NDLI: Firewall placement in a large network topology

Content Provider	IEEE Xplore Digital Library
Author	Smith, R.N. Bhattacharya, S.
Copyright Year	1997
Description	Author affiliation: Dept. of Comput. Sci. & Eng., Arizona State Univ., Tempe, AZ, USA (Smith, R.N.)
Abstract	Network security is an integral component of a multi-user distributed information environment. Firewall (FW) technology is a popular approach to build secure networks, and a plethora of FWs have been designed. Our research focuses on the placement of FWs (i.e. an operations research approach) in a large, complex network system, or a system of systems. A key contribution of this research is to propose the concept of a FW cascade, i.e. a chain of FWs, which could be placed in the path between a potential attack point and a network node with sensitive data. Among other benefits, the FW cascade offers two key benefits: (1) increased comprehensiveness (viz. address, port, service, user ID and direction) of security protection; and (2) most importantly, enhancing the degree of confidence that the network security engineer could expect from the underlying set of FWs and the overall end-to-end security protection that is achieved. This results in a novel capability, where a network security engineer can provide completeness and high confidence in the security attributes across the network. We propose a decomposition of the security characters of a FW and a suite of FW placement heuristics which allows us to place the FWs across the network while optimizing cost and maximizing security protection. Minimization of delay is another optimization goal. Performance is depicted using simulation.
Starting Page	40
Ending Page	45
File Size	599314
Page Count	6
File Format	PDF
ISBN	0818681535
ISSN	10710485
DOI	10.1109/FTDCS.1997.644701
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	1997-10-31
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Intelligent networks Network topology Protection Data security Passive filters Filtering Computer science Computer hacking Art
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Security at the network edge: a distributed firewall architecture

A topological approach to detect conflicts in firewall policies

Network processor acceleration for a Linux* netfilter firewall

Intelligent Autonomic Strategy to Attacks in Network Infrastructure Protection: Feedback Methods to IDS, Using Policies, Alert Filters and Firewall Packet Filters for Multiple Protocols

Packet filtering in bridge

Research and Design of NIDS Based on Linux Firewall

Tuple Based Approach for Anomalies Detection within Firewall Filtering Rules

Design and implementation of firewall simulation based on SSFNet

An Approach for Automated Network-Wide Security Analysis

Firewall placement in a large network topology

Similar Documents

Security at the network edge: a distributed firewall architecture

A topological approach to detect conflicts in firewall policies

Network processor acceleration for a Linux* netfilter firewall

Intelligent Autonomic Strategy to Attacks in Network Infrastructure Protection: Feedback Methods to IDS, Using Policies, Alert Filters and Firewall Packet Filters for Multiple Protocols

Packet filtering in bridge

Research and Design of NIDS Based on Linux Firewall

Tuple Based Approach for Anomalies Detection within Firewall Filtering Rules

Design and implementation of firewall simulation based on SSFNet

An Approach for Automated Network-Wide Security Analysis

Firewall placement in a large network topology