and J.G. Slember MEAD: support for real-time fault-tolerant CORBA: research articles Concurrency and Computation: Practice and Experience 17 12 2005 1527 1545 (Pubitemid 41375369)
23. P. Neira-Ayuso Conntrack-tools: the connection tracking user-space tools for GNU/Linux 2006 http://conntrack-tools.netfilter.org
24. P. Neira-Ayuso Netfilter's connection tracking system The USENIX Magazine LOGIN 32 3 2006 34 39
25. P. Neira-Ayuso http-client-benchmark: a simple HTTP client benchmarking tool similar to Willy Tarreau's inject 2008 http://1984.lsi.us.es/git/http- client-benchmark
26. P. Neira-Ayuso, R.M. Gasca, and L. Lefevre FT-FW: efficient connection failover in cluster-based stateful firewalls Proceedings of the 16th Euromicro conference on parallel, distributed and network-based processing (PDP'08) Feb. 2008 573 580
27. P. Neira-Ayuso, R.M. Gasca, and L. Lefevre Demystifying cluster-based fault-tolerant firewalls IEEE Internet Computing 13 2009 31 38
28. P. Neira-Ayuso, L. Lefevre, and R.M. Gasca hft-fw: hybrid fault-tolerance for cluster-based stateful firewalls International conference on parallel and distributed systems vol. 0 2008 525 532
29. P. Neira-Ayuso, L. Lefevre, and R.M. Gasca Multiprimary support for the availability of cluster-based stateful firewalls using FT-FW Proceedings ESORICS'08: European symposium on research in computer security Oct. 2008 [Malaga, Spain]
30. Netfilter Core Team iptables: the free software firewalling tool for linux 1999 http://iptables.netfilter.org
31. Pablo Neira-Ayuso, Rafael M. Gasca, and L. L. Communicating between the kernel and user-space in Linux using Netlink sockets Software: Practice and Experience 40 9 Aug. 2010
32. D. Powell Distributed fault tolerance: lessons learnt from Delta-4 IEEE micro vol. 14 Feb. 1994 36 47
33. S. Pozo, R. Ceballos, and R.M. Gasca Afpl, an abstract language model for firewall acls ICCSA (2)'08 2008 468 483
34. S. Pozo, R. Ceballos, and R.M. Gasca A quadratic, complete, and minimal consistency diagnosis process for firewall ACLs 2010 Advanced Information Networking and Applications (AINA)
35. E. Rescorla, and N. Modadugu RFC 4347-Datagram transport layer security 2006 http://tools.ietf.org/html/rfc4347
36. A. Robertson Linux HA project 1999 http://www.linux-ha.org
37. Sebastien Godard System performance tools for linux 2011 http://sebastien.godard.pagesperso-orange.fr/
38. F. Sultan, A. Bohra, S. Smaldone, Y. Pan, P. Gallard, and I. Neamtiu Recovering Internet service sessions from operating system failures IEEE Internet computing Apr. 2005
39. F. Sultan, K. Srinivasan, D. Iyer, and L. Iftode Migratory TCP: connection migration for service Continuity in the internet 22nd international conference on distributed computing systems 2002
40. The OpenSSL Project OpenSSL - Open Source library that implements the SSL and TLS protocols 2011 http://www.openssl.org
41. G. Vallee, and K. Charoenpornwattana A framework for proactive fault tolerance Proceedings of 3rd international conference on Availability, Reliability and Security (ARES) Mar. 2008
42. G. Vallee, T. Naughton, C. Engelmann, H. Ong, and S.L. Scott System-level virtualization for high performance computing Proceedings of the 16th Euromicro Conference on Parallel, Distributed and Network-Based Processing (PDP 2008) vol. 0 2008 636 643
43. K.V. Vishwanath, and N. Nagappan Characterizing cloud computing hardware reliability Proceedings of the 1st ACM Symposium on cloud computing, SoCC 2010, Indianapolis, Indiana, USA, June 10-11 2010 193 204
44. D.D. Welch-Abernathy Essential check point FireWall-1 NG: an installation, configuration, and troubleshooting guide 2004 Pearson Higher Education
45. Welte, H., 2004. ct-sync: state replication of ip-conntrack. Linux Symposium, Ottawa, Canada 2.
46. Willy Tarreau httpterm: HTTP server benchmarking tool 2006 http://1wt.eu/tools/httpterm/
47. A. Wool A quantitative study of firewall configuration errors IEEE Computer 37 6 2004 62 67
48. R. Zhang, T. Adelzaher, and J. Stankovic Efficient TCP connection failover in web server cluster IEEE INFOCOM 2004 Mar. 2004