NDLI: A method for moving rules in a network with multiple packet filters

Content Provider	IEEE Xplore Digital Library
Author	Mothersole, I. Reed, M.J.
Copyright Year	2011
Description	Author affiliation: School of Computer Science and Electronic Engineering, University of Essex, Wivenhoe Park, Colchester, CO4 3SQ, United Kingdom (Mothersole, I.; Reed, M.J.)
Abstract	In a network where multiple packet filtering firewalls exist, it can be beneficial to distribute the filtering rules in a certain way, for example, move all the rules towards the edge (main gateway) of the network, or to evenly distribute the rules over the firewalls. Configuring firewalls is a complex task and can be very error prone. To move rules between firewalls, many factors need to be considered to ensure the global security policy remains unchanged. In this paper we present a novel method which describes how to move rules between the firewalls and what, if any, changes need to be made to the rule(s). With this work we have also presented a generic network model which can be applied to any network topology and therefore allows the method for moving rules to be applied to any network topology (so long as it meets the criteria). Applications of the work include improving the network bandwidth utilisation, when unwanted traffic is filtered out early, and also improving the processing loads on each firewall, thus reducing delays and increasing traffic throughput. Factors to be considered when moving filtering rules include the relationships which can exist between filtering rules. Naive removal and insertion of filtering rules can alter inter-rule relationships and therefore also alter the security policy - the method we present ensures the security policy remains unchanged.
Starting Page	45
Ending Page	49
File Size	291068
Page Count	5
File Format	PDF
ISBN	9781457713002
e-ISBN	9781457713019
DOI	10.1109/CEEC.2011.5995823
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2011-07-13
Publisher Place	United Kingdom
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Computers Network topology Redundancy Fires Security IP networks Optimization
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

IP Traceback by Packet Marking Method with Bloom Filters

Simultaneous Analysis of Time and Space for Conflict Detection in Time-Based Firewall Policies

A simplified graph-based methodology for analyzing firewall rules

A new method about operating system identification

Optimising Rule Order for a Packet Filtering Firewall

A data driven firewall for faster packet filtering

A dynamic topology discovery method for smart substation networks

A Research about Redundant Data Packet in Unstructured P2P Network

DynFire: Dynamic firewalling in heterogeneous environments

A method for moving rules in a network with multiple packet filters

Similar Documents

IP Traceback by Packet Marking Method with Bloom Filters

Simultaneous Analysis of Time and Space for Conflict Detection in Time-Based Firewall Policies

A simplified graph-based methodology for analyzing firewall rules

A new method about operating system identification

Optimising Rule Order for a Packet Filtering Firewall

A data driven firewall for faster packet filtering

A dynamic topology discovery method for smart substation networks

A Research about Redundant Data Packet in Unstructured P2P Network

DynFire: Dynamic firewalling in heterogeneous environments

A method for moving rules in a network with multiple packet filters