Authors:
S. Pozo
;
A. J. Varela-Vaca
;
R. M. Gasca
and
R. Ceballos
Affiliation:
University of Seville, Spain
Keyword(s):
Isolation, Inconsistency, Conflict, Anomaly, Firewall, Acl, Ruleset.
Related
Ontology
Subjects/Areas/Topics:
Access Control
;
Data and Systems Security
;
Data Engineering
;
Databases and Data Security
;
Information and Systems Security
;
Internet Technology
;
Security Verification and Validation
;
Web Information Systems and Technologies
Abstract:
Writing and managing firewall ACLs are hard, tedious, time-consuming and error-prone tasks for a wide range of reasons. During these tasks, inconsistent rules can be introduced. An inconsistent firewall ACL implies in general a design fault, and indicates that the firewall is accepting traffic that should be denied or vice versa. This can result in severe problems such as unwanted accesses to services, denial of service, overflows, etc. However, the administrator is who ultimately decides if an inconsistent rule is a fault or not. Although many algorithms to detect and manage inconsistencies in firewall ACLs have been proposed, they have different drawbacks regarding different aspects of the consistency diagnosis problem, which can prevent their use in a wide range of real-life situations. In this paper, we review these algorithms along with their drawbacks, and propose a new divide and conquer based algorithm, which uses specialized abstract data types. The proposed algorithm return
s consistency results over the original ACL. Its computational complexity is better than the current best algorithm for inconsistency isolation, as experimental results will also show
(More)